A machine learning based account risk prediction method and system

Abstract

This invention relates to the field of computer technology and discloses a machine learning-based method and system for predicting account risk. The method includes acquiring transaction details, login behavior, and terminal environment information of a target account at different time periods to construct a dynamic account behavior feature dataset; performing multi-layer nested feature extraction on the dynamic account behavior feature dataset and constructing an account risk behavior evolution model using a fusion algorithm of temporal convolutional networks and attention mechanisms; determining whether the risk sensitivity of the account risk behavior evolution model is stable within the current training period based on the trend changes of response offsets; generating a prediction scoring matrix for potentially risky accounts by applying a multi-stage decision network and counterfactual reasoning mechanism to the corrected behavior sequence; and performing a multi-dimensional fusion evaluation of the account's current state based on the misjudgment boundary correction results and a pre-set risk control knowledge base. This invention has the advantage of reducing the misjudgment rate.

Description

Technical Field

[0001] This invention relates to the field of computer technology, specifically to a method and system for predicting account risk based on machine learning. Background Technology

[0002] The current financial environment is increasingly complex, and account risk is manifesting in increasingly diverse forms, with users' risky behaviors exhibiting strong concealment and deceptiveness. Machine learning-based account risk prediction methods have been widely applied in scenarios such as financial anti-fraud and risk control audits. A common approach is to train classification models based on historical account transaction data and user behavioral characteristics to determine whether an account poses a potential risk. However, existing technologies still have some significant technical bottlenecks, particularly in their insufficient ability to identify accounts at risk. The behavioral characteristics of such accounts often hover between normal and abnormal, neither violating existing rules nor exhibiting obvious fraudulent features. They are often incorrectly classified as low-risk due to the lack of fine-grained dynamic behavioral modeling, making them potential targets for exploitation of system vulnerabilities. Existing methods do not fully consider the time dependence and contextual evolution of account transaction behavior when constructing features, resulting in models struggling to respond promptly to the gradual evolution of risky behavior. For example, an account may gradually increase transaction amounts, extend operation times, and change transaction periods in a short period. If this slow process of change is not effectively captured, the model may easily overlook the gradual accumulation of risk. Therefore, it is necessary to design a machine learning-based method and system for predicting account risk that reduces the false positive rate. Summary of the Invention

[0003] (a) Technical problems to be solved

[0004] To address the shortcomings of existing technologies, this invention provides a machine learning-based method and system for predicting account risks, which has the advantage of reducing the false positive rate and solves the problems mentioned in the background technology.

[0005] (II) Technical Solution

[0006] To achieve the aforementioned goal of reducing the false positive rate, this invention provides the following technical solution: a machine learning-based account risk prediction method, comprising the following steps:

[0007] The system acquires transaction details, login behavior, and terminal environment information of the target account at different time periods, and constructs a dynamic behavior feature dataset of the account by combining a high-dimensional feature encoding strategy and a context sequence analysis mechanism.

[0008] Multi-layer nested feature extraction is performed on the account dynamic behavior feature dataset. An account risk behavior evolution model is constructed using a fusion algorithm of temporal convolutional network and attention mechanism. In the process of model construction, perturbation parameters are introduced to monitor the model's response offset to abnormal behavior features in real time.

[0009] Based on the trend change of the response offset, it is determined whether the risk sensitivity of the account risk behavior evolution model is stable in the current training period. If it is stable, the temporal evolution nodes of risk behavior are recorded, and the behavior sequence is dynamically corrected in combination with the local anomaly factor evaluation mechanism.

[0010] For the corrected behavioral sequence, a multi-stage decision network and counterfactual reasoning mechanism are applied to generate a prediction score matrix for potential risk accounts and to correct the misjudgment boundary of the prediction results.

[0011] Based on the results of the misjudgment boundary correction, and combined with the preset risk control knowledge base, a multi-dimensional integrated assessment of the current status of the account is conducted, and the final risk prediction result is output.

[0012] Preferably, the process of constructing the account dynamic behavior feature dataset is as follows:

[0013] Collect raw behavioral data of the target account at different time periods, and format and remove outliers from the raw data;

[0014] Behavioral data is classified and encoded based on feature type. For numerical features, Z-score standardization is used, and for categorical features, a combination of one-hot encoding and target encoding is used.

[0015] By utilizing the context sequence analysis mechanism, the dependency relationship between preceding and subsequent behaviors is introduced into each behavior time segment, and context label features are constructed to generate a dataset of dynamic account behavior features.

