Transaction risk analysis method and device

Abstract

The embodiment of the invention provides a transaction risk analysis method and device. The method comprises the following steps: acquiring a transaction group containing a plurality of transaction records, and constructing a transaction graph according to the transaction group; the plurality of transaction records comprise transaction records related to a target user in a predetermined time period; searching a plurality of mode sub-graphs representing a plurality of risk modes in the transaction graph to obtain matched sub-graphs; searching risk knowledge related to the risk mode represented by the matching sub-graph from a knowledge base; case analysis of a transaction case similar to the transaction graph is searched from a case library; and inputting the plurality of transaction records, the risk knowledge and the case analysis into a first large language model to obtain a transaction risk analysis result about the transaction group output by the first large language model.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of machine learning, and in particular, to a transaction risk analysis method and device using a large language model. Background Art

[0002] In the financial field, transaction risk analysis, especially the detection and analysis of illegal fund transfers, faces huge challenges. In recent years, the capabilities of large language models (LLMs) have increased rapidly and played an important role in many fields. Although LLMs perform well in natural language related tasks, the effect of directly using LLMs for transaction risk analysis is not good.

[0003] Therefore, it is expected that there will be an improved solution that utilizes LLMs to achieve better performance in transaction risk analysis tasks. Summary of the invention

[0004] One or more embodiments of this specification describe a transaction risk analysis solution, which retrieves risk knowledge and case analysis through graph retrieval, and inputs the retrieved risk knowledge and case analysis together with multiple transaction records included in a transaction group into a large language model, thereby improving the transaction risk analysis capability of the large language model for the transaction group.

[0005] According to a first aspect, a transaction risk analysis method is provided, comprising: obtaining a transaction group including a plurality of transaction records, and constructing a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to a target user in a predetermined period of time; searching the transaction graph for a plurality of pattern subgraphs representing a plurality of risk patterns to obtain a matching subgraph; searching a knowledge base for risk knowledge related to the risk pattern represented by the matching subgraph; searching a case analysis of a transaction case similar to the transaction graph from a case base; and inputting the plurality of transaction records, the risk knowledge, and the case analysis into a first large language model together to obtain a transaction risk analysis result on the transaction group output by the first large language model.

[0006] According to one embodiment, searching the transaction graph for a number of pattern subgraphs representing a number of risk patterns includes: using a number of groups of detection rules preset for the number of risk patterns respectively to detect whether there are corresponding pattern subgraphs in the transaction graph.

[0007] In one embodiment, searching for case analysis of transaction cases similar to the transaction graph from a case library includes: obtaining a first embedded representation of the transaction graph; calculating the similarity between the first embedded representation and a second embedded representation of the transaction graph corresponding to each transaction case in the case library; and obtaining case analysis text corresponding to one or more transaction cases with the highest similarity.

[0008] In a further embodiment, obtaining a first embedded representation of the transaction graph includes: encoding each node in the transaction graph using a language model to obtain a first vector representation of each node; processing the first vector representation of each node in the transaction graph using a graph neural network to obtain a second vector representation of each node; and aggregating the second vector representations of all nodes in the transaction graph to obtain the first embedded representation of the transaction graph.

[0009] In a further embodiment, each node in the transaction graph is encoded using a language model to obtain a first vector representation of each node, including: using a language model to encode the description text of the transaction record corresponding to each edge in the transaction graph to obtain an edge representation vector of each edge; for any node, the first vector representation of the node is determined based on the edge representation vectors of all its connected edges.

[0010] According to one embodiment, obtaining a transaction group including multiple transaction records includes: obtaining a first transaction record of a target user within a predetermined period of time, and a second transaction record of other users who have transaction behaviors with the target user within the predetermined period of time, to obtain a transaction group including multiple transaction records.

[0011] According to one embodiment, the case analysis includes an evaluation conclusion on whether the transaction case has risks and its risk pattern, and the reasoning process for reaching the evaluation conclusion; the transaction risk analysis result includes an analysis conclusion on whether the transaction group has risks and its risk pattern, and the reasoning process for reaching the analysis conclusion.

[0012] In one embodiment, the case library is constructed in the following manner: extracting a sample transaction group from a target data set, the sample transaction group having a first label of whether it is a risky transaction and a second label of the risk pattern it has; inputting the first label and the second label of each transaction in the sample transaction group into a second largest language model, and making it output reasoning steps with the first label and the second label as evaluation conclusions; taking the sample transaction group as a transaction case, and taking the first label, the second label and the reasoning steps as corresponding case analysis, and adding them to the case library.

