Training method and device of risk detection system

Abstract

The embodiment of the invention discloses a training method and device of a risk detection system. The risk detection system comprises a dynamic graph representation model, a prompt generation module and a risk assessment model. The method comprises the steps that firstly, a dynamic graph representation model obtained through pre-training based on a transaction dynamic graph is obtained, the transaction dynamic graph comprises a plurality of transaction entity nodes and connection edges established due to the fact that the nodes have transaction behaviors, and the connection edges have transaction timestamp attributes; then, respectively taking a plurality of transaction entity nodes carrying the risk tags as target nodes, and generating node representations of the target nodes under a target timestamp based on the transaction dynamic graph by utilizing a dynamic graph representation model; then, determining a prompt vector of the target node by utilizing a prompt generation module; afterwards, the fusion representation between the node representation and the prompt vector is input into a risk assessment model to obtain a risk assessment result, and the risk assessment result is used for training the prompt generation module and the risk assessment model in combination with a corresponding risk label.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the field of data processing technology, and in particular, to the application of artificial intelligence in financial risk control and fraud detection. Background Art

[0002] With the rapid development of financial technology, the scale of financial transactions such as electronic payments and online lending continues to expand, and transaction scenarios are becoming increasingly complex. In this context, risk monitoring and anti-fraud technologies in financial transactions have become critical to ensuring the security of user assets and the stability of the financial system.

[0003] Traditional financial transaction risk monitoring methods primarily rely on the following technologies: monitoring based on rule engines, machine learning methods that rely on expert feature selection, etc. However, these traditional technologies are difficult to meet the higher requirements of practical applications.

[0004] Therefore, there is an urgent need for an improved technical solution that can effectively improve the prediction accuracy and real-time monitoring capabilities of risks of users and other trading entities, so as to adapt to the increasingly complex risk prevention and control needs in financial transaction scenarios. Summary of the Invention

[0005] The embodiments of this specification describe a training method and device for a risk detection system, which can better meet actual application needs.

[0006] According to a first aspect, a method for training a risk detection system is provided, the system comprising a dynamic graph representation model, a prompt generation module, and a risk assessment model. The method comprises:

[0007] The dynamic graph representation model obtained by pre-training based on the transaction dynamic graph is obtained, and the transaction dynamic graph includes multiple transaction entity nodes and transaction connection edges established due to transaction behaviors between the transaction entity nodes, and the transaction connection edges have transaction timestamp attributes. Several transaction entity nodes carrying risk labels are respectively used as target nodes, and node representations are generated based on the transaction dynamic graph using the dynamic graph representation model to obtain the target node representation of the target node under the target timestamp corresponding to the target risk label. The target prompt vector of the target node is determined using the prompt generation module. The fusion representation between the target node representation and the target prompt vector is input into the risk assessment model to obtain a target risk assessment result, which is used to train the prompt generation module and the risk assessment model in combination with the target risk label.

[0008] In one embodiment, the transaction entity node is associated with a set of transaction entity attributes; the transaction connection edge is associated with a set of transaction behavior attributes, including the transaction timestamp attribute.

[0009] In one embodiment, the pre-training includes the following steps: obtaining multiple pre-training samples, wherein any pre-training sample includes a pair of transaction entity nodes and a corresponding behavior label, wherein the behavior label indicates whether a transaction occurred between the pair of nodes at a specified timestamp. For each of the pre-training samples, a dynamic graph representation model is used to generate node representations based on the transaction dynamic graph, thereby obtaining node representations for each of the pair of transaction entity nodes at the specified timestamp. The dynamic graph representation model is then trained based on the similarity between the obtained pair of node representations and the behavior label.

[0010] In one embodiment, the prompt generation module includes multiple first prompt vectors corresponding to multiple transaction entity nodes; wherein, using the prompt generation module to determine the target prompt vector of the target node includes: determining the first prompt vector corresponding to the target node as the target prompt vector.

[0011] In one embodiment, the prompt generation module includes multiple first prompt vectors corresponding to multiple transaction entity nodes and a time encoder. Determining a target prompt vector for a target node using the prompt generation module includes: determining the first prompt vector corresponding to the target node; processing the time difference between the target timestamp and the first timestamp using the time encoder to generate a time encoding vector; the first timestamp being the timestamp of the last transaction activity performed by the target node before the target timestamp; fusing the first prompt vector and the time encoding vector to determine the fused result as the target prompt vector.

[0012] In one embodiment, determining a target hint vector for the target node using the hint generation module includes: determining, from the transaction dynamic graph, K neighboring nodes corresponding to the K most recent transactions with the target node. For each of these neighboring nodes, constructing a corresponding neighbor word-gram, each of which includes one or more of the following: a node representation of the neighboring node, a position code for the neighboring node, a transaction amount code, and a transaction time code. The Transformer model included in the hint generation module processes the word-gram sequence formed by the K neighbor word-grams to obtain the target hint vector.

