Enterprise-level fraud automatic identification platform and method based on artificial intelligence

Abstract

The present invention discloses an enterprise-level fraud automatic identification platform and method based on artificial intelligence, which relates to the technical field of enterprise fraud data processing. The enterprise-level fraud automatic identification platform and method based on artificial intelligence include the following steps: S1, obtaining enterprise fraud data and preprocessing the enterprise fraud data; S2, constructing a role behavior graph, evaluating the risk connection closeness between behavior entities, updating the role behavior graph based on the evaluation results and constructing a potential fraud edge set; S3, identifying the path to which each potential fraud edge belongs, analyzing the causal contribution of behavior and capital variables to path risk, marking the path causal field nodes and defining the path causal evidence chain; S4, quantifying the explanatory strength of each field in the path causal structure, identifying the dominant responsibility field, constructing a responsibility chain and outputting a structured attribution result. This solves the problem in the prior art that fraud identification results are unexplainable and lack evidence chain and responsibility tracing.

Description

Technical Field

[0001] The present invention relates to the technical field of enterprise fraud data processing, and specifically to an enterprise-level fraud automatic identification platform and method based on artificial intelligence. Background Art

[0002] As businesses continue to digitize, internal fraud is becoming increasingly subtle, exhibiting complex, chain-like characteristics that span systems, roles, and time periods. Fraud often lurks in heterogeneous data from multiple sources, such as financial transactions, ERP logs, employee logins, approval records, and equipment usage history, creating a complex mix of data with varying structures, dimensions, and time sequences.

[0003] For example, the application with publication number CN119338476A provides a procurement anomaly monitoring and fraud warning method and system based on behavioral analysis, including: obtaining the position and authority information of procurement personnel, establishing respective behavioral pattern baselines for personnel in different positions, and identifying each person's procurement pattern characteristics; real-time monitoring of procurement personnel's procurement behavior, combining personal procurement pattern characteristics and behavioral pattern baselines, and comparing them with personal historical procurement patterns and the general procurement patterns of the team. If anomalies that are obviously deviated from the baseline or team pattern are found, they will be marked as suspected abnormal procurement behavior; extracting key attributes of suspected fraudulent orders, and analyzing whether there are related orders from the same supplier that appear multiple times in a similar period of time.

[0004] However, existing methods lack quantitative modeling of the causal strength and responsibility contribution between nodes and paths in the behavior chain, and are unable to explain the causes and evolution logic of risky behaviors; detection results are mostly isolated alarms, lacking traceability basis such as complete behavior paths, responsibility chains, field contributions, etc., making it difficult to support subsequent audits, accountability, or evidence consolidation; the reasoning process is black-boxed, making it difficult to generate a clear responsibility positioning structure.

[0005] Therefore, to address the above issues, there is an urgent need for an enterprise-level fraud automatic identification platform and method based on artificial intelligence. Summary of the Invention

[0006] Technical problems solved

[0007] In response to the shortcomings of the existing technology, the present invention provides an enterprise-level fraud automatic identification platform and method based on artificial intelligence, which solves the problems in the existing technology that fraud identification results are unexplainable and lack evidence chain and responsibility traceability.

[0008] Technical Solution

[0009] To achieve the above objectives, the present invention is implemented through the following technical solutions: an artificial intelligence-based enterprise-level fraud automatic identification method, comprising the following steps: S1, real-time collection of multi-source data, obtaining enterprise fraud data from the multi-source data, and preprocessing the enterprise fraud data to obtain preprocessed enterprise fraud data; S2, constructing a role behavior graph based on the preprocessed enterprise fraud data, evaluating the risk connection closeness between role behaviors, updating the role behavior graph based on the evaluation results, and determining a potential fraud edge set in the updated role behavior graph; S3, identifying the path to which each potential fraud edge in the fraud edge set belongs, analyzing the causal contribution of role behavior and capital variables to path risk, and marking the path causal field nodes in the updated role behavior graph based on the causal contribution and defining a path causal evidence chain; S4, quantifying the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain, identifying the dominant responsibility field, constructing a responsibility chain through the dominant responsibility field and outputting a structured attribution result, thereby realizing a causal closed loop from path identification to responsibility attribution.

[0010] Furthermore, multi-source data is collected in real time, corporate fraud data is obtained from the multi-source data, and the corporate fraud data is pre-processed to obtain the pre-processed corporate fraud data. The specific steps are as follows: multi-source data such as transaction records, login logs, approval processes and entry and exit behaviors are collected in real time to obtain corporate fraud data. The corporate fraud data includes the amount of a single transfer, the average number of transactions per day, the average transfer interval, login time, the number of off-site logins, approval delay, the proportion of approval amount, and the frequency of nighttime activities; the single transfer amount and the average number of transactions per day are dynamically smoothed by the exponential sliding average algorithm; the approval delay and the frequency of nighttime activities are synchronized with the event sequence by the timestamp alignment algorithm; the distribution of the number of off-site logins and the proportion of approval amount are normalized by the quantile normalization algorithm; the numerical scale of the corporate fraud data is normalized by the minimum and maximum scaling method to achieve normalization of the corporate fraud data.

[0011] Furthermore, based on the pre-processed corporate fraud data, a role behavior graph is constructed to evaluate the risk connection density between role behaviors. The specific steps are as follows: Based on the pre-processed corporate fraud data, a role behavior graph containing employees, accounts, equipment, and approval processes is constructed. The nodes in the graph represent entity roles, and the edges represent behavior paths. Each edge corresponds to a set of behavior relationship fields, and weighted attributes are constructed for all edges. Using the pre-processed corporate fraud data, the risk connection density between behavioral entities in the graph structure is evaluated: the square root of the product of the single transfer amount and the approval amount ratio is taken as the capital intensity. Item; add the product of the login time and the frequency of evening activities by one and then take the logarithm to obtain the behavior intensity item; add the capital intensity item and the behavior intensity item to obtain the numerator of the fraud risk score; add the number of remote logins and the approval delay and divide it by the value of the average transfer interval plus one to obtain the exponential function value, and add one to the exponential function value to obtain the behavior penalty item; divide the numerator of the fraud risk score by the behavior penalty item to obtain the basic risk score item; divide the average daily transaction number by ten and take the hyperbolic tangent function value as the high-frequency trading correction item; add the basic risk score item and the high-frequency trading correction item to obtain the fraud association intensity value.