[0013] In a further embodiment, the target data set is constructed in the following manner: serialized transaction records are generated through a third language model and added to the target data set as normal transactions; based on the definition rules of the several risk modes and the data distribution of real transaction data, a simulator is used to generate transaction groups under each risk mode, and the first label and the second label are added to the transaction groups and then added to the target data set.

[0014] According to one embodiment, the method further includes: constructing a training data set, using the training data set to fine-tune a general large language model to obtain the first large language model, wherein each piece of training data in the training data set includes a sample transaction group, risk knowledge related to a risk pattern matching the sample transaction group found from the knowledge base, case analysis similar to the sample transaction group found from the case base, and expected model output.

[0015] According to one embodiment, the several risk modes include one or more of the following: a fast-in-fast-out mode; a circular trading mode; a dispersion-first-then-aggregation mode; a aggregation-first-then-dispersion mode.

[0016] According to a first aspect, a transaction risk analysis device is provided, comprising: an acquisition unit, configured to acquire a transaction group including a plurality of transaction records, and construct a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to a target user in a predetermined period of time; a first search unit, configured to search the transaction graph for a plurality of pattern subgraphs representing a plurality of risk patterns, and obtain matching subgraphs; and search a knowledge base for risk knowledge related to the risk pattern represented by the matching subgraphs; a second search unit, configured to search a case analysis of a transaction case similar to the transaction graph from a case base; and an analysis unit, configured to input the plurality of transaction records, the risk knowledge, and the case analysis together into a first large language model, and obtain a transaction risk analysis result on the transaction group output by the first large language model.

[0017] According to a third aspect, a computer program product is provided, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0018] According to a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0019] According to a fifth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method of the first aspect is implemented.

[0020] In an embodiment of the present specification, a transaction graph is constructed according to a transaction group, and relevant risk knowledge and cases are searched for respectively through subgraph search and graph matching based on the transaction graph, and the found risk knowledge and cases are respectively input into the first large language model together with multiple transaction records included in the transaction group, thereby improving the transaction risk analysis capability of the large language model for the transaction group. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0022] Figure 1 A schematic diagram showing the principle of using LLMs to perform transaction risk analysis tasks.

[0023] Figure 2 A flow chart of a transaction risk analysis method according to an embodiment is shown.

[0024] Figure 3 Pattern subgraphs showing four typical money laundering risk patterns.

[0025] Figure 4 A schematic diagram of the process of retrieving risk knowledge is shown.

[0026] Figure 5 A schematic diagram of the process of retrieving case analysis is shown.

[0027] Figure 6 A schematic structural diagram of a transaction risk analysis device according to an embodiment is shown. DETAILED DESCRIPTION

[0028] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0029] In the description of this specification, words such as "exemplary", "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary", "for example" or "for example" in this specification should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0030] In the description of this specification, the term "and / or" is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist at the same time. In addition, unless otherwise specified, the term "plurality" means two or more.

[0031] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprises", "has" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0032] At present, case analysis in the field of transaction risk control is highly dependent on manual analysis by experts in the field of risk control, which consumes a lot of manpower and has poor timeliness. Transaction risk discovery methods based on traditional machine learning models (such as tree models and graph models) usually model risk discovery as a classification problem, and identify risky users and transactions by training classification models. However, this method cannot provide an interpretable analysis process and still relies on further manual analysis.

[0033] LLMs is a deep neural network model with a very large number of parameters. It is trained based on massive amounts of text data. It can understand and generate coherent and grammatical natural language text, and contains rich world knowledge, bringing revolutionary progress in tasks such as text generation, machine translation, and knowledge question answering.

[0034] Although LLMs perform well in natural language-related tasks, there are still the following challenges and difficulties in directly using LLMs for transaction risk analysis: 1) Lack of relevant risk control knowledge. General large language models are based on general text training and have rich common sense, but they lack the necessary expertise to complete professional tasks such as transaction risk analysis (such as illegal fund transfer analysis); 2) Weak transaction event correlation analysis capabilities. General large language models have strong modeling capabilities for sequence data such as natural language, but are relatively weak in analyzing graph structure information such as the correlation of transaction events.

