Real-time anti-fraud monitoring method and system for financial transaction

Abstract

The invention is suitable for the technical field of financial security, and provides a financial transaction real-time anti-fraud monitoring method and system, and the method comprises the steps: collecting user equipment interaction data in real time, extracting an operation curvature change spectrum feature vector, and recognizing a conventional verification step missing time period and an equipment silent state interval; calculating a local entropy speed increase rate and capital network temperature gradient space distribution, and generating an entropy change index; setting a curvature detection threshold value according to the entropy change index, executing multi-scale mode matching on the equipment silent state interval, and obtaining equipment peripheral signal data; performing space-time convolution fusion on the peripheral signal data and the pressure value sequence, and executing a pressure test; and carrying out space-time correlation analysis, identifying a multi-dimensional abnormal signal, and generating a cross-scale risk early warning instruction. Through multi-dimensional data fusion and dynamic risk assessment, the accuracy and scene adaptability of financial transaction real-time anti-fraud monitoring are improved, and an effective guarantee is provided for financial transaction security.

Description

Technical Field

[0001] The present invention belongs to the field of financial security technology, and in particular relates to a real-time anti-fraud monitoring method and system for financial transactions. Background Art

[0002] With the rapid development of financial technology, online financial transactions have become the mainstream mode of transaction. However, the risks of financial fraud that accompany them are also becoming increasingly prominent. Fraudulent methods are becoming more diverse and covert, including remote control of device operation, impersonation of user behavior, and splitting funds for cross-regional transfers. To address these risks, the industry has developed risk identification technologies based on data mining and machine learning. By analyzing user transaction data, device operation records, and other information to build risk assessment models, the technology aims to detect and intercept fraudulent activities in advance and ensure the security of financial transactions.

[0003] Currently, financial fraud risk is primarily identified through two approaches: one is based on user device operation data, such as touch traces and click frequency, extracting operational characteristics and comparing them with historical normal behavior to identify abnormal operations; the other is based on account fund transaction data, such as transaction amount, frequency, and recipients, to analyze abnormal fund flows by constructing a fund network model. Some technologies combine these two types of data, but most of them simply superimpose features and lack in-depth correlation analysis between operational behavior, fund flows, and environmental information.

[0004] Existing technologies have fundamental limitations in overall solution design, making it difficult to address the core challenges of complex fraud scenarios: there is a lack of systematic characterization of risk characteristics, and the biometric characteristics of operational behavior, the network characteristics of capital flow, and the environmental characteristics of the equipment are not analyzed as an organic whole, resulting in insufficient ability to identify multi-dimensional collaborative fraud behaviors; there are gaps in the tracking of risk transmission paths, and it is impossible to dynamically correlate the evolution of operational anomalies and financial risks, making it difficult to capture the risk diffusion patterns from the operational level to the financial level; there is insufficient attention paid to the correlation between environmental factors and behavioral characteristics, and the verification role of the physical environment around the equipment in verifying the authenticity of the operation is ignored, resulting in limited accuracy in identifying remote theft and fraud in abnormal environments. Summary of the Invention

[0005] The purpose of the present invention is to provide a real-time anti-fraud monitoring method and system for financial transactions, aiming to solve the technical problems existing in the prior art identified in the background technology.

[0006] The present invention is implemented as follows: a real-time anti-fraud monitoring method for financial transactions, the method comprising: Real-time collection of user device interaction data, including touch track coordinate sequence, pressure value sequence, three-axis acceleration data and interface operation event stream; Extracting a spectral feature vector of the operation curvature change based on the touch trajectory coordinate sequence, and identifying a period of missing routine verification steps and a device silent state interval based on the three-axis acceleration data and the interface operation event stream; Based on the operational curvature change spectrum feature vector and in combination with the real-time account fund transaction data, the local entropy growth rate caused by a single transaction and the spatial distribution of the fund network temperature gradient are dynamically calculated to generate an entropy change index; Setting a curvature detection threshold based on the entropy change index, and using the adjusted curvature detection threshold to detect the spectral feature vector of the operation curvature change, performing multi-scale pattern matching on the silent state interval of the device, and obtaining device peripheral signal data based on the interface operation event stream; The acquired device peripheral signal data is fused with the pressure value sequence through spatiotemporal convolution to perform stress testing. The operation curvature change spectrum feature vector, entropy change index, and stress test results are subjected to spatiotemporal correlation analysis to identify multi-dimensional abnormal signals and generate cross-scale risk warning instructions.