[0016] Preferably, the multi-layered nested feature extraction process for the account dynamic behavior feature dataset is as follows:

[0017] After inputting the feature dataset, a nested structure of short-term and long-term behaviors is constructed based on behavior time slices;

[0018] Within the nested structure, local statistical feature extraction and trend change capture are performed separately to form nested feature representations at different time scales;

[0019] A screening mechanism based on the change rate of feature entropy is introduced to filter out invalid features and retain a subset of features with high information density;

[0020] Hierarchical combination of high-information-density feature subsets generates derived features.

[0021] Preferably, the process of constructing an account risk behavior evolution model using a fusion algorithm of temporal convolutional networks and attention mechanisms is as follows:

[0022] The nested feature matrix is ​​input into a temporal convolutional network, and the local perception mechanism is used to extract short-term change patterns.

[0023] After the temporal convolutional layer, a multi-head self-attention mechanism is introduced to model the long-term dependencies and abnormal jump patterns among account behaviors;

[0024] Introducing residual connection structures enhances the nonlinear expressive power of the model;

[0025] By combining behavioral type labels and timestamp information, an intermediate state sequence of risk evolution is generated, and the predicted value of risk change is output synchronously during the training process;

[0026] During the training process, perturbation parameters are introduced to simulate the changes in model output under input perturbation, ultimately forming an account risk behavior evolution model.

[0027] Preferably, the process for determining whether the risk sensitivity of the account risk behavior evolution model is stable within the current training period is as follows:

[0028] During each round of model training, the predicted output offset before and after the perturbation is calculated in real time, and the corresponding perturbation response vector is recorded.

[0029] The changing trend of the perturbation response vector in multiple consecutive training rounds is fitted, and a response offset trend curve is constructed.

[0030] Set the offset volatility threshold and the average disturbance response magnitude threshold to determine whether the model’s risk perception capability is stable.

[0031] If the response offset trend curve is stable and the average disturbance response amplitude fluctuation is less than or equal to the offset volatility threshold, then the model's risk perception capability is considered stable.

[0032] If the response offset trend curve is not stable and the average disturbance response amplitude fluctuation is greater than the offset volatility threshold, then the model's risk perception capability is considered unstable.

[0033] Preferably, the process of dynamically correcting the behavioral sequence by combining the evaluation mechanism of local anomaly factors is as follows:

[0034] Extract risk evolution nodes and corresponding behavioral fragments during the construction process, and construct a subset of local features of the nodes;

[0035] Apply the local outlier factor algorithm to a subset of local features of each node to calculate the local anomaly score.

[0036] Identify behavioral segments with abnormally high scores and determine that these segments are mutation behaviors.

[0037] By combining historical templates of similar account behavior, abnormal segments can be replaced or expanded through matching analysis to complete the correction of abnormal behavior.

[0038] Preferably, the process of correcting the misjudgment boundary of the prediction results is as follows:

[0039] An account risk score vector is generated based on the corrected behavior sequence, and a misjudgment boundary discrimination model is constructed by combining the misjudgment samples in the training set.

[0040] A counterfactual reasoning mechanism is introduced to construct comparative behavior samples of boundary behaviors near the prediction results, simulating the possibility of boundary reversal.

[0041] Adjust the discrimination threshold in the risk scoring model based on the deviation between the actual misjudged label and the simulated reverse output;

[0042] The account scoring results in the boundary area are calculated using probability weighting to correct the bias caused by fuzzy judgment.

[0043] Preferably, the process for outputting the final risk prediction result is as follows:

[0044] The risk score, after correction for misjudgment boundaries, will be integrated with the account's historical behavior patterns, environmental tags, and device trust levels.

[0045] The risk level mapping rules preset in the risk control knowledge base are invoked, and risk classification is determined by combining the scoring range.

[0046] For accounts with risk levels in the critical range, a risk prediction result is output by combining time-period risk weights with cross-platform behavior comparison scores.

[0047] A machine learning-based account risk prediction system includes:

[0048] Data acquisition module: Acquires multi-source data such as transaction, login and terminal environment of target account, and constructs dynamic behavior feature dataset of account by combining high-dimensional feature encoding and context sequence analysis;

[0049] Risk Evolution Module: Performs multi-layer feature extraction on account behavior data, models the evolution process of account risk behavior by fusing temporal convolutional networks and attention mechanisms, and introduces perturbation parameters to monitor model response shift;

[0050] Trend Judgment Module: Determines whether the risk sensitivity is stable based on the trend of model response offset. If stable, it identifies key nodes in the behavioral evolution and uses the local anomaly factor mechanism to dynamically correct the behavioral sequence.