[0013] Furthermore, in a specific embodiment, the neighbor word element includes the position code, and its determination includes: sorting the K neighbor nodes according to the order in which the K transaction behaviors occurred, and encoding the obtained serial numbers as the corresponding position codes.

[0014] In another specific embodiment, the neighbor word includes a transaction amount code, and determining the transaction amount includes: encoding the transaction amount using an amount encoder included in the prompt generation module to obtain the transaction amount code; and / or,

[0015] In another specific embodiment, the neighbor word includes a transaction time code, and its determination includes: determining the time difference between the target timestamp and the transaction timestamp, encoding the time difference using a time encoder included in the prompt generation module, and obtaining the transaction time code.

[0016] In one embodiment, the target prompt vector of the target node is determined using the prompt generation module, including: determining the K most recent transaction behaviors with the target node from the transaction dynamic graph; determining K indicator values of the K transaction behaviors under predetermined business indicators to form a business indicator sequence; and determining the target prompt vector based on the business indicator sequence.

[0017] Furthermore, in a specific embodiment, the business indicators include time intervals and transaction amounts, and the time interval is the time difference between the target timestamp and the transaction time; wherein, based on the business indicator sequence, the target prompt vector is determined, including: using the timing model contained in the prompt generation module to process the time interval sequence to obtain a time pattern code; performing maximum pooling and average pooling on the transaction amount sequence to obtain pooling results, and using the amount encoder contained in the prompt generation module to process the pooling results to obtain a transaction intensity pattern code; performing a fusion process on the time pattern code and the transaction intensity pattern code, thereby determining the fusion result as the target prompt vector.

[0018] In one embodiment, determining a target hint vector for the target node using the hint generation module includes: determining a plurality of second hint vectors corresponding to the target node; processing the plurality of second hint vectors using a gating network in the hint generation module to obtain a weight for each second hint vector; and performing weighted processing on the plurality of second hint vectors using the weights to obtain the target hint vector.

[0019] In one embodiment, the fusion result between the target node representation and the target prompt vector is input into the risk assessment model, including: fusing the target node representation and the target prompt vector to obtain the fusion result; wherein the fusion processing includes splicing, addition or positional multiplication; and inputting the fusion result into the risk assessment model.

[0020] In one embodiment, after obtaining the target risk assessment result, the method further includes: fixing the model parameters of the dynamic graph representation model, and using the risk assessment result and the target risk label to adjust the model parameters of the prompt generation module and the risk assessment model; or, using the risk assessment result and the target risk label to adjust the model parameters of the dynamic graph representation model, the prompt generation module and the risk assessment model.

[0021] According to a second aspect, a training device for a risk detection system is provided, the system comprising a dynamic graph representation model, a prompt generation module, and a risk assessment model. The device comprises:

[0022] The representation model acquisition unit is configured to obtain the dynamic graph representation model obtained by pre-training based on the transaction dynamic graph, wherein the transaction dynamic graph includes multiple transaction entity nodes and transaction connection edges established due to transaction behaviors between the transaction entity nodes, and the transaction connection edges have transaction timestamp attributes. The node representation generation unit is configured to use several transaction entity nodes carrying risk labels as target nodes, generate node representations based on the transaction dynamic graph using the dynamic graph representation model, and obtain the target node representation of the target node at the target timestamp corresponding to the target risk label. The prompt vector generation unit is configured to use the prompt generation module to determine the target prompt vector of the target node. The risk assessment unit is configured to input the fusion representation between the target node representation and the target prompt vector into the risk assessment model to obtain a target risk assessment result, which is used to train the prompt generation module and the risk assessment model in combination with the target risk label.

[0023] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method provided in the first aspect.

[0024] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0025] In summary, the above-mentioned method and device disclosed in the embodiments of this specification are first used to use the dynamic graph representation model pre-trained based on the transaction dynamic graph to generate a node representation that integrates the topological relationship between entities and the timing information of transaction behavior. Then, the idea of incorporating prompt vectors into the node representation is adopted to fully utilize the small amount of labeled data in the financial risk control scenario, thereby significantly improving the training effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0027] Figure 1 Schematic diagram of the implementation architecture for training a risk assessment model based solely on a pre-trained dynamic graph representation model;

[0028] Figure 2 This is a diagram illustrating an implementation architecture of a training solution for a risk detection system disclosed in an embodiment of this specification;

[0029] Figure 3 A schematic diagram of the process steps of the risk detection system training method disclosed in the embodiments of this specification;

[0030] Figure 4 This is a schematic diagram of the functional unit structure of the training device of the risk detection system disclosed in the embodiments of this specification. DETAILED DESCRIPTION

[0031] Next, the solution provided in this specification is described with reference to the accompanying drawings.