[0035] Retrieval-Augmented Generation (RAG) technology combines information retrieval and large language generation models, dynamically retrieves relevant documents, enhances the contextual information of the generation model, and enables the model to flexibly utilize large-scale external data sets and knowledge sets, thereby improving the accuracy and reliability of text generation. RAG technology improves the interpretability and real-time performance of the system and is suitable for applications such as question-answering systems, dialogue systems, and text summarization.

[0036] However, transaction risk analysis tasks are significantly different from general question-answering tasks. Transaction risk analysis tasks require the model to have not only domain knowledge, but also strong behavioral data analysis capabilities. In addition, transaction data is different from general text data. Transaction data not only contains rich semantic information, but also displays complex transaction graph structure information, which poses a huge challenge to existing retrieval-based methods (such as RAG technology).

[0037] In view of this, the embodiments of this specification propose a knowledge-case graph retrieval enhancement generation framework, which retrieves domain knowledge and case analysis through graph retrieval to assist LLMs in performing transaction risk analysis tasks. More specifically, the framework can use a subgraph retrieval engine to retrieve professional knowledge (i.e., risk knowledge) related to risk patterns based on subgraph features in the transaction graph, and use a case matching engine to retrieve related case analysis based on overall transaction graph features. The retrieved risk knowledge and case analysis can be input into LLMs together with the transaction data to be analyzed.

[0038] The risk knowledge retrieved by the risk knowledge retrieval method based on subgraph structure matching enables the general large language model to have the ability to analyze transaction risks, especially the ability to analyze transaction risk patterns that may exist in the transaction group. The case analysis retrieved by the case retrieval method based on graph representation (i.e., the overall transaction graph characteristics) not only includes the risk assessment conclusion of the case, but also generally includes the reasoning process for reaching the conclusion. In this way, case analysis enhances the large language model's ability to analyze the correlation of transaction events, and makes the transaction risk analysis results generated by the large language model highly interpretable. As a result, LLMs can complete risk control case analysis tasks based on transaction data with very little human intervention, provide highly interpretable analysis results, and greatly improve the usability of large language models in risk control tasks.

[0039] Therefore, by combining risk knowledge and case analysis, the risk analysis capabilities of LLMs can be effectively improved. Experiments show that the framework can improve the accuracy and coverage of different types of LLMs by nearly 50%, and the accuracy can be almost tripled.

[0040] Figure 1 A schematic diagram showing the principle of using LLMs to perform transaction risk analysis tasks.

[0041] like Figure 1As shown, the original transaction data includes multiple transaction records. Each transaction record may include, but is not limited to, field information such as transaction time (Time), amount (Amount), source party (Source), target party (Target), and details (Detail). The source party and the target party refer to the two parties involved in the transaction. Specifically, the source party may refer to the initiator of the transaction, and the target party may refer to the recipient of the transaction. Details may refer to, but are not limited to, transaction type information such as transfer and payment.

[0042] First, a transaction graph is constructed based on the original transaction data. Both parties involved in the transaction in the original transaction data can be used as nodes in the transaction graph. The connecting edges between nodes represent the transaction behaviors between nodes, and each connecting edge corresponds to a transaction record.

[0043] Next, risk knowledge retrieval and case analysis retrieval are performed respectively. Among them, risk knowledge retrieval and case analysis retrieval can be performed simultaneously without any order. Risk knowledge retrieval refers to using a subgraph search engine to search for several pattern subgraphs representing several risk patterns in the transaction graph, and then searching for risk knowledge related to the risk patterns represented by the searched pattern subgraphs from the knowledge base. Case analysis retrieval refers to using a case matching engine to search for case analysis of transaction cases similar to the transaction graph from the case library.

[0044] Finally, a prompt word Prompt is constructed based on transaction data, risk knowledge and case analysis, and input into the large language model so that the large language model can perform transaction risk analysis on the transaction data based on risk knowledge and case analysis. Risk knowledge can compensate for the transaction risk analysis knowledge that LLMs lack during the pre-training process, especially the risk knowledge related to potential risk patterns in the transaction graph. Case analysis can provide LLMs with reasoning details of similar cases. Therefore, by providing risk knowledge, case analysis and transaction data to be analyzed as Prompt to LLMs, the accuracy of the transaction risk analysis results generated by LLMs can be improved, and highly interpretable transaction risk analysis results can be obtained. Exemplarily, Prompt can also include instruction information described in natural language, and the instruction information can be descriptive information for the transaction risk analysis task. The instruction information can improve the relevance of the content generated by LLMs to the transaction risk analysis task.