[0051] Risk scoring module: It scores the potential risks of the modified behavioral sequence, generates a prediction matrix by combining a multi-stage decision network and counterfactual reasoning method, and corrects the boundary of misjudgment of the results.

[0052] Results output module: Integrates risk control knowledge base and account risk scoring results, performs multi-dimensional fusion analysis, and outputs risk prediction results.

[0053] (III) Beneficial Effects

[0054] Compared with existing technologies, the present invention provides a machine learning-based method and system for predicting account risk, which has the following advantages:

[0055] This invention, by introducing high-dimensional feature encoding and contextual sequence analysis mechanisms, can fully mine the behavioral evolution information of accounts at different time periods, significantly improving the accuracy of characterizing abnormal behavior patterns. It constructs a risk behavior evolution model by fusing temporal convolutional networks and attention mechanisms, ensuring local behavior perception while considering global dependencies, enhancing the ability to identify gradual behavioral trends and sudden anomalies. By introducing micro-perturbation parameters and monitoring model output offset in real time, it effectively judges the stability of risk sensitivity and avoids misjudgments caused by using non-converged models. Combining a local anomaly factor evaluation mechanism to correct behavioral sequences further improves the credibility and consistency of behavioral data. A multi-stage decision network and counterfactual reasoning mechanism can dynamically correct boundary prediction results, significantly reducing the risk of misjudgments caused by sample distribution offsets. Finally, it integrates a risk control knowledge base for multi-dimensional evaluation, effectively improving the interpretability and business adaptability of predictions. The overall solution has higher prediction accuracy, lower misjudgment rate, and stronger model generalization ability, providing the financial industry with a robust, efficient, and real-time adaptable intelligent risk control solution. Attached Figure Description

[0056] Figure 1 This is a schematic diagram of the method of the present invention;

[0057] Figure 2 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example 1: Please refer to Figure 1 As shown in the embodiment of the present invention, a machine learning-based account risk prediction method includes the following steps:

[0060] S1: Obtain transaction details, login behavior, and terminal environment information of the target account at different time periods, and construct a dynamic behavior feature dataset of the account by combining high-dimensional feature encoding strategy and context sequence analysis mechanism.

[0061] The process of constructing the account dynamic behavior feature dataset in S1 is as follows:

[0062] Collect raw behavioral data of the target account at different time periods, including transaction details, login time, IP address changes, device information, geographical location, transaction amount, transaction frequency and operation path, and perform formatting and outlier removal on the raw data;

[0063] Behavioral data is classified and encoded based on feature type. Numerical features are standardized using Z-score, while categorical features are classified using a combination of one-hot encoding and target encoding. After standardization, the numerical features have a mean of 0 and a standard deviation of 1, which improves the scale consistency among different features. For categorical features, high-frequency categories are encoded using one-hot encoding, which converts each category into a separate binary column. Low-frequency categories are encoded using target encoding, which calculates the average risk probability corresponding to the category based on historical risk labels and maps it to a continuous value.

[0064] By leveraging context sequence analysis, dependencies between preceding and subsequent behaviors are introduced into each behavioral time segment. Context label features, including behavior transition paths, behavior jump probabilities, and operation time period preferences, are constructed to generate a dynamic account behavior feature dataset. Behavioral sequences are divided into time segments according to fixed time windows or behavior continuity rules. Behavioral events within each time segment are organized sequentially to form behavior chains. The behavior type sequence of each account within a segment is modeled, such as login → transfer → balance inquiry → logout, and a behavior transition matrix is ​​recorded. A state transition probability matrix is ​​introduced to represent the transition tendency between various behaviors. The existence of jumps between consecutive behaviors that do not conform to normal operating habits is analyzed, and the probability of jumps occurring is calculated. The time of behavioral events is mapped to time periods of the day, and the time preference distribution of account operations is calculated. Behavioral chain sequences, transition probabilities, jump indicators, and time period preferences are integrated with the original encoded features through feature concatenation to generate a complete time series context feature matrix. The high-dimensional encoded features, time segment labels, and context behavior dependency structure are uniformly merged. Structured behavioral sequence samples with account ID + time segment as the primary key are constructed, and each sample records the complete behavioral features of the account within a specific time segment.