[0032] As mentioned previously, traditional financial transaction risk monitoring methods rely on expert rule construction and expert feature selection. These methods require extensive manual intervention, making it difficult to capture complex trading patterns and obtain information gain from dynamic trading topological relationships. While time series analysis can predict user trading behavior, it cannot fully simulate the mutual influence between users. To more comprehensively understand financial transaction behavior and its complex interrelationships, graph modeling has become an effective approach, effectively capturing the associations and topological relationships between entities.

[0033] One approach proposes first using graph data to construct a static transaction graph. For example, using transaction entities (such as users and merchants) as nodes, edges are established between nodes with historical transactions, and graph neural networks are used to learn node representations. Sequential analysis models, such as recurrent neural networks, are then used to model the dynamic nature of transaction entities over time. However, this approach completely separates the relationships between transaction entities from their dynamic nature, resulting in poor overall model performance. Furthermore, this approach's representation of time is limited to the order of the sequence and is unable to model the precise timing within transaction behavior data.

[0034] Later, a method was proposed to first integrate time data into the edge information to construct a behavior dynamic graph that can accurately express the time when the behavior occurred. Each node represents an entity, and each edge represents a transaction between entities. The edges have specific time information. For this, please refer to Figure 1 The transaction dynamic graph shown in , where the connecting edges have timestamp attributes, such as t1, t2, etc.

[0035] Continue to see Figure 1 For the constructed transaction dynamic graph, the dynamic graph representation model can be used to learn its node representation. Then, for the downstream risk assessment task, the transaction entity node representation learned by the dynamic graph representation model is used as the input of the risk assessment model, and the risk assessment results and corresponding risk labels are used to train the risk assessment model.

[0036] However, the amount of labeled data corresponding to downstream tasks, especially abnormal samples with risks, is particularly scarce. Figure 1 Improvements can be made to better improve the accuracy of risk identification by utilizing a small amount of labeled data.

[0037] Figure 2 This is a diagram of the implementation architecture of the training solution for the risk detection system disclosed in the embodiments of this specification. Figure 1 In addition to the dynamic graph representation model and risk assessment model, the risk detection system also incorporates a prompt generation module. This module generates prompt vectors for transaction entity nodes. The input to the risk assessment model then becomes a fused representation of the transaction entity node representation and the prompt vector. As can be seen, the prompt vector helps learn more entity information. Consequently, the fused representation contains richer entity information, effectively improving the accuracy of risk assessment results.

[0038] Next, we introduce Figure 2 The specific method process for training the architecture.

[0039] Figure 3 This is a flow chart of the steps of the training method for the user risk detection system disclosed in the embodiment of this specification. The execution subject of this method can be any device, platform, server or equipment cluster with computing and processing capabilities. Figure 3 As shown, the training method includes the following process steps:

[0040] Step S310: obtaining a dynamic graph representation model pre-trained based on a transaction dynamic graph, wherein the transaction dynamic graph includes a plurality of transaction entity nodes and transaction connection edges established between the transaction entity nodes due to transaction behaviors, wherein the transaction connection edges have a transaction timestamp attribute.

[0041] The transaction entity nodes in the above transaction dynamic graph can be user nodes or merchant nodes. The set formed by multiple transaction entity nodes can be recorded as The set of transaction connection edges can be recorded as where e ij (t) represents the behavioral event that occurs between nodes i and j at time t∈[0,T]. Furthermore, the connecting edge can be directed or undirected. In the case of a directed edge, it generally points from the transaction initiator to the transaction recipient.

[0042] Transaction entity nodes and transaction connection edges are often each associated with a set of attributes. For transaction entity nodes, the associated set of attributes may include: entity type (such as user / merchant), registration time, geographic location, credit score, historical transaction frequency, account balance (changing over time), etc. For transaction connection edges, the associated set of attributes may include: transaction amount, timestamp, transaction type (transfer, consumption, top-up, etc.), payment method (credit card, digital currency, etc.), transaction success, product / service category, etc.

[0043] The transaction dynamic graph can be either a discrete dynamic graph or a continuous dynamic graph. A discrete dynamic graph is divided into multiple static graph snapshots at fixed time intervals (e.g., days / hours). A continuous dynamic graph is continuous in time, with each edge having a precise timestamp, and the graph structure constantly changes over time. Given that continuous dynamic graphs are suitable for real-time response scenarios, which is consistent with risk control scenarios, the transaction dynamic graph mentioned in this step is preferably constructed as a continuous dynamic graph.

[0044] The transaction dynamics graph can be constructed based on the collected historical transaction behavior data. Since the construction process is not the focus of this solution, it will not be described here.

