Transaction risk analysis method and apparatus

Abstract

Embodiments of the present specification provide a transaction risk analysis method and device. The method comprises: obtaining a transaction group containing a plurality of transaction records, constructing a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to a target user in a predetermined period; searching for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph to obtain a matching subgraph; searching for risk knowledge related to the risk pattern represented by the matching subgraph from a knowledge base; searching for case analysis of a transaction case similar to the transaction graph from a case base; inputting the plurality of transaction records, the risk knowledge and the case analysis into a first large language model to obtain a transaction risk analysis result about the transaction group output by the first large language model.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of machine learning, and in particular to a transaction risk analysis method and device implemented by using a large language model. BACKGROUND

[0002] In the financial field, transaction risk analysis, especially the detection and analysis of illegal fund transfers, faces great challenges. In recent years, the capabilities of large language models (LLMs) have rapidly improved and play an important role in many fields. Although LLMs perform well in natural language related tasks, the direct use of LLMs in transaction risk analysis does not work well.

[0003] Therefore, it is desirable to have an improved solution to use LLMs to have better performance in transaction risk analysis tasks. SUMMARY

[0004] One or more embodiments of the present specification describe a transaction risk analysis solution that retrieves risk knowledge and case analysis through graph retrieval, and inputs the retrieved risk knowledge and case analysis together with a plurality of transaction records included in a transaction group into a large language model, which can improve the transaction risk analysis capability of the large language model for the transaction group.

[0005] According to a first aspect, a transaction risk analysis method is provided, comprising: obtaining a transaction group including a plurality of transaction records, and constructing a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to a target user in a predetermined period; searching for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph to obtain a matching subgraph; searching for risk knowledge related to the risk pattern represented by the matching subgraph from a knowledge base; searching for case analysis of a transaction case similar to the transaction graph from a case base; inputting the plurality of transaction records, the risk knowledge, and the case analysis into a first large language model to obtain a transaction risk analysis result about the transaction group output by the first large language model.

[0006] According to an embodiment, searching for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph comprises: respectively using a plurality of sets of detection rules preset for a plurality of risk patterns to detect whether a corresponding pattern subgraph exists in the transaction graph.

[0007] In an embodiment, searching for case analysis of a transaction case similar to the transaction graph from a case base comprises: obtaining a first embedding representation of the transaction graph; calculating the similarity between the first embedding representation and a second embedding representation of a transaction graph corresponding to each transaction case in the case base; obtaining the case analysis text corresponding to one or more transaction cases with the highest similarity.

[0008] In a further embodiment, obtaining the first embedding representation of the transaction graph comprises: encoding each node in the transaction graph using a language model to obtain a first vector representation of each node; processing the first vector representation of each node in the transaction graph using a graph neural network to obtain a second vector representation of each node; and performing an aggregation operation on the second vector representation of all nodes in the transaction graph to obtain the first embedding representation of the transaction graph.

[0009] In a further embodiment, encoding each node in the transaction graph using a language model to obtain a first vector representation of each node comprises: encoding a description text of a transaction record corresponding to each edge in the transaction graph using a language model to obtain an edge representation vector of each edge; and determining the first vector representation of any node according to the edge representation vectors of all connected edges of the node.

[0010] According to an embodiment, obtaining a transaction group containing a plurality of transaction records comprises: obtaining first transaction records of a target user within a predetermined period of time, and second transaction records of other users having transaction behavior with the target user within the predetermined period of time to obtain a transaction group containing a plurality of transaction records.

[0011] According to an embodiment, the case analysis includes an evaluation conclusion on whether the transaction case has a risk and a risk pattern, and an inference process for deriving the evaluation conclusion, and the transaction risk analysis result includes an analysis conclusion on whether the transaction group has a risk and a risk pattern, and an inference process for deriving the analysis conclusion.

[0012] In an embodiment, the case library is constructed by: extracting a sample transaction group from a target data set, the sample transaction group having a first label of whether it is a risky transaction and a second label of a risk pattern it has; inputting each transaction, the first label and the second label in the sample transaction group into a second large language model to make it output an inference step with the first label and the second label as an evaluation conclusion; adding the sample transaction group as a transaction case, the first label, the second label and the inference step as a corresponding case analysis to the case library.

[0013] In a further embodiment, the target data set is constructed by: generating a serialized transaction record by a third large language model, adding it to the target data set as a normal transaction; generating a transaction group under each risk pattern using a simulator based on the definition rules of the risk patterns and the data distribution of real transaction data, adding the first label and the second label to it and adding it to the target data set.