[0065] S2: Multi-layer nested feature extraction is performed on the account dynamic behavior feature dataset. A model for the evolution of account risk behavior is constructed by fusion algorithm of temporal convolutional network and attention mechanism. In the process of model construction, perturbation parameters are introduced to monitor the response offset of the model to abnormal behavior features in real time.

[0066] The multi-layer nested feature extraction process for the account dynamic behavior feature dataset in S2 is as follows:

[0067] After inputting the feature dataset, a nested structure of short-term and long-term behaviors is constructed based on behavior time slices;

[0068] Within the nested structure, local statistical feature extraction and trend change capture are performed separately to form nested feature representations at different time scales. The account dynamic behavior feature dataset is sorted in chronological order, with each account forming a complete behavior sequence. A short-term window is set to capture instantaneous fluctuations in behavior features, and a long-term window is set to model the behavior patterns of accounts over daily or weekly periods. The behavior sequence in the long-term window is used as the outer feature structure, and the short-term window sequence is used as the inner behavior flow, forming a sliding window + time pyramid nested expression in the model structure. Short-term and long-term windows are paired for each time node to ensure the temporal synchronization of nested features.

[0069] A filtering mechanism based on the rate of change of feature entropy is introduced to filter out invalid features and retain a subset of features with high information density; for each behavioral feature... The information entropy for the entire sample is calculated using the following formula:

[0070] ;

[0071] In the formula, The probability of the eigenvalue distribution;

[0072] The formula for calculating the rate of change of information entropy over time for a sequence of feature values ​​of the same account within a continuous time period is:

[0073] ;

[0074] In the formula, Features The rate of change of information entropy between adjacent time windows t-1 and t Features The information entropy within the current time window t, Features The information entropy within the previous time window t-1;

[0075] The system hierarchically combines high-information-density feature subsets to generate derived features such as behavioral change speed, magnitude, and frequency. Within the retained feature subsets, features are combined according to a three-dimensional structure of feature-time-account. Interactive features are constructed, such as transaction amount × login time period, terminal type × operation frequency, IP change frequency × geographical span, etc. For a numerical feature within a sliding time window, the rate of change is calculated, the maximum jump magnitude and direction of behavioral features within each window are recorded, and the frequency of key behaviors per unit time is statistically analyzed to construct a frequency vector.

[0076] The process of constructing the account risk behavior evolution model in S2 using a fusion algorithm of temporal convolutional networks and attention mechanisms is as follows:

[0077] Nested feature matrices are input into a temporal convolutional network to extract short-term change patterns using a local perception mechanism; the multi-layered nested feature representations are constructed as a three-dimensional tensor input, with each account as a unit. , where B is the number of accounts, T is the time step length, and F is the feature dimension of each time step; a temporal convolutional network is adopted to construct a stacked structure consisting of multiple one-dimensional convolutional layers, dilated convolution is used to expand the receptive field, each convolutional layer has a sliding window covering multiple time steps, only past information is used for feature extraction to avoid future data leakage, and the output of the convolution operation contains a feature tensor containing local behavioral change patterns.

[0078] Following the temporal convolutional layers, a multi-head self-attention mechanism is introduced to model the long-term dependencies and anomalous jump patterns among account behaviors. The core idea of ​​this multi-head self-attention mechanism is to adaptively learn the weights between behavioral events within the temporal dimension, converting the convolutional network output into three sets of representations: Q, K, and V, representing the query vector, attention key vector, and behavior value at the current time step, respectively. Multiple independent attention heads are used to capture behavioral dependency features at different levels or dimensions, and finally, the outputs of each head are concatenated and projected.

[0079] Introducing residual connection structures enhances the nonlinear expressive power of the model and improves training stability; adding residual connections after each convolutional layer and attention module allows the original features to propagate directly in subsequent layers, avoiding gradient vanishing; improving the network's sensitivity to feature changes and enhancing learning stability; supporting deep stacked network structures to better fit the nonlinear risk evolution process.

[0080] By combining behavioral type labels and timestamp information, an intermediate state sequence of risk evolution is generated, and the predicted risk change value is output synchronously during the training process. The type labels of behavioral events are encoded into vectors through an embedding layer and concatenated to the output of the attention module. Standardized timestamp vectors are added to enhance the model's ability to model time dependencies. The above concatenation results are input into a bidirectional GRU layer to output the risk state representation at each time step. At each time step, a fully connected layer + sigmoid activation function is applied to output a risk score, representing the potential risk level of the account at that time point. The training objective is to minimize the cross-entropy loss between the predicted score and the true label.