[0012] Furthermore, the specific steps of updating the role behavior graph and constructing a potential fraud edge set based on the evaluation results are as follows: updating the role behavior graph with the fraud association strength value as the edge weight; comparing the fraud association strength value and the fraud association strength threshold in real time, and when the fraud association strength value is greater than the fraud association strength threshold, marking the corresponding edge as a potential fraud edge; when the fraud association strength value is less than or equal to the fraud association strength threshold, marking the edge as a normal behavior edge and retaining it in the role behavior graph as an auxiliary behavior background; extracting all potential fraud edges and constructing a potential fraud edge set; accordingly, the method also includes: adopting a directed graph structure generation mechanism, starting from the employee node, connecting to the account, equipment, and approval process nodes according to the behavior path, and preliminarily establishing a role-behavior-consequence path structure.

[0013] Furthermore, the specific steps of identifying the path to which each potential fraud edge in the fraud edge set belongs and analyzing the causal contribution of role behavior and capital variables to path risk are as follows: extract the potential fraud edge set, identify the path to which each potential fraud edge belongs, obtain all corporate fraud data fields in the path, and quantify the structural explanatory power of behavior intensity and capital flow in each path on the final fraud risk: add one to the frequency of evening activities and take the natural logarithm, multiply it by the login time, as the behavior association product term; divide the behavior association product term by the square root of the average transfer interval plus one, as the behavior intensity term; take the product of the single transfer amount and the proportion of the approved amount as the capital intensity term; add the behavior intensity term and the capital intensity term to obtain the path basic causal score value; multiply the path basic causal score value by the logarithm of the fraud association intensity value plus one to obtain the path causal evaluation value.

[0014] Furthermore, the specific steps for marking path causal field nodes in the updated role behavior graph based on causal contribution and defining the path causal evidence chain are as follows: compare the path causal evaluation value and the path causal threshold in real time. If the path causal evaluation value is greater than the path causal threshold, mark the path as a causal reasoning path for subsequent field node extraction and evidence chain construction; if the path causal evaluation value is less than or equal to the path causal threshold, mark the path as a boundary path, retain the structural information and field data for comparison reference, and do not participate in the current round of reasoning path set; extract the fields used to calculate the path causal evaluation value on the causal reasoning path one by one, and mark the nodes to which they belong as path causal field nodes according to the correspondence between the fields and the node attributes in the role behavior graph; connect the path causal field nodes to form a directed node sequence according to the node connection order in the role behavior graph, and the position of each node in the sequence is determined by its appearance order in the path; define the node sequence as a path causal evidence chain, and record the path number, path causal evaluation value, field name, field value and node connection order.

[0015] Furthermore, the specific steps for quantifying the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain are as follows: based on the path causal evidence chain, extract the path causal field nodes in each path; for each causal field node, read its corresponding enterprise fraud data, and link the path causal evaluation value and the fraud association strength value to quantify the explanatory strength of each field in the path causal structure; multiply the single transfer amount by the proportion of the approval amount and divide it by the average transfer interval plus one as the capital attribution item; divide the login time by the approval delay plus one as the behavior attribution item; add the capital attribution item and the behavior attribution item as the node attribution base value; add the path causal evaluation value and the fraud association strength value, add one, and then take the natural logarithm as the causal adjustment item; multiply the node attribution base value by the causal adjustment item to obtain the node attribution priority value.

[0016] Furthermore, the specific steps for identifying the dominant responsibility field are as follows: sort the path causal field nodes extracted from each path from high to low according to the degree of action on the node chain, select the field node with the largest node attribution priority value, mark it as the dominant responsibility node, and record the field name, field value, attributed behavior entity and connection position index of the node.

[0017] Furthermore, by constructing a responsibility chain through the dominant responsibility field and outputting structured attribution results, the specific steps for realizing the causal closed loop from path identification to responsibility attribution are as follows: according to the node connection order in the role behavior diagram, the path causal field nodes are constructed into a directed sequence to generate a responsibility chain; a structured attribution data set is constructed using the path number, responsibility chain node sequence, dominant responsibility node, path causal evaluation value and fraud correlation strength value, and the correspondence between the path layer, field node layer and attribution indicator layer is established; based on the structured attribution data set, a field attribution index is constructed to count the frequency of occurrence of each field in all dominant responsibility nodes and the maximum node attribution priority value; the attribution index is jointly archived with the path causal evidence chain, the role behavior diagram and the corporate fraud data to form a responsibility chain closed loop structure with traceable fields, reconstructable paths and attributable nodes.

[0018] The second aspect of the present invention provides an enterprise-level fraud automatic identification platform based on artificial intelligence, including: an enterprise fraud data collection and preprocessing module, a role behavior graph construction and causal modeling module, a path causal evaluation and evidence chain construction module and an attribution priority calculation and responsibility chain output module, wherein: the enterprise fraud data collection and preprocessing module is used to collect multi-source data in real time, obtain enterprise fraud data from multi-source data, and preprocess the enterprise fraud data to obtain preprocessed enterprise fraud data; the role behavior graph construction and causal modeling module is used to construct a role behavior graph based on the preprocessed enterprise fraud data, evaluate the risk connection between role behaviors, and update the angle based on the evaluation results. Color behavior graph, and determine the potential fraud edge set in the updated role behavior graph; path causal evaluation and evidence chain construction module, used to identify the path to which each potential fraud edge in the fraud edge set belongs, analyze the causal contribution of role behavior and capital variables to path risk, and mark the path causal field nodes in the updated role behavior graph based on the causal contribution and define the path causal evidence chain; attribution priority calculation and responsibility chain output module, used to quantify the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain, identify the dominant responsibility field, build the responsibility chain through the dominant responsibility field and output the structured attribution result, so as to realize the causal closed loop from path identification to responsibility attribution.

[0019] Beneficial effects

[0020] The present invention has the following beneficial effects:

[0021] (1) This AI-based enterprise-level fraud automatic identification platform and method constructs a causal reasoning path based on role-behavior-field, combines causal graph neural network with counterfactual analysis logic, and outputs a responsibility chain containing path causal field nodes, connection sequence, behavior type and attribution strength, so that each fraud judgment has verifiable, reproducible and traceable explanatory evidence, significantly enhancing the credibility and legal applicability of the system output.