[0014] According to an embodiment, the method further comprises: constructing a training data set, fine-tuning a general large language model by using the training data set to obtain the first large language model, wherein each piece of training data in the training data set comprises a sample transaction group, risk knowledge related to a risk pattern matched with the sample transaction group found from the knowledge base, case analysis similar to the sample transaction group found from the case base, and expected model output.

[0015] According to an embodiment, the plurality of risk patterns comprises one or more of the following: fast-in fast-out pattern; circular transaction pattern; first dispersion then aggregation pattern; first aggregation then dispersion pattern.

[0016] According to the first aspect, a transaction risk analysis apparatus is provided, comprising: an acquisition unit configured to acquire a transaction group containing a plurality of transaction records, and construct a transaction graph according to the transaction group; the plurality of transaction records comprising transaction records related to a target user in a predetermined period; a first finding unit configured to search for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph to obtain a matching subgraph, and find risk knowledge related to the risk pattern represented by the matching subgraph from a knowledge base; a second finding unit configured to find case analysis of a transaction case similar to the transaction graph from a case base; and an analysis unit configured to input the plurality of transaction records, the risk knowledge, and the case analysis into a first large language model together to obtain a transaction risk analysis result about the transaction group output by the first large language model.

[0017] According to the third aspect, a computer program product is provided, comprising computer programs / instructions which, when executed by a processor, implement the steps of the method of the first aspect.

[0018] According to the fourth aspect, a computer-readable storage medium is provided, having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first aspect.

[0019] According to the fifth aspect, a computing device is provided, comprising a memory and a processor, characterized in that the memory has stored executable codes, and the processor, when executing the executable codes, implements the method of the first aspect.

[0020] In the embodiments of the present specification, a transaction graph is constructed according to a transaction group, relevant risk knowledge and cases are found respectively based on the transaction graph through subgraph search and graph matching, and the found risk knowledge and cases are input into a first large language model together with the plurality of transaction records contained in the transaction group, which can improve the transaction risk analysis capability of the large language model for the transaction group. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without any creative effort on the basis of these drawings.

[0022] Figure 1 A schematic diagram showing the principle of performing a transaction risk analysis task using LLMs is shown.

[0023] Figure 2 A flowchart of a transaction risk analysis method according to an embodiment is shown.

[0024] Figure 3 A pattern sub-diagram showing four typical money laundering risk patterns is shown.

[0025] Figure 4 A flowchart showing the retrieval of risk knowledge is shown.

[0026] Figure 5 A flowchart showing the retrieval of case analysis is shown.

[0027] Figure 6 A schematic diagram showing the structure of a transaction risk analysis apparatus according to an embodiment is shown. DETAILED DESCRIPTION

[0028] The schemes provided in the present specification will be described below with reference to the drawings.

[0029] In the description of the present specification, the words "exemplary", "for example", or "e.g." are used to mean serving as an example, instance, or illustration. Any embodiment or design solution described as "exemplary", "for example", or "e.g." in the present specification should not be interpreted as being more preferred or advantageous than other embodiments or design solutions. Rather, the words "exemplary", "for example", or "e.g." are used to present the relevant concept in a specific manner.

[0030] In the description of the present specification, the term "and / or" is merely a description of the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which can represent the three cases of A alone, B alone, and A and B together. In addition, unless otherwise specified, the term "multiple" means two or more.

[0031] In addition, the terms "first", "second", etc. are used only for descriptive purposes and are not to be construed as indicating or implying relative importance or implicating a recited technical effect to the exclusion of other features. Thus, a feature defined with "first", "second", etc. can include one or more of the features. The terms "comprises", "comprising", "includes", "including" and "has" are intended to be open-ended and mean "including but not limited to", unless explicitly indicated otherwise.

[0032] Currently, case analysis in the field of transaction risk control highly depends on manual analysis by experts in the field of risk control, which consumes a lot of manpower and is less timely. The transaction risk discovery method based on traditional machine learning models (such as tree models and graph models) usually models risk discovery as a classification problem, and identifies risky users and transactions by training a classification model, but this approach cannot provide an explainable analysis process and still relies on further manual analysis.

[0033] LLMs are a kind of deep neural network model with a large number of parameters, trained based on a large amount of text data, capable of understanding and generating coherent and grammatically correct natural language text, and containing rich world knowledge, bringing revolutionary progress in text generation, machine translation and knowledge question answering tasks.