[0081] During training, perturbation parameters are introduced to simulate changes in model output under input perturbation, ultimately forming a stable and reusable evolution model of account risk behavior.

[0082] S3: Based on the trend change of the response offset, determine whether the risk sensitivity of the account risk behavior evolution model is stable in the current training period. If it is stable, record the temporal evolution nodes of the risk behavior and dynamically correct the behavior sequence in combination with the local anomaly factor evaluation mechanism.

[0083] The process in S3 for determining whether the risk sensitivity of the account risk behavior evolution model is stable within the current training period is as follows:

[0084] During each round of model training, the predicted output offset before and after the perturbation is calculated in real time, and the corresponding perturbation response vector is recorded. During each round of model training, a micro-perturbation is introduced into the input account dynamic nested feature data to form a perturbation sample. The original sample and the perturbation sample are respectively input into the account risk behavior evolution model to obtain two sets of prediction results. The prediction output of the original prediction output is compared with the prediction output of the perturbation sample, and the prediction difference between the two is calculated. This difference is recorded as the perturbation response vector of the current round. After each round of training is completed, the perturbation response vector is appended to the perturbation response sequence.

[0085] The changing trend of the perturbation response vector in multiple consecutive training rounds is fitted, and a response offset trend curve is constructed. Based on the perturbation response vector recorded in multiple consecutive training rounds, a certain number of continuous vectors are selected to form a sliding window. A trend analysis algorithm is applied to fit the changing trend of the perturbation response in the training period to obtain a perturbation offset trend curve. By analyzing the slope and fluctuation trend of the trend curve, the stable response capability of the model to the perturbation input during the training process is judged.

[0086] Set a threshold for offset volatility and a threshold for average disturbance response amplitude to determine whether the model's risk perception capability is stable; calculate the standard deviation and mean of the disturbance response vector within a sliding window and compare them with the two set thresholds respectively;

[0087] If the response offset trend curve is stable and the average disturbance response amplitude fluctuation is less than or equal to the offset volatility threshold, then the model's risk perception capability is considered stable.

[0088] If the response offset trend curve is not stable and the average disturbance response amplitude fluctuation is greater than the offset volatility threshold, then the model's risk perception capability is considered unstable.

[0089] The process of dynamically correcting the behavioral sequence in S3, which incorporates the evaluation mechanism of local anomaly factors, is as follows:

[0090] Extract risk evolution nodes and corresponding behavioral fragments during the construction process, and construct a subset of local features for each node; during the construction of the account risk behavior evolution model, record the risk evolution nodes that are judged as key changes at each time step, and extract several behavioral records before and after them to form a local behavioral fragment; for each node behavioral fragment, extract the corresponding feature vector set, including the transaction amount change rate, device switching frequency, login location jump range, etc., and construct a subset of local features for anomaly detection.

[0091] For each node's local feature subset, the local outlier factor algorithm is applied to calculate the local anomaly score. For each local feature subset, the local outlier factor algorithm is used for processing. The difference in K-nearest neighbor density between the segment and its neighboring segments is calculated to evaluate the isolation degree of the behavior segment in the local feature space and output an outlier factor score. The higher the score, the more likely it is to be a local anomalous behavior.

[0092] Identify behavioral segments with abnormally high scores and determine them as mutation behaviors; filter all local outlier factor scores according to a preset abnormal score threshold; if the LOF value of a certain behavioral segment exceeds the threshold and there is an obvious temporal / spatial / pattern mutation in the original behavioral sequence, then mark the behavioral segment as a mutation behavior; mutation behaviors include abnormal transaction time, sudden transaction peaks, and rare device logins;

[0093] By combining historical templates of similar account behavior, abnormal segments can be replaced or expanded through matching analysis to complete the correction of abnormal behavior.

[0094] Understandably, the purpose of determining whether the risk sensitivity of the account risk behavior evolution model is stable within the current training period is:

[0095] Function 1: By analyzing the trend changes of the perturbation response vector in consecutive training rounds, it is possible to identify whether there are large fluctuations in the prediction results of the model under different input perturbations. If the fluctuations are too large, it indicates that the model is too sensitive to local abnormal behavior or is unstable, and there is a risk of overfitting or structural underfitting.

[0096] Function 2: When the risk sensitivity of the model tends to stabilize during the training period, the identified risk evolution nodes and prediction results have high credibility and can effectively support subsequent steps such as behavioral sequence anomaly correction and risk scoring matrix construction. If the stability is not judged and the output of the non-converged or unstable model is used directly, it is easy to cause the subsequent misjudgment boundary to expand and affect the accuracy of the overall risk prediction chain.