[0022] (2) This AI-based enterprise-level fraud automatic identification platform and method integrates enterprise-level multi-source heterogeneous data to construct a complex graph structure that includes employees, accounts, equipment, approval processes, and multi-dimensional behavior fields. Each edge marks a specific behavioral event, and each field node carries a quantitative indicator. The graph structure supports dynamic updates and real-time data injection, and has the ability to extract horizontal behavioral chains and vertical field risk penetration, providing a solid structural foundation for subsequent path-level causal analysis.

[0023] (3) This AI-based enterprise-level fraud automatic identification platform and method proposes two structural indicators: fraud association strength value and path causal evaluation value. The former is used to measure the degree of behavioral risk closeness between entity pairs in the graph, and the latter is used to evaluate the causal explanation ability of path-level field combinations for fraud events. The two jointly constitute the dual dimensions of risk screening and traceability analysis, effectively improving the system's accurate identification capabilities in complex environments.

[0024] (4) This AI-based enterprise-level fraud automatic identification platform and method, through the innovative design of the node attribution priority value indicator system, quantitatively scores the attribution strength of the field nodes in each path, automatically identifies the dominant responsibility fields, and constructs a causal evidence chain based on the path connection relationship, realizing closed-loop attribution chain modeling of fraudulent behavior, supporting scenarios such as manual review, risk warning and judicial evidence collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 A flowchart of the method for automatically identifying enterprise-level fraud based on artificial intelligence;

[0026] Figure 2 A diagram of the structure of an AI-based enterprise-level fraud automatic identification platform;

[0027] Figure 3 A comparison chart of node attributed priority values ​​in descending order;

[0028] Figure 4 A role behavior diagram driven by field attribution. DETAILED DESCRIPTION

[0029] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0030] See also Figures 1-4, an embodiment of the present invention provides a technical solution: an artificial intelligence-based enterprise-level fraud behavior automatic identification method, comprising the following steps: S1, real-time collection of multi-source data, obtaining enterprise fraud data from the multi-source data, and preprocessing the enterprise fraud data to obtain the preprocessed enterprise fraud data; S2, constructing a role behavior graph based on the preprocessed enterprise fraud data, evaluating the risk connection closeness between role behaviors, updating the role behavior graph based on the evaluation results, and determining a potential fraud edge set in the updated role behavior graph; S3, identifying the path to which each potential fraud edge in the fraud edge set belongs, analyzing the causal contribution of role behavior and capital variables to path risk, and marking the path causal field nodes in the updated role behavior graph based on the causal contribution and defining a path causal evidence chain; S4, quantifying the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain, identifying the dominant responsibility field, constructing a responsibility chain through the dominant responsibility field and outputting a structured attribution result, thereby realizing a causal closed loop from path identification to responsibility attribution.

[0031] Specifically, the system collects multi-source data in real time, extracts enterprise fraud data from these data sources, and pre-processes the data to obtain pre-processed enterprise fraud data. The specific steps for obtaining pre-processed enterprise fraud data are as follows: In real time, it collects multi-source data, including transaction records, login logs, approval processes, and access behavior, to obtain enterprise fraud data. This data includes single transfer amount, average daily transaction count, average transfer interval, login duration, number of remote logins, approval delay, percentage of approved amounts, and frequency of nighttime activity. By reading the transaction flow in the enterprise's financial system in real time, the amount of each fund transfer is extracted to obtain the single transfer amount. This directly reflects the unit quota characteristics of internal fund transfers within the enterprise and is suitable for identifying large-scale abnormal fund flows. By setting a rolling cycle, the number of valid transfers per account within consecutive calendar days is counted to obtain the average daily transaction count, which reflects account activity and can reveal potential risks associated with frequent trading operations. By calculating the time interval between two consecutive fund transfers and averaging all the interval values, the average transfer interval is obtained, which is used to measure account operation frequency and monitor high-intensity fund activities. By analyzing the authentication logs for each account in the enterprise login system, the duration of each login is counted to obtain the login duration field. This field can indicate the persistence of account usage and capture anomalous online behavior. By comparing the geographic location of the login terminal with the account registration location, the number of logins with significant geographical deviations is recorded to obtain the number of out-of-region logins. This metric reveals potential account changes and external control risks. By extracting the execution time of each approval process node in the business approval system and calculating the time difference from task triggering to final confirmation, the approval delay is obtained, reflecting fluctuations in process efficiency and possible intentional delays. By calculating the ratio of the corresponding fund amount of each approval to the total approved fund amount of the account, the proportion of the approved fund amount is obtained, which is used to assess the financial involvement of key approval links and identify abnormal concentration of authority and responsibility. By extracting the timestamps of operations in the account behavior log, the number of active events in the evening hours each day is counted to obtain the frequency of evening activity, which can be used to identify operations during irregular hours and potential signs of fraud to circumvent supervision. The exponential moving average algorithm is used to dynamically smooth the amount of single transfers and the average daily number of transactions; the timestamp alignment algorithm is used to synchronize the event sequence of approval delays and the frequency of evening activities; the quantile normalization algorithm is used to normalize the distribution of the number of off-site logins and the proportion of approved amounts; the minimum and maximum scaling method is used to normalize the numerical scale of corporate fraud data, thereby achieving normalization of corporate fraud data.

[0032] In this implementation plan, by real-time collection of multi-source data such as transaction records, login logs, approval processes and entry and exit behaviors, eight types of fraud fields are accurately extracted, including single transfer amount, average daily transaction times, average transfer interval, login duration, number of remote logins, approval delay, proportion of approval amount, and frequency of night activities. The exponential moving average algorithm, timestamp alignment algorithm, quantile normalization algorithm and minimum and maximum scaling method are combined to achieve field-level dynamic smoothing, sequence alignment, distribution standardization and scale normalization processing, and construct a basic set of corporate fraud data with unified structure, complete time series and stable statistics, providing high-quality data support for subsequent path identification, causal reasoning and responsibility attribution, and significantly improving the system's data adaptability and modeling accuracy in complex business environments.