[0034] Although LLMs perform well in natural language related tasks, there are still challenges and difficulties in directly using LLMs for transaction risk analysis: 1) Lack of relevant risk control knowledge, general large language models are trained based on general text and have rich common sense, but lack the professional knowledge necessary for professional tasks such as transaction risk analysis (such as illegal fund transfer analysis); 2) Weak ability to analyze the correlation of transaction events, general large language models have strong modeling ability for sequence data such as natural language, but have weak ability to analyze the correlation of transaction events, which are graph structure information.

[0035] Retrieval-Augmented Generation (RAG) technology combines information retrieval and large language generation models, dynamically retrieves relevant documents to enhance the context information of the generation model, enabling the model to flexibly utilize large-scale external data sets and knowledge sets, thereby improving the accuracy and reliability of text generation. RAG technology improves the explainability and real-time performance of the system, and is suitable for question answering systems, dialogue systems and text summarization applications.

[0036] However, the transaction risk analysis task is significantly different from the general question answering task. The transaction risk analysis task not only requires the model to have domain knowledge, but also requires the model to have strong behavioral data analysis capability. In addition, transaction data is different from general text data. Transaction data not only contains rich semantic information, but also shows complex transaction graph structure information, which brings great challenges to the existing retrieval-based methods (such as RAG technology).

[0037] Therefore, the embodiments of the present specification propose a knowledge-case graph retrieval enhanced generation framework. The framework retrieves domain knowledge and case analysis through graph retrieval to assist LLMs to perform transaction risk analysis tasks. More specifically, the framework can use a subgraph retrieval engine to retrieve professional knowledge (i.e., risk knowledge) related to risk patterns based on subgraph features in the transaction graph, and use a case matching engine to retrieve relevant case analysis based on overall transaction graph features. The retrieved risk knowledge and case analysis can be input into the LLM together with the transaction data to be analyzed.

[0038] The risk knowledge retrieved based on the subgraph structure matching makes the general large language model have transaction risk analysis capability, especially the analysis capability for the transaction risk patterns that may exist in the transaction group. The case analysis retrieved based on the graph representation (i.e., overall transaction graph features) not only contains the risk assessment conclusion of the case, but also generally includes the reasoning process to reach the conclusion. In this way, the case analysis enhances the correlation analysis capability of the large language model for transaction events, and makes the transaction risk analysis result generated by the large language model have strong explainability. Therefore, the LLM can complete the risk control case analysis task based on transaction data with little human intervention, provide analysis results with high explainability, and greatly improve the usability of the large language model in the risk control task.

[0039] Therefore, by combining risk knowledge and case analysis, the risk analysis capability of the LLM can be effectively improved. Experiments show that the framework can achieve nearly 50% improvement in precision and coverage for different types of LLMs, and the accuracy can be almost tripled.

[0040] Figure 1 A schematic diagram showing the principle of using LLMs to perform transaction risk analysis tasks is shown.

[0041] As Figure 1As shown, the original transaction data includes multiple transaction records. Each transaction record can include, but is not limited to, Time, Amount, Source, Target, Detail, and the like field information. The Source and the Target refer to the two parties participating in the transaction. Specifically, the Source can refer to the initiator of the transaction, and the Target can refer to the receiver of the transaction. The Detail can refer to, but is not limited to, transaction type information such as transfer and payment.

[0042] First, a transaction graph is constructed based on the original transaction data. Both parties participating in the transaction in the original transaction data can be nodes in the transaction graph, and the connection edges between the nodes represent the transaction behavior between the nodes. Each connection edge corresponds to a transaction record.

[0043] Next, risk knowledge retrieval and case analysis retrieval are performed respectively. Among them, risk knowledge retrieval and case analysis retrieval can be performed simultaneously without any order. Risk knowledge retrieval refers to searching for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph by using a subgraph search engine, and then searching for risk knowledge related to the risk patterns represented by the searched pattern subgraphs from a knowledge base. Case analysis retrieval refers to searching for a transaction case similar to the transaction graph from a case base by using a case matching engine.

[0044] Finally, the Prompt is constructed based on the transaction data, the risk knowledge, and the case analysis together, and is input into the large language model, so that the large language model can perform transaction risk analysis on the transaction data based on the risk knowledge and the case analysis. The risk knowledge can compensate for the lack of transaction risk analysis knowledge of the LLMs in the pre-training process, especially the risk knowledge related to the potential risk patterns in the transaction graph. The case analysis can provide the LLMs with reasoning details of similar cases. Therefore, by providing the risk knowledge, the case analysis, and the transaction data to be analyzed together as the Prompt to the LLMs, the accuracy of the transaction risk analysis results generated by the LLMs can be improved, and highly interpretable transaction risk analysis results can be obtained. For example, the Prompt can also include natural language description instruction information. The instruction information can be description information for the transaction risk analysis task. The instruction information can improve the relevance of the generated content of the LLMs to the transaction risk analysis task.