[0097] The technical solution of this embodiment is as follows: By introducing micro-perturbation parameters during model training, the offset response of the model output before and after the perturbation is monitored in real time, and a response offset trend curve is constructed for consecutive rounds. If the fluctuation of this curve is lower than a preset threshold, it is determined that the model's ability to perceive risky behavior tends to stabilize within the current training period. Subsequently, the temporal evolution nodes of the risky behaviors identified by the model within this period are extracted, and abnormal behavior segments are identified and corrected based on the local anomaly factor evaluation mechanism. The account behavior sequence is dynamically corrected, and the subsequent risk scoring results are optimized. This achieves effective perception of the model's risk sensitivity state, avoids premature reliance on its output results before the model is stable, and improves the reliability of risk identification results. At the same time, the dynamic correction of the behavior sequence through the local anomaly factor evaluation mechanism significantly improves the model's fault tolerance and robustness to behavioral mutations, thereby reducing the misjudgment rate and enhancing prediction accuracy.

[0098] Example 2: As Figure 1 As shown, a machine learning-based account risk prediction method further includes the following steps:

[0099] S4: For the corrected behavioral sequence, a multi-stage decision network and counterfactual reasoning mechanism are applied to generate a prediction score matrix for potential risk accounts, and the misjudgment boundary is corrected for the prediction results.

[0100] The process of correcting the misjudgment boundary of the prediction result in S4 is as follows:

[0101] An account risk score vector is generated based on the corrected behavior sequence, and a misjudgment boundary discrimination model is constructed by combining it with misjudged samples in the training set. The account behavior sequence after anomaly correction is used as the model input, and the risk behavior evolution model trained is used to output the risk score vector of the current account. Historical misjudged samples of the model are extracted from the training set, including instances that were incorrectly judged as risky accounts or normal accounts, and their score distribution and behavioral feature differences are analyzed. Normal samples, risky samples and misjudged samples are input together into the boundary discrimination sub-model to train a boundary recognition module with misjudgment sensitivity, which is used to identify accounts that are prone to misjudgment within the score boundary area.

[0102] A counterfactual reasoning mechanism is introduced to construct comparative behavior samples for boundary behaviors near the predicted results, simulating the possibility of boundary reversal. A behavior sequence in which the risk score of the current account falls near the model score boundary is selected, and a set of counterfactual behavior samples is generated based on this sequence. That is, a small number of feature changes are artificially controlled to keep most of the behavioral background unchanged. The original sequence and the counterfactual samples are input into the model together to observe whether the predicted labels are reversed. The label change probability of each set of boundary samples under different perturbation conditions is statistically analyzed to measure the stability and boundary sensitivity of the judgment results.

[0103] Based on the deviation between the actual misjudged labels and the simulated reversed output, adjust the discrimination threshold in the risk scoring model; compare the true labels of historical misjudged samples with the prediction results of their counterfactual simulated samples, and calculate the label deviation between the two in the model scoring space; if the labels of misjudged samples are easily flipped under counterfactual perturbation, it indicates that there is a sensitive range in the current model boundary setting; based on the error distribution and boundary behavior characteristics, dynamically adjust the risk discrimination scoring threshold in the model to give it a higher fault tolerance rate in high misjudgment areas, thereby improving the recognition accuracy of boundary samples;

[0104] The scoring results of accounts in the boundary area are weighted by probability to correct the bias caused by fuzzy judgment. For all accounts whose scores fall near the risk discrimination boundary, the label uncertainty coefficient is calculated by combining the reversal probability under counterfactual simulation. The uncertainty coefficient is used to weight the original risk scores by probability to improve the fault tolerance of the predicted values ​​for fuzzy samples. The weighted scoring results can dynamically reflect the degree of risk fluctuation of account behavior under boundary perturbation, thus forming a more robust final judgment result.

[0105] S5: Based on the error boundary correction results and combined with the preset risk control knowledge base, perform a multi-dimensional fusion assessment of the current account status and output the final risk prediction result.

[0106] The process of outputting the final risk prediction result in S5 is as follows:

[0107] The risk score, corrected for misjudgment boundaries, is integrated with the account's historical behavior patterns, environmental tags, and device trust levels. The corrected account risk score is then obtained, and the target account's historical behavior patterns over a long period are retrieved, including behavioral rhythm, fund flow paths, and operational habits. Environmental tags for the current time period are extracted, such as holiday visits, nighttime access, and logins to sensitive areas. The historical behavior records and associated risk distribution of the terminal device used by the account are obtained, and the device's trust score is calculated. These three types of information are used as weighted features and integrated with the risk score. The resulting risk probability value is obtained through feature normalization and Bayesian inference.