[0045] The specific implementation process of the above technical concept is described below.

[0046] Figure 2 The flowchart of a transaction risk analysis method according to an embodiment is shown. It should be understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. In addition, the model architecture corresponding to the technical concept of the method will be used in both the training stage and the use stage. Figure 2 The forward inference process shown makes predictions.

[0047] In execution Figure 2 Before the transaction risk analysis method is implemented, it is necessary to build Figure 1 The subgraph search engine, knowledge base and case base shown in FIG. To construct the subgraph search engine and knowledge base, several risk patterns (and their pattern subgraphs) can be predefined, and based on the definition or rules of each risk pattern, a subgraph search engine can be constructed, and the description of each risk pattern and other information can be stored in the knowledge base.

[0048] In order to create a more detailed case library, multiple representative transaction cases can be selected, and case analysis of these transaction cases can be obtained using human analysis (such as expert analysis) or LLMs analysis.

[0049] In some embodiments, the case library can be constructed in the following manner. A sample transaction group is extracted from the target data set, and the sample transaction group has a first label of whether it is a risky transaction and a second label of the risk mode it has. Each transaction in the sample transaction group, the first label and the second label are input into the large language model, and the large language model is made to output the reasoning steps with the first label and the second label as the evaluation conclusion. The sample transaction group is used as a transaction case, and the first label, the second label and the reasoning steps are used as the corresponding case analysis and added to the case library. For clarity, the large language model used here is referred to as the second large language model, and the large language model is referred to as the second large language model. Figure 1 The large language model used for transaction risk analysis is called the first large language model. The second large language model may be the same as or different from the first large language model. Preferably, the second large language model may be a large language model with a larger number of parameters or better reasoning ability.

[0050] Existing transaction risk analysis datasets usually only indicate whether there are risks in transaction records (such as illegal fund transfer), but do not reveal what specific risks these transaction records have. This makes the existing transaction risk analysis datasets usually unable to be used as the aforementioned target datasets. In view of this, the embodiments of this specification also propose a method for constructing a target dataset.

[0051] First, serialized transaction records are generated through the third language model and added to the target data set as normal transactions. By using the third language model to generate serialized transaction records, the time series features in the transaction data can be maintained, and transactions occurring in the real world can be simulated more accurately. Next, based on the definition rules of several risk patterns and the data distribution of real transaction data, a simulator is used to generate transaction groups under each risk pattern, which are added to the target data set after adding a first label and a second label. Among them, a first label and a second label can be added to each transaction record in the transaction group, wherein the first label indicates whether the transaction group is a risky transaction, and the second label indicates the risk pattern. In this way, the target data set is constructed. Furthermore, as mentioned above, a case library containing case analysis of a large number of transaction cases is constructed based on the target data set.

[0052] After constructing the subgraph search engine, knowledge base and case base, you can execute Figure 2 The transaction risk analysis method shown in the figure. The specific implementation process includes the following steps.

[0053] In step S21, a transaction group including multiple transaction records is obtained, and a transaction graph is constructed according to the transaction group.

[0054] The plurality of transaction records include transaction records related to the target user in a predetermined period. The target user represents an analysis object. Exemplarily, the predetermined period may refer to one day, such as the transaction risk analysis of the target user may be performed in units of days.

[0055] The transaction records related to the target user in the predetermined period may refer to multi-hop (e.g., two or more hops) transaction records centered on the target user. Each transaction record may include, but is not limited to, the transaction time, transaction parties, transaction amount, and other transaction-related details (e.g., transaction type).

[0056] Figure 3 The following diagram shows four typical operation modes (i.e., risk modes) of illegal fund transfer. Figure 3 As shown in the figure, these four typical operation modes are: fast in and fast out mode; circular transaction mode; first disperse and then gather mode and first gather and then disperse mode. The mode subgraphs of these four typical operation modes only involve two-hop transaction records. Therefore, when analyzing whether the target user has these four risky behavior modes, it is only necessary to obtain the transaction records within two hops centered on the target user to identify these four risky modes. In other words, the first transaction record of the target user within a predetermined period of time and the second transaction records of other users who have transaction behaviors with the target user within a predetermined period of time can be obtained to obtain a transaction group.