[0045] The specific implementation process of the above technical concept is described below.

[0046] Figure 2 A flowchart of a transaction risk analysis method according to an embodiment is shown. It should be understood that the method can be executed by any device, equipment, platform, cluster of equipment having computing and processing capabilities. In addition, the model architecture corresponding to the technical concept of the method utilizesFigure 2 The forward reasoning process shown makes a prediction.

[0047] Before performing the transaction risk analysis method of Figure 2 , a subgraph search engine, a knowledge base and a case base shown in Figure 1 need to be constructed in advance. To construct the subgraph search engine and the knowledge base, a plurality of risk patterns (and their pattern subgraphs) can be defined in advance, the subgraph search engine can be constructed based on the definition or rules of each risk pattern, and the description and other information of each risk pattern can be stored in the knowledge base.

[0048] To create a more detailed case base, a plurality of representative transaction cases can be selected, and case analysis of these transaction cases can be obtained by using artificial analysis (such as expert analysis) or LLM analysis for these transaction cases.

[0049] In some embodiments, the case base can be constructed as follows. A sample transaction group is extracted from a target data set, the sample transaction group has a first label of whether it is a risky transaction, and a second label of a risk pattern it has. The transactions in the sample transaction group, the first label and the second label are input into a large language model, and the large language model is caused to output reasoning steps with the first label and the second label as evaluation conclusions. The sample transaction group is taken as a transaction case, and the first label, the second label and the reasoning steps are taken as corresponding case analysis, and are added to the case base. For the sake of clarity, the large language model used here is referred to as a second large language model, and the large language model used in Figure 1 for transaction risk analysis is referred to as a first large language model. The second large language model and the first large language model can be the same or different. Preferably, the second large language model can be a large language model with a larger number of parameters or better reasoning capability.

[0050] Existing transaction risk analysis data sets usually only indicate whether a transaction record exists a risk (such as illegal fund transfer), but do not reveal what kind of risk the transaction record specifically exists. This makes the existing transaction risk analysis data set usually unable to serve as the aforementioned target data set. In view of this, the present specification also proposes a construction method of a target data set.

[0051] First, serialized transaction records are generated using a third-largest language model and added to the target dataset as normal transactions. Utilizing this model preserves the temporal characteristics of the transaction data and more accurately simulates real-world transactions. Next, based on the definition rules of several risk patterns and the data distribution of real transaction data, a simulator is used to generate transaction groups under each risk pattern. These groups are then labeled with a first and second tag and added to the target dataset. Each transaction record within a group is labeled with both a first and second tag; the first tag indicates whether the group represents a risky transaction, and the second tag indicates the risk pattern it represents. This constructs the target dataset. Furthermore, as mentioned earlier, a case library containing a large number of transaction cases is built based on the target dataset.

[0052] Based on the construction of the subgraph search engine, knowledge base, and case library, it is possible to execute... Figure 2 The method for analyzing transaction risks is shown. The specific execution process includes the following steps.

[0053] In step S21, a transaction group containing multiple transaction records is obtained, and a transaction graph is constructed based on the transaction group.

[0054] Multiple transaction records include transaction records related to the target user within a predetermined time period. The target user refers to the object of analysis. For example, the predetermined time period can be one day, such as performing transaction risk analysis on a daily basis for the target user.

[0055] Transaction records related to the target user during the predetermined time period can refer to multi-hop (e.g., two or more hops) transaction records centered on the target user. Each transaction record may include, but is not limited to, transaction time, parties involved, transaction amount, and other transaction-related details (e.g., transaction type).

[0056] Figure 3 The diagram illustrates four typical operational models (i.e., risk models) of illicit fund transfers. Figure 3 As shown, these four typical operating modes are: quick in and quick out mode; cyclical trading mode; dispersion-then-aggregation mode; and aggregation-then-dispersion mode. The sub-diagrams of these four typical operating modes only involve two-hop transaction records. Therefore, when analyzing whether a target user exhibits these four risky behavior patterns, it is only necessary to obtain the transaction records within two hops centered on the target user to identify these four risk patterns. In other words, the first transaction record of the target user within a predetermined time period, and the second transaction records of other users who have transacted with the target user within the predetermined time period, can be obtained to obtain the transaction group.

[0057] It should be understood that if the risk pattern to be identified is more complex, such as a transaction record involving more hops (more than two hops), more hops (more than two hops) of the transaction record can be acquired in a target user-centric manner to obtain a transaction group.