[0033] Specifically, a role behavior graph is constructed based on the preprocessed enterprise fraud data, and the specific steps for evaluating the risk connection between role behaviors are as follows: Based on the preprocessed enterprise fraud data, a role behavior graph is constructed containing employee nodes, account nodes, device nodes and approval process nodes. Each node in the graph represents a specific internal entity role of the enterprise, and the edges between the nodes represent the actual occurrence path of fraud-related behaviors. Each edge is composed of a set of normalized behavioral relationship fields, including a single transfer amount field, an average daily transaction number field, an average transfer interval field, a login duration field, a remote login number field, an approval delay field, an approval amount ratio field, and a nighttime activity frequency field. Based on these fields, all edges are given quantitative weighted attributes to reflect the risk transmission capabilities between entities. Based on this graph structure, the pre-processed corporate fraud data is used to evaluate the closeness of the risk connection between behavioral entities in the graph structure edge by edge: first, the single transfer amount field is multiplied by the approval amount ratio field, and the product is taken and square root transformed. The result is used as the capital intensity item, which is used to reflect the capital flow risk intensity between the entities connected by the edge; then, the natural logarithm of the result of multiplying the login duration field by the evening activity frequency field is added by one, and the result is taken as the behavior intensity item, which is used to characterize the joint effect of behavior time distribution and login duration behavior on fraud risk; then, the capital intensity item and the behavior intensity item are added together to form the numerator of the fraud risk score, which is used to comprehensively represent the initial risk level of the behavior included in the path. Subsequently, the off-site login times field is added to the approval delay field, and the result is divided by the value of the average transfer interval field plus one to obtain a penalty factor input item. The exponential function value of the input item is taken, and then added by one to obtain the behavior penalty item, which is used to quantify the impact of geographic location offset and process delay on behavior reliability; the above fraud risk score numerator is divided by the behavior penalty item, and the result is defined as the basic risk score item, which is used to represent the adjusted value of the fraud risk carried by the edge under consideration of interference factors; finally, the average daily transaction times field is divided by ten, and its hyperbolic tangent function value is calculated as the high-frequency trading correction item, which reflects the adjustment effect of high-frequency operations of the account on the degree of deviation of fraud behavior; the basic risk score item and the high-frequency trading correction item are added to obtain the final fraud association strength value, which is used as the weight of the edge to update the risk expression ability of the behavior path in the role behavior graph, thereby realizing quantitative modeling of the risk connection strength between roles.

[0034] The specific calculation formula for the fraud correlation strength value is:

[0035] ;

[0036] Where S represents the fraud association strength value, A represents the single transfer amount, B represents the average daily number of transactions, C represents the average transfer interval, D represents the login duration, E represents the number of remote logins, F represents the approval delay, G represents the proportion of approved amounts, and H represents the frequency of nighttime activities.

[0037] In this implementation, a role-behavior graph encompassing employees, accounts, equipment, and approval processes is constructed based on preprocessed enterprise fraud data. This graph integrates eight fraud fields: single transfer amount, average daily transaction count, average transfer interval, login duration, number of remote logins, approval delay, percentage of approved amount, and frequency of evening activity. A weighted attribute calculation model is established along the behavioral path, forming a fraud association strength value indicator to quantitatively model the closeness of risk connections between behavioral entities. This mechanism embeds capital intensity, behavioral intensity, behavioral penalty, and high-frequency trading corrections into a unified scoring system. This system considers both the spatiotemporal distribution and process characteristics of behavior, and incorporates capital flow structure and account operation patterns. This effectively enhances the expressive power of the graph structure in risk path identification, providing high-resolution risk weight support for potential fraud edge extraction and causal path construction.

[0038] Specifically, the specific steps for updating the role behavior graph and constructing a potential fraud edge set based on the evaluation results are as follows: using the fraud association strength value as the edge weight, updating the role behavior graph, and assigning the weight of each edge in the graph structure with the fraud association strength value; comparing the fraud association strength value with the fraud association strength threshold set by the system in real time, and performing edge-by-edge judgment in each round of edge weight update cycle; when the fraud association strength value of an edge is greater than the fraud association strength threshold, marking the edge as a potential fraud edge, and annotating it with a high-risk label in the updated role behavior graph, identifying it as a risk path segment with abnormal structural connections; when the fraud association strength value of an edge is less than the fraud association strength threshold or the fraud association strength value is equal to the fraud association strength threshold, marking the edge as a potential fraud edge. It is recorded as a normal behavior edge and retained as the background path in the role behavior graph to support the reference modeling of the normal behavior structure in the subsequent causal identification process; all edge sets that have been marked as potential fraud edges are extracted to construct a potential fraud edge set, which is used as the input behavior graph structure for entering the path causal identification process; a directed graph structure generation mechanism is adopted, starting from the employee node, according to the chronological order of the behavior and the logical dependency relationship of the data flow, connecting to the account node in sequence according to the edge connection direction, then to the device node, and finally to the approval process node. Based on the interaction between the fraud field data and the role entity, a role-behavior-consequence path structure is established to support causal reasoning analysis based on the behavior path and the calculation of the field node attribution score.

[0039] In this implementation plan, the role behavior graph is updated based on the fraud association strength value, the edge weights in the graph are calculated using corporate fraud data, potential fraud edges are distinguished from ordinary behavior edges, and a potential fraud edge set is constructed; a directed graph structure generation mechanism is adopted to connect account nodes, device nodes, and approval process nodes in sequence from employee nodes to establish a role-behavior-consequence path structure, providing a clear-direction graph model support for subsequent causal reasoning and field attribution.