[0057] It should be known that if the risk pattern to be identified is more complex, such as transaction records involving more hops (greater than two hops), transaction records with more hops (greater than two hops) can be obtained with the target user as the center to obtain a transaction group.

[0058] After obtaining the transaction group, a transaction graph can be constructed based on the transaction group. Each transaction party involved in the transaction group can be used as a node in the transaction graph, and each edge in the transaction graph corresponds to a transaction record. The edge in the transaction graph can refer to a directed edge, and the direction of the edge indicates the direction of the funds flow of the transaction record, that is, from the source party (Source) to the target party (Target).

[0059] In step S22, a plurality of pattern subgraphs representing a plurality of risk patterns are searched in the transaction graph to obtain matching subgraphs; and risk knowledge related to the risk patterns represented by the matching subgraphs is searched from the knowledge base.

[0060] Risk models may include but are not limited to a combination of the above Figure 3 The four operation modes described. Each risk mode has a corresponding mode subgraph. The mode subgraph is used to characterize the graph structure characteristics unique to the corresponding risk mode. Each risk mode may have one or more mode subgraphs. Different risk modes generally have different mode subgraphs.

[0061] A matching subgraph refers to a subgraph of a pattern found in the transaction graph that represents a certain risk pattern. Figure 1 The subgraph structure that matches the transaction graph is the pattern subgraph that is searched in the transaction graph. If a pattern subgraph is searched in the transaction graph, it means that the transaction group may have the risk pattern represented by the pattern subgraph. Therefore, the risk knowledge related to the risk pattern represented by the matching subgraph can be found from the knowledge base, so that the subsequent large language model can use the risk knowledge to accurately identify whether the transaction graph actually has the risk pattern, and the specific risk point when it has the risk pattern (such as the transaction record that caused the risk pattern).

[0062] Several groups of detection rules preset for several risk patterns can be used to detect whether there is a corresponding pattern subgraph in the transaction graph. Each group of detection rules may include one or more detection rules. Exemplarily, for each risk pattern, a corresponding detection rule can be set according to the graph structure characteristics of the pattern subgraph corresponding to the risk pattern (optionally, it can also be combined with the definition of the risk pattern).

[0063] Figure 4 A schematic diagram of the process of retrieving risk knowledge is shown.

[0064] See also Figure 4 , the transaction graph can be input into the subgraph retrieval engine, and the subgraph retrieval engine searches the transaction graph for subgraphs that match each risk pattern. Figure 1The subgraph retrieval engine may include a subgraph matching algorithm (i.e., the detection rule mentioned above) set for each risk pattern. These subgraph matching algorithms can detect whether there is a subgraph matching with a specific pattern in the transaction graph based on the node relationship and edge attribute information in the transaction graph. Figure 1 The subgraph structure.

[0065] After obtaining the search results, risk knowledge related to the risk pattern represented by the matching subgraph can be retrieved from the knowledge base. Exemplarily, the retrieved risk knowledge may include description information of the risk pattern represented by the matching subgraph. Figure 4 As shown, the risk patterns represented by the matching subgraph include the fast-in-fast-out pattern and the cyclic transaction pattern. Therefore, the risk knowledge related to the fast-in-fast-out pattern and the risk knowledge related to the cyclic transaction pattern can be retrieved from the knowledge base. The risk knowledge related to the fast-in-fast-out pattern may include: the time interval is very short; the transaction amount is the same, etc., which are characteristic descriptions of the fast-in-fast-out risk pattern. The risk knowledge related to the cyclic transaction pattern may include: the funds from the initiator are continuously traded through a series of intermediaries; the funds eventually return to the initiator; the time interval is short, etc., which are characteristic descriptions of the cyclic transaction risk pattern. In this way, through the subgraph retrieval engine and the knowledge base, the risk knowledge related to the possible risk patterns in the transaction graph is obtained.

[0066] On the other hand, in step S23, case analysis of transaction cases similar to the transaction graph is searched from the case library.

[0067] Case analysis can reflect the specific reasoning details of a transaction case. For example, case analysis can include an evaluation conclusion on whether a transaction case has risks and its risk pattern, as well as the reasoning process for reaching the evaluation conclusion. Case analysis can systematically teach LLMs how to analyze and reason about transaction data. The case library can be pre-built in the manner described above, which contains case analysis of a large number of transaction cases.