[0108] The system calls upon the preset risk level mapping rules in the risk control knowledge base and combines them with the scoring range to determine the risk level. The merged risk probability value is then input into the predefined risk level mapping function in the risk control knowledge base. The function divides the probability value into several scoring ranges according to the standards of financial institutions. The system then marks the account with a preliminary risk level based on the range in which the merged score falls.

[0109] For accounts with risk levels in the critical range, a risk prediction result is output by combining time-period risk weights and cross-platform behavior comparison scores. For accounts on the verge of multiple risk levels, the risk weight parameter of the time period to which their behavior belongs is extracted. This parameter represents the probability of fraud in a specific time period based on historical statistics. The consistency between the account's behavior trajectory on other platforms or systems and its behavior on the current platform is analyzed, and a cross-platform behavior comparison score is calculated. The risk level label of the current account is adjusted using the above two indicators. If both indicators tend to be high risk, the critical account is labeled as high risk; otherwise, the original level is maintained. Finally, the risk prediction result after fusion judgment is output.

[0110] Example 3: Please refer to Figure 2 As shown, an account risk prediction system based on machine learning includes:

[0111] Data acquisition module: Acquires multi-source data such as transaction, login and terminal environment of target account, and constructs dynamic behavior feature dataset of account by combining high-dimensional feature encoding and context sequence analysis;

[0112] Risk Evolution Module: Performs multi-layer feature extraction on account behavior data, models the evolution process of account risk behavior by fusing temporal convolutional networks and attention mechanisms, and introduces perturbation parameters to monitor model response shift;

[0113] Trend Judgment Module: Determines whether the risk sensitivity is stable based on the trend of model response offset. If stable, it identifies key nodes in the behavioral evolution and uses the local anomaly factor mechanism to dynamically correct the behavioral sequence.

[0114] Risk scoring module: It scores the potential risks of the modified behavioral sequence, generates a prediction matrix by combining a multi-stage decision network and counterfactual reasoning method, and corrects the boundary of misjudgment of the results.

[0115] Results output module: Integrates risk control knowledge base and account risk scoring results, performs multi-dimensional fusion analysis, and outputs risk prediction results.

[0116] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0117] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A machine learning based account risk prediction method, characterized in that, Includes the following steps: The system acquires transaction details, login behavior, and terminal environment information of the target account at different time periods, and constructs a dynamic behavior feature dataset of the account by combining a high-dimensional feature encoding strategy and a context sequence analysis mechanism. Multi-layer nested feature extraction is performed on the account dynamic behavior feature dataset. An account risk behavior evolution model is constructed using a fusion algorithm of temporal convolutional network and attention mechanism. In the process of model construction, perturbation parameters are introduced to monitor the model's response offset to abnormal behavior features in real time. Based on the trend change of the response offset, it is determined whether the risk sensitivity of the account risk behavior evolution model is stable in the current training period. If it is stable, the temporal evolution nodes of risk behavior are recorded, and the behavior sequence is dynamically corrected in combination with the local anomaly factor evaluation mechanism. The process for determining whether the risk sensitivity of the account risk behavior evolution model is stable within the current training period is as follows: During each round of model training, the predicted output offset before and after the perturbation is calculated in real time, and the corresponding perturbation response vector is recorded. The changing trend of the perturbation response vector in multiple consecutive training rounds is fitted, and a response offset trend curve is constructed. Set the offset volatility threshold and the average disturbance response magnitude threshold to determine whether the model’s risk perception capability is stable. If the response offset trend curve is stable and the average disturbance response amplitude fluctuation is less than or equal to the offset volatility threshold, then the model's risk perception capability is considered stable. If the response offset trend curve is not stable and the average disturbance response amplitude fluctuation is greater than the offset volatility threshold, the model's risk perception capability is determined to be unstable. The process of dynamically correcting the behavioral sequence by combining the evaluation mechanism of local anomaly factors is as follows: Extract risk evolution nodes and corresponding behavioral fragments during the construction process, and construct a subset of local features of the nodes; Apply the local outlier factor algorithm to a subset of local features of each node to calculate the local anomaly score. Identify behavioral segments with abnormally high scores and determine that these segments are mutation behaviors. By combining historical templates of similar account behavior, abnormal segments are replaced or expanded through matching analysis to complete the correction of abnormal behavior; For the corrected behavioral sequence, a multi-stage decision network and counterfactual reasoning mechanism are applied to generate a prediction score matrix for potential risk accounts and to correct the misjudgment boundary of the prediction results. The process of correcting the misjudgment boundary of the prediction results is as follows: An account risk score vector is generated based on the corrected behavior sequence, and a misjudgment boundary discrimination model is constructed by combining the misjudgment samples in the training set. A counterfactual reasoning mechanism is introduced to construct comparative behavior samples of boundary behaviors near the prediction results, simulating the possibility of boundary reversal. Adjust the discrimination threshold in the risk scoring model based on the deviation between the actual misjudged label and the simulated reverse output; The account scoring results in the boundary area are weighted by probability to correct the bias caused by fuzzy judgment. Based on the results of the misjudgment boundary correction, and combined with the preset risk control knowledge base, a multi-dimensional integrated assessment of the current status of the account is conducted, and the final risk prediction result is output.