[0058] After obtaining the transaction group, a transaction graph can be constructed according to the transaction group. Each transaction party involved in the transaction group can be a node in the transaction graph, and each edge in the transaction graph corresponds to a transaction record. The edge in the transaction graph can be a directed edge, and the direction of the edge represents the direction of the fund flow of the transaction record, i.e., from the source (Source) to the target (Target).

[0059] In step S22, a plurality of pattern subgraphs representing a plurality of risk patterns are searched in the transaction graph to obtain a matching subgraph, and risk knowledge related to the risk pattern represented by the matching subgraph is searched from the knowledge base.

[0060] The risk pattern can include but is not limited to the four operation modes described above. Figure 3 Each risk pattern has a corresponding pattern subgraph. The pattern subgraph is used to represent the graph structure characteristics unique to its corresponding risk pattern. Each risk pattern can have one or more pattern subgraphs. Different risk patterns generally have different pattern subgraphs.

[0061] The matching subgraph refers to the subgraph structure searched in the transaction graph and representing a pattern subgraph of a certain risk pattern, i.e., the pattern subgraph searched in the transaction graph. If a certain pattern subgraph is searched in the transaction graph, it means that the transaction group can have the risk pattern represented by the pattern subgraph. Therefore, the risk knowledge related to the risk pattern represented by the matching subgraph can be searched from the knowledge base, so that the subsequent large language model can utilize the risk knowledge to accurately identify whether the transaction graph truly has the risk pattern and the specific risk point (such as the transaction record causing the risk pattern) when having the risk pattern. Figure 1

[0062] A plurality of sets of detection rules preset for a plurality of risk patterns can be used to detect whether the corresponding pattern subgraph exists in the transaction graph. Each set of detection rules can include one or more detection rules. For example, for each risk pattern, the corresponding detection rule can be set according to the graph structure characteristics of the pattern subgraph corresponding to the risk pattern (optionally, the definition of the risk pattern can also be combined).

[0063] Figure 4 A flowchart for retrieving risk knowledge is shown.

[0064] Referring to Figure 4 The transaction graph can be input into a subgraph retrieval engine, and the subgraph retrieval engine can search whether the pattern subgraph of each risk pattern exists in the transaction graph. Figure 1 ​The subgraph structure is consistent. The subgraph retrieval engine may include subgraph matching algorithms (i.e., the detection rules mentioned above) tailored to each risk pattern. These subgraph matching algorithms can detect whether there exists a subgraph in the transaction graph that matches a specific pattern, based on the node relationships and edge attribute information in the transaction graph. Figure 1 Subgraph structure.

[0065] After obtaining the search results, risk knowledge related to the risk patterns represented by the matching subgraph can be retrieved from the knowledge base. For example, the retrieved risk knowledge may include descriptive information about the risk patterns represented by the matching subgraph. Figure 4 As shown, the risk patterns represented by the matching subgraph include the quick-in-quick-out pattern and the cyclical trading pattern. Therefore, risk knowledge related to the quick-in-quick-out pattern and the cyclical trading pattern can be retrieved from the knowledge base. Risk knowledge related to the quick-in-quick-out pattern can include characteristics such as very short time intervals and identical transaction amounts. Risk knowledge related to the cyclical trading pattern can include characteristics such as funds from the initiator being continuously traded through a series of intermediaries; funds ultimately returning to the initiator; and short time intervals. Thus, through the subgraph retrieval engine and the knowledge base, risk knowledge related to possible risk patterns in the trading graph can be obtained.

[0066] On the other hand, in step S23, case analysis is performed on transaction cases that are similar to the transaction chart by searching the case library.

[0067] Case studies can reflect the specific reasoning details of a transaction case. For example, a case study may include an assessment conclusion regarding whether a transaction case carries risk and its risk patterns, as well as the reasoning process leading to that conclusion. Case studies can systematically teach LLMs how to analyze and reason about transaction data. A case library can be pre-built as described above, containing case studies of a large number of transaction cases.

[0068] Given the diverse structural characteristics of transaction cases, applying subgraph-based retrieval to case retrieval is inappropriate. Therefore, the embodiments in this specification propose that case retrieval be performed using full-graph matching.

[0069] In other words, it's possible to find transaction cases that share similar overall graph structure characteristics with the transaction graph. Specifically, both the transaction graph and the cases can be converted into graph representations, and the transaction cases most similar to the transaction group can be determined by calculating the similarity of these graph representations. After finding similar transaction cases, further case analysis of those cases can be performed.