[0068] Considering that transaction cases have rich and diverse structural features, it is inappropriate to apply the subgraph-based retrieval method to case retrieval. Therefore, the embodiment of this specification proposes that case retrieval can be performed by full-graph matching.

[0069] In other words, it is possible to find transaction cases that are similar to the overall graph structure characteristics of the transaction graph. Specifically, both the transaction graph and the case can be converted into graph representations, and the transaction case that is most similar to the transaction group can be determined by calculating the similarity of the graph representations. After finding a similar transaction case, you can further find a case analysis of the transaction case.

[0070] Figure 5 A schematic diagram of the process of retrieving case analysis is shown.

[0071] like Figure 5 As shown, first, the first embedding representation of the transaction graph can be obtained by graph encoding the transaction graph. Then, the similarity between the first embedding representation and the second embedding representation of the transaction graph corresponding to each transaction case in the case library is calculated. Finally, the case analysis text corresponding to one or more transaction cases with the highest similarity is obtained.

[0072] Combine the following Figure 5 The process of graph encoding the transaction graph of the target user is described in detail. It should be known that for the transaction graph of each transaction case in the case library, the second embedded representation of the transaction graph can be obtained according to the graph encoding method described below. In addition, the second embedded representation can be obtained in advance and stored in the case library in association with the case analysis of the transaction case.

[0073] See also Figure 5 First, use the language model to encode each node in the transaction graph to obtain the first vector representation of each node. In order to enrich the node features, all the connecting edges of the node can be encoded to form an edge representation vector, and the first vector representation of the node can be obtained based on the edge representation vector. Exemplarily, the language model can be used to encode the description text of the transaction record corresponding to each edge in the transaction graph to obtain the edge representation vector of each edge; then, for any node, the first vector representation of the node is determined based on the edge representation vectors of all its connecting edges. For example, the average pooling result of the edge representation vectors of all the connecting edges of the node can be used as the first vector representation of the node. In this way, rich semantic information of the node can be captured.

[0074] Next, the first vector representation of each node in the transaction graph is processed using a graph neural network (GNN) to obtain the second vector representation of each node. In this way, rich graph structure information in the transaction graph can be captured.

[0075] Finally, the second vector representations of all nodes in the transaction graph are aggregated to obtain the first embedded representation of the transaction graph. The aggregation operation may refer to an average pooling operation. The average pooling operation mentioned here refers to average pooling (i.e., averaging) the second vector representations of all nodes, and using the average pooled vector representation as the first embedded representation.

[0076] In this way, the first embedded representation of the transaction graph is obtained as a representation of the entire graph information, which contains the information of each transaction and the graph structure information between transactions. The first embedded representation of the transaction graph is compared with the second embedded representation corresponding to each transaction case, and several transaction cases with high similarity are found. Transaction cases similar to the current transaction group in terms of transaction content and transaction mode can be obtained. Then, case analysis of these similar transaction cases can be obtained.

[0077] In addition, the embodiment does not limit the execution order of step S22 and step S23. That is, step S22 may be executed first, and then step S23; step S23 may be executed first, and then step S22; step S22 and step S23 may also be executed in parallel without any particular order.

[0078] Based on the risk knowledge obtained through step S22 and the case analysis obtained through step S23, in step S24, multiple transaction records, risk knowledge, and case analysis are input into the first largest language model to obtain the transaction risk analysis results of the transaction group output by the first largest language model.

[0079] As mentioned above, case analysis can include the evaluation conclusion on whether the transaction case has risks and its risk pattern, as well as the reasoning process for reaching the evaluation conclusion. Therefore, the transaction risk analysis result can not only include the analysis conclusion on whether the transaction group has risks and its risk pattern, but also include the reasoning process for reaching the analysis conclusion.

[0080] In some embodiments, a training data set may also be constructed, and a general large language model may be fine-tuned using the training data set to obtain a first language model. That is, the first large language model may refer to a large language model after fine-tuning. Exemplarily, each piece of training data in the training data set may include a sample transaction group, risk knowledge related to a risk pattern matching the sample transaction group found from a knowledge base, a case analysis similar to the sample transaction group found from a case base, and the desired model output. Among them, the fine-tuning method may adopt instruction tuning. Instruction tuning refers to adding instruction information described in natural language to the prompt, and the instruction information may be description information for a transaction risk analysis task. In the case of adopting the instruction tuning method, in the application stage after training, the instruction information may also be input into the first large language model together with multiple transaction records, risk knowledge, and case analysis.