2. The method of claim 1, wherein, The process of constructing the account dynamic behavior feature dataset is as follows: Collect raw behavioral data of the target account at different time periods, and format and remove outliers from the raw data; Behavioral data is classified and encoded based on feature type. For numerical features, Z-score standardization is used, and for categorical features, a combination of one-hot encoding and target encoding is used. By utilizing the context sequence analysis mechanism, the dependency relationship between preceding and subsequent behaviors is introduced into each behavior time segment, and context label features are constructed to generate a dataset of dynamic account behavior features. 3.The machine learning based account risk prediction method of claim 2, wherein, The process of multi-level nested feature extraction for the account dynamic behavior feature dataset is as follows: After inputting the feature dataset, a nested structure of short-term and long-term behaviors is constructed based on behavior time slices; Within the nested structure, local statistical feature extraction and trend change capture are performed separately to form nested feature representations at different time scales; A screening mechanism based on the change rate of feature entropy is introduced to filter out invalid features and retain a subset of features with high information density; Hierarchical combination of high-information-density feature subsets generates derived features.

4. The account risk prediction method based on machine learning according to claim 3, characterized in that, The process of constructing an account risk behavior evolution model using a fusion algorithm of temporal convolutional networks and attention mechanisms is as follows: The nested feature matrix is ​​input into a temporal convolutional network, and the local perception mechanism is used to extract short-term change patterns. After the temporal convolutional layer, a multi-head self-attention mechanism is introduced to model the long-term dependencies and abnormal jump patterns among account behaviors; Introducing residual connection structures enhances the nonlinear expressive power of the model; By combining behavioral type labels and timestamp information, an intermediate state sequence of risk evolution is generated, and the predicted value of risk change is output synchronously during the training process; During the training process, perturbation parameters are introduced to simulate the changes in model output under input perturbation, ultimately forming an account risk behavior evolution model.

5. The account risk prediction method based on machine learning according to claim 4, characterized in that, The process of outputting the final risk prediction result is as follows: The risk score, after correction for misjudgment boundaries, will be integrated with the account's historical behavior patterns, environmental tags, and device trust levels. The risk level mapping rules preset in the risk control knowledge base are invoked, and risk classification is determined by combining the scoring range. For accounts with risk levels in the critical range, a risk prediction result is output by combining time-period risk weights with cross-platform behavior comparison scores.

6. A machine learning-based account risk prediction system, applied to the method described in any one of claims 1-5, characterized in that, include: Data acquisition module: Acquires multi-source data such as transaction, login and terminal environment of target account, and constructs dynamic behavior feature dataset of account by combining high-dimensional feature encoding and context sequence analysis; Risk Evolution Module: Performs multi-layer feature extraction on account behavior data, models the evolution process of account risk behavior by fusing temporal convolutional networks and attention mechanisms, and introduces perturbation parameters to monitor model response shift; Trend Judgment Module: Determines whether the risk sensitivity is stable based on the trend of model response offset. If stable, it identifies key nodes in the behavioral evolution and uses the local anomaly factor mechanism to dynamically correct the behavioral sequence. Risk scoring module: It scores the potential risks of the modified behavioral sequence, generates a prediction matrix by combining a multi-stage decision network and counterfactual reasoning method, and corrects the boundary of misjudgment of the results. Results output module: Integrates risk control knowledge base and account risk scoring results, performs multi-dimensional fusion analysis, and outputs risk prediction results.

Images