[0070] Figure 5 A flowchart illustrating the process of retrieving case analysis is shown.

[0071] likeFigure 5 As shown, first, a first embedding representation of the transaction graph can be obtained by graph encoding the transaction graph. Then, similarities between the first embedding representation and second embedding representations of transaction graphs corresponding to each transaction case in the case library are calculated. Finally, case analysis texts corresponding to one or more transaction cases with the highest similarity are obtained.

[0072] The following will be described in detail in combination with Figure 5 The process of graph encoding the transaction graph of the target user will be described in detail. It should be known that for the transaction graph of each transaction case in the case library, the second embedding representation of the transaction graph can be obtained according to the graph encoding manner described below. Moreover, the second embedding representation can be obtained in advance and stored in the case library in association with the case analysis of the transaction case.

[0073] Referring to Figure 5 First, the language model is used to encode each node in the transaction graph to obtain a first vector representation of each node. In order to enrich the node features, all the connection edges of the node can be encoded to form an edge representation vector, and the first vector representation of the node is obtained based on the edge representation vector. For example, the description text of the transaction record corresponding to each edge in the transaction graph can be encoded by using the language model to obtain an edge representation vector of each edge. Then, for any node, the first vector representation of the node is determined according to the edge representation vectors of all the connection edges of the node. For example, the average pooling result of the edge representation vectors of all the connection edges of the node can be taken as the first vector representation of the node. In this way, the rich semantic information of the node can be captured.

[0074] Next, the first vector representation of each node in the transaction graph is processed by using the graph neural network (GNN) to obtain a second vector representation of each node. In this way, the rich graph structure information in the transaction graph can be captured.

[0075] Finally, an aggregation operation is performed on the second vector representations of all the nodes in the transaction graph to obtain a first embedding representation of the transaction graph. The aggregation operation can be an average pooling operation. Here, the average pooling operation refers to averaging the second vector representations of all the nodes, and the vector representation after the average pooling is taken as the first embedding representation.

[0076] In this way, the first embedding representation of the transaction graph is obtained as the representation of the whole graph information, which contains the information of each transaction and the graph structure information between the transactions. By comparing the first embedding representation of the transaction graph with the second embedding representations corresponding to each transaction case, a number of transaction cases with higher similarity can be found, which can obtain the case analysis of these similar transaction cases.

[0077] In addition, the embodiment does not limit the execution order between step S22 and step S23. That is, step S22 can be executed first, and then step S23 can be executed; or step S23 can be executed first, and then step S22 can be executed; or step S22 and step S23 can be executed in parallel without any order.

[0078] On the basis of obtaining the risk knowledge through step S22 and obtaining the case analysis through step S23, in step S24, the plurality of transaction records, the risk knowledge, and the case analysis are input into the first large language model to obtain a transaction risk analysis result about the transaction group output by the first large language model.

[0079] As described above, the case analysis can include an evaluation conclusion about whether the transaction case has a risk and a risk pattern thereof, and an inference process of deriving the evaluation conclusion. Therefore, the transaction risk analysis result can include not only an analysis conclusion about whether the transaction group has a risk and a risk pattern thereof, but also an inference process of deriving the analysis conclusion.

[0080] In some embodiments, a training data set can also be constructed to fine-tune a general large language model to obtain the first language model. That is, the first large language model can refer to a large language model after fine-tuning. For example, each training data in the training data set can include a sample transaction group, risk knowledge related to a risk pattern matched with the sample transaction group found from a knowledge base, case analysis similar to the sample transaction group found from a case base, and expected model output. Wherein, the fine-tuning method can adopt instruction tuning. Instruction tuning refers to adding natural language description instruction information in the prompt. The instruction information can be description information for the transaction risk analysis task. In the case of adopting the instruction tuning method, in the application stage after training, the instruction information can also be input into the first large language model together with the plurality of transaction records, the risk knowledge, and the case analysis.

[0081] According to another aspect, an embodiment of a transaction risk analysis device is provided. Figure 6 A structural schematic diagram of a transaction risk analysis device according to an embodiment is shown, which can be deployed in any device, platform or device cluster with data storage, computing and processing capabilities.

[0082] As Figure 6 shown, the transaction risk analysis device 600 includes:

[0083] The acquisition unit 61 is configured to acquire a transaction group containing a plurality of transaction records, and construct a transaction graph according to the transaction group; the plurality of transaction records include transaction records related to a target user in a predetermined period;

[0084] The first searching unit 62 is configured to search for a plurality of pattern subgraphs representing a plurality of risk patterns in the transaction graph to obtain a matching subgraph, and search for risk knowledge related to the risk pattern represented by the matching subgraph from a knowledge base.