[0081] According to an embodiment of another aspect, a transaction risk analysis device is provided. Figure 6 A schematic diagram of the structure of a transaction risk analysis device according to an embodiment is shown. The device can be deployed in any device, platform or device cluster with data storage, computing and processing capabilities.

[0082] like Figure 6 As shown, the transaction risk analysis device 600 includes:

[0083] The acquisition unit 61 is configured to acquire a transaction group including a plurality of transaction records, and construct a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to the target user in a predetermined period;

[0084] The first search unit 62 is configured to search for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph to obtain matching subgraphs; and search for risk knowledge related to the risk patterns represented by the matching subgraphs from a knowledge base;

[0085] A second search unit 63 is configured to search for case analysis of transaction cases similar to the transaction graph from a case library;

[0086] The analysis unit 64 is configured to input the plurality of transaction records, the risk knowledge, and the case analysis into a first large language model, and obtain a transaction risk analysis result on the transaction group output by the first large language model.

[0087] In some embodiments, the first search unit 62 is specifically configured to use several groups of detection rules preset for several risk patterns to detect whether there is a corresponding pattern subgraph in the transaction graph.

[0088] In some embodiments, the second search unit 63 is specifically configured to obtain a first embedded representation of the transaction graph; calculate the similarity between the first embedded representation and a second embedded representation of the transaction graph corresponding to each transaction case in the case library; and obtain case analysis texts corresponding to one or more transaction cases with the highest similarity.

[0089] In a further embodiment, the second search unit 63 is specifically configured to use a language model to encode each node in the transaction graph to obtain a first vector representation of each node; use a graph neural network to process the first vector representation of each node in the transaction graph to obtain a second vector representation of each node; and perform an aggregation operation on the second vector representations of all nodes in the transaction graph to obtain a first embedded representation of the transaction graph.

[0090] In a further embodiment, the second search unit 63 is specifically configured to use a language model to encode the description text of the transaction record corresponding to each edge in the transaction graph to obtain an edge representation vector of each edge; for any node, the first vector representation of the node is determined based on the edge representation vectors of all its connected edges.

[0091] In some embodiments, the acquisition unit 61 is specifically configured to acquire a first transaction record of a target user within a predetermined period of time, and a second transaction record of other users who have transaction behaviors with the target user within the predetermined period of time, to obtain a transaction group containing multiple transaction records.

[0092] In some embodiments, the case analysis includes an evaluation conclusion on whether the transaction case has risks and its risk pattern, and the reasoning process for reaching the evaluation conclusion; the transaction risk analysis result includes an analysis conclusion on whether the transaction group has risks and its risk pattern, and the reasoning process for reaching the analysis conclusion.

[0093] In some embodiments, the case library is constructed in the following manner: extracting a sample transaction group from a target data set, the sample transaction group having a first label of whether it is a risky transaction and a second label of the risk pattern it has; inputting the first label and the second label of each transaction in the sample transaction group into a second largest language model, and letting it output reasoning steps with the first label and the second label as evaluation conclusions; taking the sample transaction group as a transaction case, and adding the first label, the second label and the reasoning steps as corresponding case analysis to the case library.

[0094] In some embodiments, the target data set is constructed in the following manner: serialized transaction records are generated through a third language model and added to the target data set as normal transactions; based on the definition rules of the several risk modes and the data distribution of real transaction data, a simulator is used to generate transaction groups under each risk mode, and the first label and the second label are added to the transaction groups and then added to the target data set.

[0095] In some embodiments, the transaction risk analysis device 600 further includes a training unit. The training unit is configured to construct a training data set, and use the training data set to fine-tune the general large language model to obtain the first large language model, wherein each piece of training data in the training data set includes a sample transaction group, risk knowledge related to a risk pattern matching the sample transaction group found from the knowledge base, case analysis similar to the sample transaction group found from the case base, and expected model output.

[0096] For the specific implementation examples of each unit in the above device, please refer to the previous Figure 2 Description.

[0097] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described.

[0098] According to another embodiment, a computer program product is also provided, including a computer program / instruction, which is executed by a processor to implement the aforementioned combination Figure 2 The method steps described.

[0099] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 2 The method described.