[0040] Specifically, the steps for identifying the path to which each potential fraud edge in the fraud edge set belongs and analyzing the causal contribution of role behavior and capital variables to path risk are as follows: Extract the potential fraud edge set, perform path identification on each potential fraud edge, identify the complete path number of the edge nested in the graph structure based on the connection order in the role behavior graph, and locate its position; obtain all corporate fraud data within the path, and match the field position index with the behavior nodes one by one to ensure the consistency of the path field and node structure. Quantify the structural explanatory power of behavior intensity and capital flow in each path on the final fraud risk: Add 1 to the natural logarithm of the evening activity frequency field to form a frequency adjustment factor. This factor is then multiplied by the login duration field to form a behavioral correlation product term, which measures the degree of product correlation between persistent behavior and abnormal activity frequency in the path; divide this behavioral correlation product term by the square root of the average transfer interval field plus 1 to construct a behavioral intensity term, which reflects the contribution of behavioral variables to path structural risk under the constraint of operation frequency. Multiply the single transfer amount field with the approval amount ratio field to form a comprehensive coupling value of the capital variable, which is defined as the capital intensity term, representing the joint strength of the capital flow amount and the capital ratio of the key approval node in the path; add the behavior intensity term and the capital intensity term to form the path basic causal score value, which represents the structural expression ability of the variable combination in the path for fraud risk; multiply the path basic causal score value by the natural logarithm of the fraud association intensity value plus one to calculate the path causal evaluation value, which is used as the causal scoring indicator for subsequent field node attribution and path sorting.

[0041] The specific calculation formula of the path causal evaluation value is:

[0042] ;

[0043] Where W represents the path causal evaluation value, S represents the fraud association strength value, A represents the single transfer amount, C represents the average transfer interval, D represents the login duration, G represents the proportion of the approved amount, and H represents the frequency of nighttime activities.

[0044] In this implementation plan, by identifying the path to which the potential fraud edge belongs, and based on the single transfer amount, the proportion of the approved amount, the average transfer interval, the login time, and the frequency of evening activities in the path, a path causal evaluation value calculation model is constructed to quantify the structural explanatory power of behavioral intensity and financial intensity on fraud risk; combined with the fraud correlation intensity value, a causal scoring system with behavioral continuity constraints, financial coupling expression and risk amplification mechanism is formed, to achieve a hierarchical assessment of the contribution of variables in the fraud path, and provide a clear structure and accurate expression of quantitative support for the subsequent field node attribution and causal evidence chain generation.

[0045] Specifically, the specific steps for marking path causal field nodes in the updated role behavior diagram based on causal contribution and defining the path causal evidence chain are as follows: compare the path causal evaluation value and the path causal threshold in real time, and make a judgment based on the calculation result of the path causal evaluation value. If the path causal evaluation value is greater than the path causal threshold, the path is marked as a causal reasoning path. This type of path contains path characteristics with complete structure, significant variables, and sufficient risk expression, which are used to enter the subsequent field node extraction stage and the path causal evidence chain construction process; if the path causal evaluation value is less than the path causal threshold or the path causal evaluation value is equal to the path causal threshold, the path is marked as a boundary path. This type of path retains its node structure and all fraud field data, and is used as a reference sample for reasoning result comparison and structural feature baseline calibration, and does not participate in the generation of this round of reasoning path set. The key fraud fields used to calculate the path causal evaluation value in the causal reasoning path are extracted one by one, including the single transfer amount field, the approval amount ratio field, the average transfer interval field, the login duration field, and the nighttime activity frequency field. According to the one-to-one correspondence between the field and the node attribute in the role behavior graph, the node to which the field belongs is marked as the path causal field node. Each field node is bound to the role type and field value information. According to the node connection order in the role behavior graph and the directional structure of the edges in the graph, all path causal field nodes are connected in sequence to form a complete directed node sequence. The arrangement position of each node in the sequence strictly corresponds to the behavior triggering order in the causal reasoning path. The directed node sequence corresponding to this path is defined as the path causal evidence chain, which provides the causal path foundation support for the subsequent execution node attribution scoring, dominant field identification, and responsibility chain generation.

[0046] In this implementation plan, through real-time comparison of the path causal evaluation value and the path causal threshold, the causal reasoning path with high-risk structural characteristics is accurately screened, and the key fraud fields in the path used to calculate the path causal evaluation value are extracted, including the single transfer amount, the proportion of the approved amount, the average transfer interval, the login time, and the frequency of evening activities, and the corresponding path causal field nodes are marked in the role behavior diagram; a directed node sequence is constructed according to the node connection order to generate a path causal evidence chain with a complete structure, clear sequence, and clear variables, providing a verifiable and traceable causal input basis for the subsequent node attribution priority value calculation and responsibility chain generation.

[0047] Specifically, the steps for quantifying the explanatory strength of each causal field node in the path causal evidence chain are as follows: Based on the path causal evidence chain, the path numbers and node connection sequences recorded in the evidence chain are extracted one by one, and the path causal field nodes in each path are located. Each field node is associated with the corresponding fraud field type and field value, including the single transfer amount, the percentage of approved amounts, the average transfer interval, the login duration, and the approval delay. For each path causal field node, the normalized field value from the enterprise fraud data source is called, and the path causal assessment value corresponding to the path to which the field belongs is linked with the fraud association strength value to construct a calculation model for the field's explanatory strength in the path causal structure. The single transfer amount field is multiplied by the approval amount ratio field to calculate the joint expression of the capital variable. This product is then divided by the average transfer interval field plus one to construct the capital attribution term, which represents the structural transmission capacity of the capital variable in the path. The login duration field is divided by the approval delay field plus one to construct the behavioral attribution term, which reflects the impact of duration and process delay on the attribution degree of the behavioral variable. The capital attribution term and the behavioral attribution term are added together to form the node attribution base value, which represents the structural explanatory power of the field node under unmoderated conditions. The path causal assessment value is added to the fraud association strength value, then the natural logarithm is taken to generate the causal adjustment term, which is used to adjust the global amplification weight of the field attribution value in the causal structure. The node attribution base value is multiplied by the causal adjustment term to calculate the node attribution priority value. This value measures the structural explanatory power of the field node in its path, providing a quantifiable attribution score for identifying responsible fields and ranking dominant factors.

[0048] The specific calculation formula for the node attribution priority value is:

[0049] ;

[0050] Where Z represents the node attribution priority value, W represents the path causal evaluation value, S represents the fraud association strength value, A represents the single transfer amount, C represents the average transfer interval, D represents the login duration, G represents the proportion of the approved amount, and F represents the approval delay.