[0045] The above dynamic graph representation model is pre-trained based on the constructed transaction dynamic graph. It should be understood that the dynamic graph representation model can be implemented as Temporal Graph Networks (TGN), Temporal Graph Attention Networks (TGAT), and so on.

[0046] The pre-training task can be an edge prediction task, which is implemented using self-supervised learning. For example, the pre-training can include the following steps:

[0047] 1) Obtain multiple pre-training samples, where any pre-training sample includes a pair of transaction entity nodes and a corresponding behavior label, where the behavior label indicates whether a transaction occurred between the pair of nodes at a specified timestamp. It is understood that the transaction entity nodes included in the sample are actually node IDs.

[0048] 2) For any of the pre-trained samples, a dynamic graph representation model is used to generate node representations based on the transaction dynamic graph to obtain node representations of each of the pair of transaction entity nodes at the specified timestamp.

[0049] It should be understood that after inputting the node ID and specified timestamp of any target node into the dynamic graph representation model, the dynamic graph representation model can query from the transaction dynamic graph a number ("a number" in this article refers to one or more) of connected edges connected to the target node whose timestamps are before the specified timestamp, thereby aggregating the node features of the target node, the edge attributes of the queried several connected edges, and the node features of the several neighboring nodes corresponding to the several connected edges, thereby generating a node representation of the target node. For more specific implementation details, please refer to existing related technologies and will not be expanded here.

[0050] Based on the above, a pair of node representations corresponding to a pair of transaction entity nodes in any pre-training sample can be obtained.

[0051] 3) Based on the obtained similarity and behavior labels between a pair of node representations, the dynamic graph representation model is trained.

[0052] It can be understood that the higher the similarity between a pair of node representations, the higher the tendency of transaction behavior to occur. Therefore, the similarity can be used to represent the probability of transaction behavior occurring.

[0053] Specifically, the training loss can be determined based on the similarity and the corresponding behavior label, and then the training loss is used to train the dynamic graph representation model using the back propagation method, that is, to adjust and update the model parameters in the dynamic graph representation model.

[0054] The above describes the process of pre-training the dynamic graph representation model based on the transaction dynamic graph.

[0055] In this step, a transaction dynamic graph may be constructed first, and then the dynamic graph representation model may be pre-trained to obtain a pre-trained dynamic graph representation model. Alternatively, the pre-trained dynamic graph representation model may be directly obtained.

[0056] In step S320, several transaction entity nodes carrying risk labels are respectively used as target nodes, and node representations are generated based on the transaction dynamic graph using the dynamic graph representation model to obtain target node representations of the target nodes at target timestamps corresponding to target risk labels.

[0057] It should be noted that the downstream task is risk detection, which can be further refined into user risk monitoring in some scenarios. At this time, the risk label is the user risk label, and the several transaction entity nodes are the several user nodes; there are usually multiple transaction entity nodes carrying risk labels, or the labeled data involved; in addition, for the generation of node representation, please refer to the relevant description in the aforementioned embodiment and will not be elaborated on.

[0058] By executing this step, a target node representation of the target node may be obtained, that is, a node representation of any node among the multiple transaction entity nodes.

[0059] Step S330: Determine a target hint vector of the target node using a hint generation module.

[0060] There are many ways to design the prompt generation module, which are exemplarily introduced below.

[0061] In Design A, the prompt generation module includes multiple first prompt vectors corresponding to multiple transaction entity nodes. In other words, each transaction entity node in the transaction dynamic graph has a corresponding first prompt vector. It should be understood that the "first" in "first prompt vector," as well as similar terms such as "second" elsewhere in this document, are intended to distinguish between similar entities and do not have any other limiting meaning, such as ranking.

[0062] Therefore, in this step, the first hint vector corresponding to the target node can be directly determined as the target hint vector. It should be understood that the vector elements in the multiple first hint vectors are parameters that need to be adjusted and updated during the training process.

[0063] However, considering that design method A does not incorporate time information, another design method B is proposed.

[0064] In design approach B, the prompt generation module includes not only a plurality of first prompt vectors corresponding to a plurality of transaction entity nodes, but also a time encoder.

[0065] Therefore, in this step, first, the first prompt vector corresponding to the target node is determined, and the time difference between the target timestamp and the first timestamp is processed using a time encoder to obtain a time coding vector; wherein the first timestamp is the timestamp of the last transaction behavior of the target node before the target timestamp.

[0066] Furthermore, the first prompt vector and the temporal encoding vector corresponding to the target node are fused, so that the fusion result is determined as the target prompt vector.

[0067] It should be noted that there are various ways to perform the fusion process, such as concatenation, addition, and averaging. Alternatively, a multi-layer perceptron (MLP) can be introduced to process the concatenation result between the first cue vector and the temporal encoding vector, with the output vector being used as the target cue vector. It is understood that when an MLP is introduced, its model parameters are also classified as learnable parameters, or trainable parameters, in the cue generation module.