[0100] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0101] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A transaction risk analysis method, comprising: Acquire a transaction group including a plurality of transaction records, and construct a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to the target user in a predetermined period; Searching for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph to obtain matching subgraphs; Searching for risk knowledge related to the risk pattern represented by the matching subgraph from a knowledge base; Find case analysis of transaction cases similar to the transaction graph from the case library; The plurality of transaction records, the risk knowledge, and the case analysis are input into a first large language model to obtain a transaction risk analysis result of the transaction group output by the first large language model.

2. The method according to claim 1, wherein: Searching for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph, including: Several groups of detection rules preset for several risk patterns are used respectively to detect whether there is a corresponding pattern subgraph in the transaction graph.

3. The method according to claim 1, wherein: Find case studies of transaction cases similar to the transaction graph in the case library, including: Obtaining a first embedding representation of the transaction graph; Calculating the similarity between the first embedding representation and the second embedding representation of the transaction graph corresponding to each transaction case in the case library; Obtain case analysis texts corresponding to one or more transaction cases with the highest similarity.

4. The method according to claim 3, wherein: Obtaining a first embedding representation of the transaction graph, including: Encoding each node in the transaction graph using a language model to obtain a first vector representation of each node; Processing the first vector representation of each node in the transaction graph using a graph neural network to obtain a second vector representation of each node; An aggregation operation is performed on the second vector representations of all nodes in the transaction graph to obtain a first embedded representation of the transaction graph.

5. The method according to claim 4, wherein: The language model is used to encode each node in the transaction graph to obtain a first vector representation of each node, including: Using a language model to encode the description text of the transaction record corresponding to each edge in the transaction graph, to obtain an edge representation vector of each edge; For any node, the first vector representation of the node is determined according to the edge representation vectors of all its connected edges.

6. The method according to claim 1, wherein: Get a transaction group containing multiple transaction records, including: A first transaction record of a target user within a predetermined period of time and a second transaction record of other users who have transaction behaviors with the target user within the predetermined period of time are obtained to obtain a transaction group including multiple transaction records.

7. The method according to claim 1, wherein: The case analysis includes an assessment conclusion on whether the transaction case has risks and its risk pattern, as well as the reasoning process for reaching the assessment conclusion; The transaction risk analysis result includes an analysis conclusion on whether the transaction group has risks and the risk pattern, and a reasoning process for reaching the analysis conclusion.

8. The method according to claim 1, wherein: The case library is constructed in the following way: Extracting a sample transaction group from the target data set, the sample transaction group having a first label of whether it is a risky transaction and a second label of the risk pattern it has; Inputting the first label and the second label of each transaction in the sample transaction group into the second largest language model, and making it output the reasoning steps with the first label and the second label as the evaluation conclusion; The sample transaction group is taken as a transaction case, and the first label, the second label and the reasoning step are taken as corresponding case analysis and added to the case library.

9. The method according to claim 8, wherein: The target dataset is constructed in the following way: Generate serialized transaction records through a third language model and add them to the target data set as normal transactions; Based on the definition rules of the several risk modes and the data distribution of real transaction data, a simulator is used to generate transaction groups under each risk mode, and the first label and the second label are added to the transaction groups and then added to the target data set.

10. The method according to claim 1, further comprising: A training data set is constructed, and a general large language model is fine-tuned using the training data set to obtain the first large language model, wherein each piece of training data in the training data set includes a sample transaction group, risk knowledge related to a risk pattern matching the sample transaction group found from the knowledge base, case analysis similar to the sample transaction group found from the case base, and expected model output.

11. The method according to claim 1, wherein: The risk modes include one or more of the following: Fast-in-fast-out mode; Cyclic trading model; Disperse first and then gather mode; Gather first and then disperse mode.

12. A transaction risk analysis device, comprising: An acquisition unit is configured to acquire a transaction group including a plurality of transaction records, and construct a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to a target user in a predetermined period of time; A first search unit is configured to search the transaction graph for a plurality of pattern subgraphs representing a plurality of risk patterns to obtain matching subgraphs; Searching for risk knowledge related to the risk pattern represented by the matching subgraph from a knowledge base; A second search unit is configured to search for case analysis of transaction cases similar to the transaction graph from a case library; The analysis unit is configured to input the multiple transaction records, the risk knowledge, and the case analysis into a first large language model to obtain a transaction risk analysis result of the transaction group output by the first large language model.

13. A computer program product, comprising a computer program / instruction, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 11.

14. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 11 is implemented.

Images