[0085] The second searching unit 63 is configured to search for case analysis of a transaction case similar to the transaction graph from a case base.

[0086] The analyzing unit 64 is configured to input the plurality of transaction records, the risk knowledge, and the case analysis into a first large language model to obtain a transaction risk analysis result about the transaction group output by the first large language model.

[0087] In some embodiments, the first searching unit 62 is specifically configured to use a plurality of sets of detection rules preset for a plurality of risk patterns to detect whether a corresponding pattern subgraph exists in the transaction graph.

[0088] In some embodiments, the second searching unit 63 is specifically configured to obtain a first embedding representation of the transaction graph, calculate a similarity between the first embedding representation and a second embedding representation of a transaction graph corresponding to each transaction case in the case base, and obtain case analysis texts corresponding to one or more transaction cases with the highest similarity.

[0089] In a further embodiment, the second searching unit 63 is specifically configured to encode each node in the transaction graph by using a language model to obtain a first vector representation of each node, process the first vector representation of each node in the transaction graph by using a graph neural network to obtain a second vector representation of each node, and perform an aggregation operation on the second vector representation of all nodes in the transaction graph to obtain the first embedding representation of the transaction graph.

[0090] In a further embodiment, the second searching unit 63 is specifically configured to encode a description text of each transaction record corresponding to each edge in the transaction graph by using a language model to obtain an edge representation vector of each edge, and determine a first vector representation of any node according to the edge representation vectors of all connected edges of the node.

[0091] In some embodiments, the obtaining unit 61 is specifically configured to obtain first transaction records of a target user within a predetermined time period and second transaction records of other users having transaction behaviors with the target user within the predetermined time period to obtain a transaction group containing a plurality of transaction records.

[0092] In some embodiments, the case analysis includes an evaluation conclusion on whether the transaction case is risky and a risk pattern thereof, and a reasoning process for deriving the evaluation conclusion; and the transaction risk analysis result includes an analysis conclusion on whether the transaction group is risky and a risk pattern thereof, and a reasoning process for deriving the analysis conclusion.

[0093] In some embodiments, the case library is constructed by: extracting a sample transaction group from a target data set, the sample transaction group having a first label of whether being a risky transaction and a second label of a risk pattern thereof; inputting each transaction in the sample transaction group, the first label and the second label into a second large language model, and letting the second large language model output a reasoning step with the first label and the second label as an evaluation conclusion; and adding the sample transaction group as a transaction case, the first label, the second label and the reasoning step as a corresponding case analysis to the case library.

[0094] In some embodiments, the target data set is constructed by: generating a serialized transaction record by a third large language model, and adding the serialized transaction record as a normal transaction to the target data set; and generating a transaction group under each risk pattern by a simulator based on a definition rule of the risk pattern and a data distribution of real transaction data, and adding the transaction group to the target data set after adding the first label and the second label thereto.

[0095] In some embodiments, the transaction risk analysis apparatus 600 further includes a training unit. The training unit is configured to construct a training data set, fine-tune a general large language model by using the training data set to obtain the first large language model, wherein each training data in the training data set includes a sample transaction group, risk knowledge related to a risk pattern matched with the sample transaction group found from the knowledge base, a case analysis similar to the sample transaction group found from the case library, and an expected model output.

[0096] The specific implementation examples of each unit in the above apparatus can refer to the descriptions of the foregoing embodiments. Figure 2

[0097] According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in conjunction with Figure 2

[0098] According to yet another aspect, embodiments also provide a computer program product comprising computer program / instructions which, when executed in a processor, implement the method steps described in conjunction with the foregoing Figure 2

[0099] ​​​According to an embodiment of still another aspect, there is also provided a computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements a method as described above in connection with Figure 2 the method.

[0100] Those skilled in the art should understand that, in one or more examples described above, the functions described in the specification can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.

[0101] The above detailed description merely describes the specific implementation of the present application, and the purpose, technical solutions and beneficial effects of the present application are further described in detail. It should be understood that the above description is only a specific implementation of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application should be included in the protection scope of the present application.