[0068] In design method C, it is proposed to introduce a spatiotemporal attention mechanism to realize the generation of prompt vectors. For the target node, its recent transaction behavior will provide more valuable information. The design uses this information to generate relevant dynamic prompts.

[0069] Specifically, first, from the transaction dynamic graph, determine the K neighbor nodes corresponding to the K most recent transaction behaviors with the target node, where the specific value of K can be set as needed, such as 5 or 10.

[0070] Next, for each neighbor node, construct its corresponding neighbor word, for example:

[0071]

[0072] Among them, t u Represents the neighbor word of the neighbor node u of the target node v; z v and z u They represent the node representations of the target node v and the neighbor node u respectively; p u represents the position code of neighbor node u; e uv Represents historical interaction behavior (u,v,t uv ) attribute characteristics, where t uv Indicates the interaction timestamp; a uv represents the transaction amount, f ω1 () represents the transaction amount encoder in the prompt generation module; t represents the target timestamp corresponding to the target risk label, f ω2 () represents the temporal encoder in the prompt generation module; || represents the vector concatenation operation.

[0073] Furthermore, the position code p u The determination may include: sorting the K neighbor nodes according to the order in which the K transactions occurred, encoding the obtained sequence numbers as the corresponding position codes p u For example, the serial number may be encoded using a sine-cosine function, or a position encoder may be introduced for encoding.

[0074] Need to understand, neighbor word t uIt is not necessary to include all the information items in the right-hand expression in (1), and only a part of them can be included, for example, t u =z u ||p u ||e uv , or, other information items may also be included.

[0075] From the above, we can get the K neighbor word units corresponding to the K neighbor nodes to form a word unit sequence.

[0076] Afterwards, the Transformer model included in the prompt generation module can be used to process the word sequence to obtain the output target prompt vector.

[0077] In this design approach, the prompt generation module with the spatiotemporal attention mechanism is introduced to capture temporal change information and historical information and neighbor information close to the target to be predicted, and its parameter count is also lightweight.

[0078] Design D proposes a business indicator model based on the target node's recent transaction behavior, thereby generating a highly usable prompt vector. Specifically, the K most recent transactions with the target node are first determined from the transaction dynamic graph. K indicator values for these K transactions under predetermined business indicators are then determined to form a business indicator sequence. The target prompt vector is then determined based on this business indicator sequence.

[0079] To facilitate understanding, the following explanation is given using business indicators including time intervals and transaction amounts as examples.

[0080] For the latest K transactions of target node u, calculate the time interval sequence Δt and extract the transaction amount sequence A:

[0081]

[0082] By processing the business indicator sequence through a lightweight time series model and amount encoder, we can obtain the time pattern code h that can capture periodicity and burstiness. t and trading intensity pattern encoding h a For example:

[0083] h t =LSTM(Δt) (4)

[0084] h a =MLP(AvgPool(A)||MaxPool(A)) (5)

[0085] LSTM is the abbreviation of Long Short-Term Memory, which is an implementation example of the time series model; MLP represents a multi-layer perceptron, AvgPool represents average pooling processing, MaxPool represents maximum pooling processing, and || represents a vector concatenation operation.

[0086] Furthermore, the temporal pattern can be encoded as h t and trading intensity pattern encoding h a Perform fusion processing to determine the fusion result as the target prompt vector p v .like:

[0087] p v =MLP(h t ||h a ) (6)

[0088] As shown above, the target prompt vector generated based on design method D incorporates the business model information of the target node's recent transaction behavior.

[0089] It should be noted that the above-described design methods A, B, C, and D can be used individually or in combination. When used in combination, the hint vectors determined by each design method can be fused and then used as the final target hint vector. The following is an example of the combination use.

[0090] The prompt vectors generated under design methods B, C and D (that is, the target prompt vector generated when using only one design method) are respectively recorded as It is also proposed to use a gating network (a neural network that introduces a gating mechanism) to dynamically generate the weights [α, β, γ] of each of the three prompt vectors. For example, the weights can be generated using the following formula:

[0091]

[0092] Among them, softmax is a normalization function, W g and b g Represent the linear transformation matrix and bias vector in the gating network respectively.

[0093] Furthermore, dynamic weights [α, β, γ] can be used to Perform weighted processing to obtain the final target prompt vector p v , which can be written as:

[0094]

[0095] The above introduces the design of the prompt generation module and how to generate the target prompt vector under the corresponding design.

[0096] Step S340: Input the fusion result between the target node representation and the target prompt vector into the risk assessment model to obtain a target risk assessment result, which is used to train the prompt generation module and the risk assessment model in combination with the target risk label.