[0051] In this example, Table 1 is a node attribution priority data table, detailing the attribution calculation data for five causal field nodes within the current fraud path causal structure. Each node, based on its enterprise fraud data field within the path, combines the path causal assessment value with the fraud association strength value to calculate a corresponding node attribution priority value, which is used to measure the structural attribution explanatory power of that field node within the entire fraud path. For causal field node P1, the single transfer amount is 571.89, the approval amount accounts for 0.12%, the average transfer interval is 8.11, the login duration is 24.0, the approval delay is 25.8, the path causal assessment value is 0.55, the fraud association strength value is 0.24, and the calculated node attribution priority value is 15.32. In the causal field node P2, the single transfer amount is 792.35, the approved amount accounts for 0.19%, the average transfer interval is 5.57, the login duration is 16.1, the approval delay is 10.1, the path causal evaluation value is 0.95, the fraud association strength value is 0.59, and the calculated node attribution priority value is 26.25. In the causal field node P3, the single transfer amount is 663.00, the approved amount accounts for 0.27, the average transfer interval is 4.60, the login duration is 22.0, the approval delay is 11.2, the path causal evaluation value is 0.62, the fraud association strength value is 0.27, and the calculated node attribution priority value is 21.43. In the causal field node P4, the single transfer amount was 280.06, the approved amount accounted for 0.17%, the average transfer interval was 7.94, the login duration was 12.4, the approval delay was 56.1, the path causal evaluation value was 1.24, the fraud association strength value was 0.36, and the calculated node attribution priority value was 18.62. In the causal field node P5, the single transfer amount was 703.50, the approved amount accounted for 0.20, the average transfer interval was 8.89, the login duration was 27.4, the approval delay was 18.2, the path causal evaluation value was 1.14, the fraud association strength value was 0.47, and the calculated node attribution priority value was 15.12.

[0052] Table 1 Node attribution priority value data table

[0053]

[0054] like Figure 3 The figure shows the descending comparison of the priority values ​​of the nodes in the fraud behavior path, which is used to analyze the structural explanation strength of each field on the fraud risk in the path. The attribution weight in this path is significantly higher than that in other fields, indicating that these two nodes bear a stronger risk explanation responsibility in the path causal structure. With node The lower position of node indicates that its causal contribution in the path is weak. It can be regarded as the leading responsibility field in this path and can be included in the review and attribution process as a priority.

[0055] like Figure 4 The figure shows a field-attribution-driven role-behavior diagram, illustrating the causal structure of role-behavior based on field-attribution priority values ​​within an enterprise fraud detection system. The left side of the diagram shows business role nodes, such as employee, account, equipment, and approval process. The right side shows five key field nodes identified by the system. Field labels include attribution priority values, which measure the explanatory strength of the field in the path causal structure. Lines in the diagram represent causal paths between roles and fields. Red edges indicate potential fraud, while gray edges indicate normal behavior. The S value above each edge indicates the closeness of each behavioral path segment in the graph's contribution to fraud risk transmission. Overall, this diagram illustrates the structural process of forming a causal chain of fraud paths, starting from entity behavior and acting through field variables. Based on this diagram, the system can extract the dominant responsible field node and construct a fraud responsibility chain, enabling structured attribution analysis and traceability assessment.

[0056] In this implementation plan, by constructing an attribution scoring model with the single transfer amount, approval amount ratio, average transfer interval, login time, and approval delay as input, the path causal evaluation value and the fraud association strength value are linked, the node attribution priority value is calculated, and the explanatory strength of each field node in the path causal structure is quantified; combining the financial attribution item, behavioral attribution item and causal adjustment item to construct a multi-factor attribution expression mechanism, realize the quantitative analysis of the path causal field nodes, and provide a unified standard attribution scoring basis for the identification of the leading responsibility field and the construction of the responsibility chain.

[0057] Specifically, the steps for identifying the dominant responsibility field are as follows: The path causal field nodes extracted from each path are sorted by their role value on the node chain, combined with the node connection order and field type information recorded in the path causal evidence chain. This role value, also known as the node attribution priority value, is derived from an attribution scoring model constructed using the single transfer amount, approval amount ratio, average transfer interval, login time, and approval delay. Field nodes are sorted from high to low by their node attribution priority value, and the field node with the largest attribution priority value is extracted as the core field node with the highest explanatory power for the path causal structure in that path, marking it as the dominant responsibility node. The field name corresponding to the dominant responsibility node is also recorded, along with its standardized value in the corporate fraud data. The attributed behavior entity is the structural node type of the field in the role behavior diagram, and the connection position index is the corresponding sequence position of the field node in the path causal evidence chain. This is used to locate the exact position of the field node in the path structure when subsequently generating the responsibility chain structure.

[0058] In this implementation plan, by sorting the path causal field nodes by node attribution priority values, extracting the field node with the largest attribution priority value as the leading responsibility node, and combining the field name, field value, attribution behavior entity and connection position index, a clear mapping relationship between the field structure and causal strength within the path is established to achieve the positioning and identification of key fraud fields, and improve the recognition and traceability accuracy of the path causal evidence chain in responsibility attribution analysis.

[0059] Specifically, the following steps are used to construct a responsibility chain using the dominant responsibility field and output structured attribution results, achieving a causal closed loop from path identification to responsibility attribution: Following the node connection order in the role-behavior graph and based on the identified path causal field nodes in the path causal evidence chain, a directed node sequence is constructed that strictly follows the behavior triggering order to generate a responsibility chain. Each node's position in the chain corresponds to its position in the path. Field nodes are bound to corresponding fraud field names and values, including single transfer amount, average daily transaction number, average transfer interval, login duration, number of remote logins, approval delay, percentage of approved amount, and frequency of nighttime activities. A structured attribution dataset is constructed using the path number, responsibility chain node sequence, dominant responsibility node, path causal evaluation value, and fraud association strength value. This dataset records the path number and path causal evaluation value at the path layer, the field name, field value, and node connection order of the path causal field nodes at the field node layer, and the fraud association strength value and node attribution priority value at the attribution indicator layer, forming a complete and clearly layered data representation framework. Based on a structured attribution dataset, a field attribution index is constructed. The cumulative frequency of each field in all dominant responsibility nodes is counted by field name. The maximum node attribution priority value for each field in its corresponding dominant responsibility node is extracted to form a field-level attribution strength statistical indicator. The field attribution index is archived together with the path causal evidence chain, role behavior diagram, and corporate fraud data to establish a closed-loop responsibility chain structure with traceable fields, reconstructable paths, and attributable nodes. This provides a standardized and traceable attribution basis for audit analysis, manual verification, and system accountability.