Claims

1. A method for analyzing transaction risks, comprising: Obtain a transaction group containing multiple transaction records, and construct a transaction graph based on the transaction group; the multiple transaction records include transaction records related to the target user within a predetermined time period; Search the transaction graph for several pattern subgraphs representing several risk patterns to obtain matching subgraphs; Retrieve risk knowledge related to the risk pattern represented by the matching subgraph from the knowledge base; The case analysis of finding transaction cases similar to the transaction graph from the case library specifically includes: obtaining a first embedded representation of the transaction graph; calculating the similarity between the first embedded representation and the second embedded representation of the transaction graph corresponding to each transaction case in the case library; and obtaining the case analysis text corresponding to one or more transaction cases with the highest similarity. The multiple transaction records, the risk knowledge, and the case analysis are input into the first language model to obtain the transaction risk analysis results of the transaction group output by the first language model.

2. The method according to claim 1, wherein, The transaction graph is searched for several pattern subgraphs representing several risk patterns, including: Several sets of detection rules, each pre-set for a number of risk patterns, are used to detect whether a corresponding pattern subgraph exists in the transaction graph.

3. The method according to claim 1, wherein, Obtaining the first embedded representation of the transaction graph includes: The nodes in the transaction graph are encoded using a language model to obtain the first vector representation of each node; The first vector representation of each node in the transaction graph is processed using a graph neural network to obtain the second vector representation of each node. An aggregation operation is performed on the second vector representations of all nodes in the transaction graph to obtain the first embedded representation of the transaction graph.

4. The method according to claim 3, wherein, The transaction graph is encoded using a language model to obtain the first vector representation of each node, including: The descriptive text of the transaction records corresponding to each edge in the transaction graph is encoded using a language model to obtain the edge representation vector of each edge. For any node, determine the first vector representation of the node based on the edge representation vectors of all its connected edges.

5. The method according to claim 1, wherein, Retrieve transaction groups containing multiple transaction records, including: Obtain the first transaction record of the target user within a predetermined time period, and the second transaction records of other users who have transaction behavior with the target user within the predetermined time period, to obtain a transaction group containing multiple transaction records.

6. The method according to claim 1, wherein, The case analysis includes the assessment conclusions regarding whether the transaction case has risks and the risk patterns therein, as well as the reasoning process that leads to these assessment conclusions; The transaction risk analysis results include analytical conclusions regarding whether the transaction group has risks and the risk patterns it exhibits, as well as the reasoning process that leads to these conclusions.

7. The method according to claim 1, wherein, The case library is constructed in the following way: Extract sample trading groups from the target dataset. Each sample trading group has a first label indicating whether it is a risky trading group and a second label indicating the risk pattern it exhibits. Input the first label and the second label of each transaction in the sample transaction group into the second language model, and let it output the reasoning steps with the first label and the second label as the evaluation conclusion; The sample transaction group is used as a transaction case, and the first label, the second label, and the reasoning step are used as corresponding case analyses and added to the case library.

8. The method according to claim 7, wherein, The target dataset is constructed in the following manner: Serialized transaction records are generated using the third language model and added to the target dataset as normal transactions. Based on the definition rules of the aforementioned risk modes and the data distribution of real transaction data, a transaction group under each risk mode is generated using a simulator, and then the first label and the second label are added to it before it is added to the target dataset.

9. The method according to claim 1, further comprising: A training dataset is constructed, and a general large language model is fine-tuned using the training dataset to obtain the first large language model. Each piece of training data in the training dataset includes a sample transaction group, risk knowledge related to risk patterns matching the sample transaction group found in the knowledge base, case analysis similar to the sample transaction group found in the case library, and the expected model output.

10. The method according to claim 1, wherein, The aforementioned risk models include one or more of the following: Fast forward / fast out mode; Circular transaction model; A pattern of first dispersing and then converging; The model of first gathering and then dispersing.

11. A transaction risk analysis device, comprising: The acquisition unit is configured to acquire a transaction group containing multiple transaction records and construct a transaction graph based on the transaction group; the multiple transaction records include transaction records related to the target user within a predetermined time period; The first search unit is configured to search for several pattern subgraphs representing several risk patterns in the transaction graph to obtain a matching subgraph; Retrieve risk knowledge related to the risk pattern represented by the matching subgraph from the knowledge base; The second search unit is configured to search for case analysis of transaction cases similar to the transaction graph from the case library, specifically including: obtaining the first embedded representation of the transaction graph; calculating the similarity between the first embedded representation and the second embedded representation of the transaction graph corresponding to each transaction case in the case library; and obtaining the case analysis text corresponding to one or more transaction cases with the highest similarity. The analysis unit is configured to input the multiple transaction records, the risk knowledge, and the case analysis into a first large language model to obtain the transaction risk analysis results of the transaction group output by the first large language model.

12. A computer program product comprising a computer program / instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1-10.

13. A computing device, comprising a memory and a processor, characterized in that, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-10.

Images