[0097] Specifically, the target node representation and the target prompt vector are first fused to obtain the fusion result (or fusion representation), wherein the fusion processing includes splicing, addition or bitwise multiplication, or the splicing vector of the two is processed using MLP; then, the fusion result is input into the risk assessment model.

[0098] It should be noted that after obtaining the target risk assessment result, the training method may further include: determining the training loss based on the target risk assessment result and the target risk label, and using the backpropagation method to train the prompt generation module and risk assessment model in the risk detection system based on the training loss.

[0099] Furthermore, in one parameter adjustment method, the model parameters of the dynamic image representation model are fixed, and only the prompt generation module and risk assessment model are adjusted. In another parameter adjustment method, the pre-trained dynamic image representation model is also fine-tuned.

[0100] Based on the above, the risk detection system can be trained, and the trained risk detection system can be used for risk detection of trading entities.

[0101] In summary, the risk detection system training method disclosed in the embodiments of this specification first utilizes a pre-trained dynamic graph representation model based on a dynamic transaction graph to generate node representations that incorporate topological relationships between entities and temporal information about transaction behaviors. Furthermore, by incorporating hint vectors into the node representations, the method fully utilizes the small amount of annotated data in financial risk control scenarios, significantly improving training effectiveness. Using this trained risk monitoring system, the system can accurately and real-timely identify abnormal transaction entities, such as risky users.

[0102] Experiments demonstrate that: 1) Compared to traditional methods, training with only 30% of the labeled data required can achieve accuracy exceeding that of traditional methods. 2) Using the same amount of training data, the area under the receiver operating characteristic (ROC) curve for risk control tasks can be increased by 16% compared to traditional methods.

[0103] Corresponding to the training method disclosed in the embodiment of this specification, the embodiment of this specification also discloses a training device for a risk detection system, which includes Figure 2 The H dynamic graph representation model, prompt generation module and risk assessment model are shown in Figure 2. Figure 4 , wherein the training device 400 includes the following functional units:

[0104] The representation model acquisition unit 410 is configured to obtain the dynamic graph representation model obtained by pre-training based on the transaction dynamic graph, wherein the transaction dynamic graph includes multiple transaction entity nodes and transaction connection edges established due to transaction behaviors between the transaction entity nodes, and the transaction connection edges have transaction timestamp attributes. The node representation generation unit 420 is configured to use several transaction entity nodes carrying risk labels as target nodes, generate node representations based on the transaction dynamic graph using the dynamic graph representation model, and obtain the target node representation of the target node at the target timestamp corresponding to the target risk label. The prompt vector generation unit 430 is configured to use the prompt generation module to determine the target prompt vector of the target node. The risk assessment unit 440 is configured to input the fusion representation between the target node representation and the target prompt vector into the risk assessment model to obtain a target risk assessment result, which is used to train the prompt generation module and the risk assessment model in combination with the target risk label.

[0105] In a possible design, the transaction entity node is associated with a set of transaction entity attributes; the transaction connection edge is associated with a set of transaction behavior attributes, including the transaction timestamp attribute.

[0106] In one possible design, the pre-training includes the following steps: obtaining multiple pre-training samples, wherein any pre-training sample includes a pair of transaction entity nodes and a corresponding behavior label, and the behavior label indicates whether a transaction behavior occurs for the pair of nodes at a specified timestamp; for the arbitrary pre-training sample, using a dynamic graph representation model to generate a node representation based on the transaction dynamic graph, to obtain a node representation of each of the pair of transaction entity nodes at the specified timestamp; based on the similarity between the obtained pair of node representations and the behavior label, training the dynamic graph representation model.

[0107] In one possible design, the prompt generation module includes multiple first prompt vectors corresponding to multiple transaction entity nodes; wherein the prompt vector generation unit 430 is specifically configured to: determine the first prompt vector corresponding to the target node as the target prompt vector.

[0108] In one possible design, the prompt generation module includes multiple first prompt vectors corresponding to multiple transaction entity nodes and a time encoder. The prompt vector generation unit 430 is specifically configured to: determine a first prompt vector corresponding to the target node; use the time encoder to process the time difference between the target timestamp and the first timestamp to obtain a time encoding vector; the first timestamp is the timestamp of the last transaction activity of the target node before the target timestamp; then fuse the first prompt vector and the time encoding vector to determine the fused result as the target prompt vector.

[0109] In one possible design, the prompt vector generation unit 430 is specifically configured as follows: from the transaction dynamic graph, determine the K neighbor nodes corresponding to the K most recent transaction behaviors between the target node; for each neighbor node, construct its corresponding neighbor word, and the neighbor word includes one or more of the following: the node representation of the neighbor node, the position code of the neighbor node, the transaction amount code, and the transaction time code; use the Transformer model included in the prompt generation module to process the word sequence formed by the K neighbor word elements to obtain the target prompt vector.