[0060] In this implementation plan, by constructing a responsibility chain based on path causal field nodes, integrating path numbers, path causal evaluation values, fraud association strength values, node attribution priority values ​​and dominant responsibility nodes, a structured attribution data set is formed, and a correspondence between the path layer, field node layer and attribution indicator layer is established; the system further generates a field attribution index, records the frequency of occurrence of the field in the dominant responsibility node and the maximum node attribution priority value, and jointly archives it with the path causal evidence chain, role behavior diagram, and corporate fraud data to form a closed-loop structure of the responsibility chain with traceable fields, reconstructable paths, and attributable nodes, thereby realizing causal connectivity throughout the entire process from path identification to responsibility attribution.

[0061] like Figure 2 As shown, the second aspect of the present invention provides an enterprise-level fraud automatic identification platform based on artificial intelligence, including: an enterprise fraud data collection and preprocessing module, a role behavior graph construction and causal modeling module, a path causal evaluation and evidence chain construction module and an attribution priority calculation and responsibility chain output module, wherein: the enterprise fraud data collection and preprocessing module is used to collect multi-source data in real time, obtain enterprise fraud data from multi-source data, and preprocess the enterprise fraud data to obtain preprocessed enterprise fraud data; the role behavior graph construction and causal modeling module is used to construct a role behavior graph based on the preprocessed enterprise fraud data, evaluate the risk connection between role behaviors, and improve the risk management based on the evaluation results. A new role behavior graph is created, and the potential fraud edge set is determined in the updated role behavior graph; a path causal assessment and evidence chain construction module is used to identify the path to which each potential fraud edge in the fraud edge set belongs, analyze the causal contribution of role behavior and capital variables to path risk, and mark the path causal field nodes in the updated role behavior graph based on the causal contribution and define the path causal evidence chain; an attribution priority calculation and responsibility chain output module is used to quantify the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain, identify the dominant responsibility field, construct the responsibility chain through the dominant responsibility field and output the structured attribution result, so as to realize the causal closed loop from path identification to responsibility attribution.

[0062] In this implementation plan, a complete fraud identification and attribution analysis system is formed by constructing an enterprise fraud data collection preprocessing module, a role behavior graph construction and causal modeling module, a path causal evaluation and evidence chain construction module, and an attribution priority calculation and responsibility chain output module; the platform uses single transfer amount, average daily transaction times, average transfer interval, login time, number of remote logins, approval delay, proportion of approval amount, and frequency of nighttime activities as core fields, and runs through the entire process of data preprocessing, graph structure construction, causal evaluation modeling and responsibility chain output, to achieve a structural closed loop of enterprise fraud behavior from data extraction, causal identification, node attribution to responsibility determination, thereby improving the accuracy, explainability and traceability of fraud detection.

[0063] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0064] The preferred embodiments of the present invention disclosed above are intended only to help illustrate the present invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the present invention to the specific embodiments described. Obviously, many modifications and variations are possible based on the content of this specification. These embodiments are selected and described in detail in this specification to better explain the principles and practical applications of the present invention, thereby enabling those skilled in the art to better understand and utilize the present invention. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An enterprise-level fraud automatic identification method based on artificial intelligence, characterized by: The following steps are involved: S1, real-time collection of multi-source data, obtaining enterprise fraud data from the multi-source data, and pre-processing the enterprise fraud data to obtain pre-processed enterprise fraud data; S2, constructing a role behavior graph based on the pre-processed corporate fraud data, evaluating the risk connection between role behaviors, updating the role behavior graph based on the evaluation results, and determining the potential fraud edge set in the updated role behavior graph; The specific steps of constructing a role behavior graph based on pre-processed corporate fraud data and evaluating the risk connection between role behaviors are as follows: Based on pre-processed corporate fraud data, a role-behavior graph is constructed that includes employees, accounts, equipment, and approval processes. Nodes in the graph represent entity roles, and edges represent behavior paths. Each edge corresponds to a set of behavior relationship fields, and weighted attributes are constructed for all edges. Using pre-processed corporate fraud data, the closeness of risk connections between behavioral entities in the graph structure is assessed. The square root of the product of the single transfer amount and the proportion of the approved amount is taken as the capital intensity term; the product of the login time and the frequency of evening activities is multiplied by one and then the logarithm is taken to form the behavioral intensity term; the capital intensity term and the behavioral intensity term are added together to form the numerator of the fraud risk score; the number of remote logins and the approval delay are added together and divided by the value of the average transfer interval plus one to take the exponential function value, and the exponential function value plus one is used as the behavioral penalty term; the numerator of the fraud risk score is divided by the behavioral penalty term to form the basic risk score term; the average daily transaction number is divided by ten and the hyperbolic tangent function value is taken as the high-frequency trading correction term; the basic risk score term and the high-frequency trading correction term are added to obtain the fraud association strength value. S3, identify the path to which each potential fraud edge in the fraud edge set belongs, analyze the causal contribution of role behavior and capital variables to path risk, and mark the path causal field nodes in the updated role behavior graph based on the causal contribution and define the path causal evidence chain; S4, based on the path causal evidence chain, quantifies the explanatory strength of each causal field node in the path causal evidence chain, identifies the dominant responsibility field, constructs the responsibility chain through the dominant responsibility field and outputs the structured attribution results, realizing the causal closed loop from path identification to responsibility attribution.

2. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps of collecting multi-source data in real time, obtaining enterprise fraud data from the multi-source data, and preprocessing the enterprise fraud data to obtain the preprocessed enterprise fraud data are as follows: Real-time collection of transaction records, login logs, approval processes, and access behaviors to obtain corporate fraud data, including single transfer amount, average daily transaction times, average transfer interval, login duration, number of remote logins, approval delays, percentage of approved amounts, and frequency of nighttime activities. The exponential moving average algorithm is used to dynamically smooth the single transfer amount and the average daily transaction number; the timestamp alignment algorithm is used to synchronize the event sequence between approval delays and the frequency of evening activities; and the quantile normalization algorithm is used to normalize the distribution of the number of remote logins and the proportion of approved amounts. The enterprise fraud data is normalized by using the minimum and maximum scaling method to achieve normalization of the enterprise fraud data.

3. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps of updating the role behavior graph based on the evaluation results and determining the potential cheating edge set in the updated role behavior graph are as follows: Update the role behavior graph using the fraud association strength value as the edge weight; compare the fraud association strength value with the fraud association strength threshold in real time. When the fraud association strength value is greater than the fraud association strength threshold, mark the corresponding edge as a potential fraud edge; When the fraud association strength value is less than or equal to the fraud association strength threshold, the edge is marked as a normal behavior edge and retained in the role behavior graph as an auxiliary behavior background; Extract all potential fraud edges and construct a potential fraud edge set; Accordingly, the method further includes: adopting a directed graph structure generation mechanism, starting from the employee node, connecting to the account, equipment, and approval process nodes according to the behavior path, and preliminarily establishing a role-behavior-consequence path structure.

4. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps for identifying the path to which each potential fraud edge in the fraud edge set belongs and analyzing the causal contribution of role behavior and capital variables to path risk are as follows: Extract the set of potential fraud edges, identify the path to which each potential fraud edge belongs, obtain all corporate fraud data fields in the path, and quantify the structural explanatory power of behavioral intensity and capital flow in each path for the final fraud risk: add one to the frequency of evening activities, take the natural logarithm, and multiply it by the login time to obtain the behavioral association product term; divide the behavioral association product term by the square root of the average transfer interval plus one to obtain the behavioral intensity term; take the product of the single transfer amount and the proportion of the approved amount as the capital intensity term; add the behavioral intensity term and the capital intensity term to obtain the path-based causal score value; multiply the path-based causal score value by the logarithm of the fraud association intensity value plus one to obtain the path causal assessment value.

5. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps of marking the path causal field nodes in the updated role behavior graph based on causal contribution and defining the path causal evidence chain are as follows: Compare the path causal evaluation value and the path causal threshold in real time. If the path causal evaluation value is greater than the path causal threshold, the path is marked as a causal reasoning path for subsequent field node extraction and evidence chain construction. If the path causal evaluation value is less than or equal to the path causal threshold, the path is marked as a boundary path, retaining the structural information and field data for comparison reference, and not participating in the current round of reasoning path set. Extract the fields used to calculate the path causal evaluation value on the causal reasoning path one by one, and mark the nodes to which they belong as path causal field nodes based on the correspondence between the fields and the node attributes in the role behavior graph; According to the node connection order in the role behavior diagram, the path causal field nodes are connected to form a directed node sequence. The position of each node in the sequence is determined by its appearance order in the path; this node sequence is defined as a path causal evidence chain, and the path number, path causal evaluation value, field name, field value and node connection order are recorded.

6. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps of quantifying the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain are as follows: Based on the path causal evidence chain, the path causal field nodes in each path are extracted; for each causal field node, the corresponding corporate fraud data is read, and the path causal evaluation value and the fraud association strength value are linked to quantify the explanatory strength of each field in the path causal structure; the single transfer amount is multiplied by the proportion of the approved amount and then divided by the average transfer interval plus one as the capital attribution item; the login time is divided by the approval delay plus one as the behavior attribution item; the capital attribution item and the behavior attribution item are added together as the node attribution base value; the path causal evaluation value and the fraud association strength value are added together, plus one, and then the natural logarithm is taken as the causal adjustment item; the node attribution base value is multiplied by the causal adjustment item to obtain the node attribution priority value.

7. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps of identifying the leading responsibility field are as follows: The path causal field nodes extracted from each path are sorted from high to low according to the degree of action on the node chain. The field node with the largest node attribution priority value is selected and marked as the dominant responsibility node. The field name, field value, attributed behavior entity and connection position index of the node are recorded.

8. The method for automatically identifying enterprise-level fraudulent behavior based on artificial intelligence according to claim 1 is characterized by: The specific steps for constructing a responsibility chain through the leading responsibility field and outputting a structured attribution result to achieve a causal closed loop from path identification to responsibility attribution are as follows: According to the node connection order in the role behavior diagram, the path causal field nodes are constructed into a directed sequence to generate a responsibility chain. The structured attribution dataset is constructed using the path number, responsibility chain node sequence, leading responsibility node, path causal evaluation value, and fraud association strength value, and the corresponding relationship between the path layer, field node layer, and attribution indicator layer is established. Based on the structured attribution dataset, a field attribution index is constructed to count the occurrence frequency of each field in all leading responsibility nodes and the maximum node attribution priority value; The attribution index is jointly archived with the path causal evidence chain, role behavior diagram and corporate fraud data to form a closed-loop structure of the responsibility chain with traceable fields, reconstructable paths and attributable nodes.

9. An artificial intelligence-based enterprise-level fraud automatic identification platform, applying the artificial intelligence-based enterprise-level fraud automatic identification method according to any one of claims 1 to 8, characterized in that: It includes the enterprise fraud data collection and preprocessing module, the role behavior diagram construction and causal modeling module, the path causal evaluation and evidence chain construction module, and the attribution priority calculation and responsibility chain output module, among which: The enterprise fraud data collection and preprocessing module is used to collect multi-source data in real time, obtain enterprise fraud data from the multi-source data, and preprocess the enterprise fraud data to obtain the preprocessed enterprise fraud data; The role behavior graph construction and causal modeling module is used to construct a role behavior graph based on the preprocessed enterprise fraud data, evaluate the risk connection between role behaviors, update the role behavior graph based on the evaluation results, and determine the potential fraud edge set in the updated role behavior graph; The path causal assessment and evidence chain construction module is used to identify the path to which each potential fraud edge in the fraud edge set belongs, analyze the causal contribution of role behavior and capital variables to path risk, and mark path causal field nodes in the updated role behavior graph based on the causal contribution and define the path causal evidence chain; The attribution priority calculation and responsibility chain output module is used to quantify the explanatory strength of each causal field node in the path causal evidence chain based on the path causal evidence chain, identify the dominant responsibility field, build a responsibility chain through the dominant responsibility field and output structured attribution results, thereby realizing a causal closed loop from path identification to responsibility attribution.

Images