[0110] Furthermore, in a specific design, the prompt vector generating unit 430 is further configured to: sort the K neighbor nodes according to the order in which the K transaction behaviors occurred, and encode the obtained sequence numbers as corresponding position codes.

[0111] In another specific design, the prompt vector generation unit 430 is further configured to: use the amount encoder included in the prompt generation module to encode the transaction amount to obtain the transaction amount code.

[0112] In another specific design, the hint vector generation unit 430 is further configured to: determine a time difference between the target timestamp and the transaction timestamp, and encode the time difference using a time encoder included in the hint generation module to obtain the transaction time code.

[0113] In one possible design, the prompt vector generation unit 430 is specifically configured to: determine the K most recent transaction behaviors with the target node from the transaction dynamic graph; determine K indicator values of the K transaction behaviors under predetermined business indicators to form a business indicator sequence; and determine the target prompt vector based on the business indicator sequence.

[0114] Furthermore, in a specific design, the business indicator includes a time interval and a transaction amount, where the time interval is the time difference between the target timestamp and the transaction time. The prompt vector generation unit 430 is configured to determine the target prompt vector based on the business indicator sequence, specifically including:

[0115] The time interval sequence is processed using the timing model included in the prompt generation module to obtain the time pattern code; the transaction amount sequence is subjected to maximum pooling processing and average pooling processing respectively to obtain pooling results, and the pooling results are processed using the amount encoder included in the prompt generation module to obtain the transaction intensity pattern code; the time pattern code and the transaction intensity pattern code are fused, so as to determine the fusion result as the target prompt vector.

[0116] In one possible design, the hint vector generation unit 430 is specifically configured to: determine multiple second hint vectors corresponding to the target node; use the gating network in the hint generation module to process the multiple second hint vectors to obtain the weight of each second hint vector; and use the weights to weight the multiple second hint vectors to obtain the target hint vector.

[0117] In one possible design, the risk assessment unit 440 is specifically configured to: perform a fusion process on the target node representation and the target prompt vector to obtain the fusion result, wherein the fusion process includes splicing, addition or positional multiplication; and input the fusion result into the risk assessment model.

[0118] In one possible design, the training device 400 also includes a training unit configured to: fix the model parameters of the dynamic graphic representation model, and use the risk assessment results and target risk labels to adjust the model parameters of the prompt generation module and the risk assessment model; or, use the risk assessment results and target risk labels to adjust the model parameters of the dynamic graphic representation model, the prompt generation module and the risk assessment model.

[0119] It should be noted that for the introduction of the above functional units, reference can also be made to the relevant introduction of the process method in the aforementioned embodiment.

[0120] According to another embodiment, there is also provided a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Figure 3 The method described.

[0121] According to another embodiment, a computing device is provided, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, Figure 3 The method described.

[0122] Those skilled in the art will appreciate that, in one or more of the above examples, the functions described herein may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0123] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A training method for a risk detection system, the system comprising a dynamic graph representation model, a prompt generation module, and a risk assessment model; the method comprising: Obtaining the dynamic graph representation model obtained by pre-training based on a transaction dynamic graph, wherein the transaction dynamic graph includes a plurality of transaction entity nodes and transaction connection edges established between the transaction entity nodes due to transaction behaviors, wherein the transaction connection edges have a transaction timestamp attribute; Several transaction entity nodes carrying risk labels are respectively used as target nodes, and node representations are generated based on the transaction dynamic graph using the dynamic graph representation model to obtain target node representations of the target nodes at target timestamps corresponding to target risk labels; Determining a target hint vector for the target node using the hint generation module; The fusion representation between the target node representation and the target prompt vector is input into the risk assessment model to obtain a target risk assessment result, which is used to train the prompt generation module and the risk assessment model in combination with the target risk label.

2. The method according to claim 1, wherein The transaction entity node is associated with a set of transaction entity attributes; the transaction connection edge is associated with a set of transaction behavior attributes, including the transaction timestamp attribute.

3. The method according to claim 1, wherein The pre-training includes the following steps: Obtain multiple pre-training samples, where any pre-training sample includes a pair of transaction entity nodes and a corresponding behavior label, where the behavior label indicates whether a transaction behavior occurs between the pair of nodes at a specified timestamp; For any of the pre-trained samples, generating node representations based on the transaction dynamic graph using a dynamic graph representation model to obtain node representations of each of the pair of transaction entity nodes at the specified timestamp; The dynamic graph representation model is trained based on the obtained similarity between a pair of node representations and the behavior label.

4. The method according to claim 1, wherein The prompt generation module includes a plurality of first prompt vectors corresponding to a plurality of transaction entity nodes; wherein determining a target prompt vector of the target node by using the prompt generation module includes: A first hint vector corresponding to the target node is determined as the target hint vector.

5. The method according to claim 1, wherein The prompt generation module includes a plurality of first prompt vectors corresponding to a plurality of transaction entity nodes, and a time encoder; wherein, determining the target prompt vector of the target node by using the prompt generation module includes: Determining a first prompt vector corresponding to the target node; Using the time encoder to process the time difference between the target timestamp and the first timestamp to obtain a time code vector; the first timestamp is the timestamp of the last transaction behavior of the target node before the target timestamp; The first prompt vector and the temporal encoding vector are fused, so as to determine a fusion result as the target prompt vector.

6. The method according to claim 1, wherein Determining a target hint vector of the target node using the hint generation module includes: Determine, from the transaction dynamic graph, K neighbor nodes corresponding to the most recent K transactions between the target node and the target node; For each neighbor node, construct a corresponding neighbor word element, where the neighbor word element includes one or more of the following: a node representation of the neighbor node, a position code of the neighbor node, a transaction amount code, and a transaction time code; The Transformer model included in the prompt generation module is used to process the word-gram sequence formed by K neighbor word-grams to obtain the target prompt vector.

7. The method according to claim 6, wherein: The neighbor word element includes the position code, and determining the position code includes: sorting the K neighbor nodes according to the order in which the K transaction behaviors occurred, encoding the obtained sequence numbers as the corresponding position codes; and / or, The neighbor word includes a transaction amount code, and the determination includes: encoding the transaction amount using an amount encoder included in the prompt generation module to obtain the transaction amount code; and / or, The neighbor word includes a transaction time code, and the determination thereof includes: determining a time difference between the target timestamp and the transaction timestamp, and encoding the time difference using a time encoder included in the prompt generation module to obtain the transaction time code.

8. The method according to claim 1, wherein Determining a target hint vector of the target node using the hint generation module includes: Determine the most recent K transactions with the target node from the transaction dynamic graph; Determine K indicator values of the K transaction behaviors under predetermined business indicators to form a business indicator sequence; Based on the business indicator sequence, the target prompt vector is determined.

9. The method according to claim 8, wherein The business indicator includes a time interval and a transaction amount, wherein the time interval is the time difference between the target timestamp and the transaction time; wherein, based on the business indicator sequence, determining the target prompt vector includes: Processing the time interval sequence using the temporal model included in the prompt generation module to obtain a temporal pattern code; Performing maximum pooling and average pooling on the transaction amount sequence to obtain pooling results, and processing the pooling results using the amount encoder included in the prompt generation module to obtain a transaction intensity pattern code; The time pattern code and the transaction intensity pattern code are fused, so as to determine the fusion result as the target prompt vector.

10. The method according to claim 1, wherein Determining a target hint vector of the target node using the hint generation module includes: Determining a plurality of second prompt vectors corresponding to the target node; Processing the plurality of second prompt vectors using a gating network in the prompt generation module to obtain a weight of each second prompt vector; The plurality of second prompt vectors are weighted by using the weights to obtain the target prompt vector.

11. The method according to claim 1, wherein Inputting the fusion result between the target node representation and the target prompt vector into the risk assessment model includes: Performing a fusion process on the target node representation and the target prompt vector to obtain the fusion result; wherein the fusion process includes concatenation, addition or positional multiplication; The fusion result is input into the risk assessment model.

12. The method according to claim 1, wherein After obtaining the target risk assessment result, the method further includes: Fix the model parameters of the dynamic graph representation model, and use the risk assessment results and target risk labels to adjust the model parameters of the prompt generation module and the risk assessment model; or, The risk assessment results and target risk labels are used to adjust model parameters of the dynamic graph representation model, the prompt generation module, and the risk assessment model.

13. A training device for a risk detection system, the system comprising a dynamic graph representation model, a prompt generation module, and a risk assessment model; the device comprising: a representation model acquisition unit configured to acquire the dynamic graph representation model obtained by pre-training based on a transaction dynamic graph, wherein the transaction dynamic graph includes a plurality of transaction entity nodes and transaction connection edges established due to transaction behaviors between the transaction entity nodes, wherein the transaction connection edges have a transaction timestamp attribute; a node representation generating unit configured to respectively use a plurality of transaction entity nodes carrying risk labels as target nodes, generate node representations based on the transaction dynamic graph using the dynamic graph representation model, and obtain target node representations of the target nodes at target timestamps corresponding to target risk labels; a hint vector generating unit configured to determine a target hint vector for a target node using the hint generating module; The risk assessment unit is configured to input the fusion representation between the target node representation and the target prompt vector into the risk assessment model to obtain a target risk assessment result for training the prompt generation module and the risk assessment model in combination with the target risk label.

14. A computer-readable storage medium having a computer program stored thereon, wherein: When the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 12.

15. A computing device comprising a memory and a processor, wherein: The memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 12 is implemented.

Images