[0007] As a further solution of the present invention, the identification of the period of absence of the conventional verification step and the device silent state interval specifically includes: The touch trajectory coordinate sequence is smoothed and converted into a frequency domain signal. The amplitude, phase, and main frequency components of the curvature change in the 0-5 Hz frequency band are extracted to construct the spectral feature vector of the operation curvature change. Compare the operation event sequence of the preset normal verification process, calculate the deviation between the interface operation event flow and the operation event sequence, mark the period where the deviation exceeds 30% and lasts for more than 10 seconds, and obtain the period where the regular verification step is missing; The monitoring device has no interface operation events for 3 consecutive seconds, and the absolute values ​​of the three-axis acceleration are all less than 0.02g. The start time, duration and last operation type before the end of the time interval are recorded to obtain the device silent state interval.

[0008] As a further solution of the present invention, the dynamic calculation of the local entropy growth rate and the spatial distribution of the capital network temperature gradient caused by a single transaction to generate an entropy change index specifically includes: Based on the discreteness of the eigenvector of the operational curvature change spectrum, combined with the amount of a single transaction, the relevance of the transaction object, and the historical transaction frequency, the entropy change rate is calculated every 100ms to obtain a continuous local entropy growth rate curve. The capital transaction network where the account resides is abstracted into a graph structure consisting of nodes and edges. Using the node transaction activity and edge weight as parameters, the node activity index of each node is calculated using the heat conduction equation. This generates a temperature gradient matrix with geographical regions as the dimension, and the spatial distribution of the temperature gradient of the capital network is obtained. The peak value of the local entropy growth rate curve and the maximum change in the temperature gradient of the capital network are weighted and fused to obtain a quantitative index of 0-10 to generate an entropy change index.

[0009] As a further solution of the present invention, performing multi-scale pattern matching on the device silent state interval specifically includes: Based on the entropy change index distribution of historical normal transactions, the amplitude of the operational curvature change spectrum feature vector corresponding to the 95% percentile value is taken as the initial threshold. Then, it is dynamically adjusted according to the real-time entropy change index to set the curvature detection threshold. The device silence interval is segmented using 10s, 30s, and 60s time windows. The device status features within each segmented window are extracted and matched against the silence patterns in the historical sample library using cosine similarity. The silence patterns are characteristic patterns that appear in the historical sample library and match the device silence interval. Windows with a matching degree exceeding 0.8 are recorded, and multi-scale pattern matching is performed on the device silence interval. Based on the timestamp synchronization trigger collection of the interface operation event stream, the surrounding APs are scanned every 5 seconds, and the addresses and signal strengths are recorded to form a WiFi signal strength matrix. The magnetometer collects three-dimensional components once a second, calculates the fluctuation amplitude, and obtains the geomagnetic field intensity fluctuation sequence. The photosensor obtains the light intensity distribution in the 400-700nm band and obtains the ambient light spectrum data.

[0010] As a further solution of the present invention, the performing of the stress test specifically includes: The WiFi signal strength matrix, geomagnetic field intensity fluctuation sequence, ambient light spectrum data, and pressure value sequence are used as input. Three convolutional layers are used to extract spatiotemporal correlation features. The fused feature tensor is output and then subjected to spatiotemporal convolution fusion. Based on the entropy change indicator, three risk levels of low, medium and high are set, and the disturbance of the capital path under the corresponding levels is simulated respectively, and the stress test results are obtained by execution.

[0011] As a further solution of the present invention, the above-mentioned spatiotemporal correlation analysis, identification of multi-dimensional abnormal signals, and generation of cross-scale risk warning instructions specifically include: Analyze the correlation between the operational curvature change spectrum feature vector, entropy change index, and stress test results in the time dimension, and analyze the spatial correlation between the stress test results and environmental spectral data; Set the operational curvature change spectrum feature vector, the abnormal threshold of the entropy change index, and the abnormal threshold of the stress test result respectively, mark the abnormality of single indicators and the coordinated abnormality of multiple indicators, and identify multi-dimensional abnormal signals; Basis: Single indicator abnormality is low risk, two indicator abnormalities are medium risk, and three indicator abnormalities are high risk. The severity of the abnormal signal is judged, and a cross-scale risk warning instruction is generated based on the severity.

[0012] Another object of the present invention is to provide a real-time anti-fraud monitoring system for financial transactions, the system comprising: The real-time data acquisition module is used to collect user device interaction data in real time, including touch track coordinate sequence, pressure value sequence, three-axis acceleration data and interface operation event stream; a curvature feature extraction module for extracting a characteristic vector of a frequency spectrum of an operation curvature change based on the touch trajectory coordinate sequence, and identifying periods of missing routine verification steps and periods of device silence based on the three-axis acceleration data and the interface operation event stream; An entropy change index calculation module is used to dynamically calculate the local entropy growth rate and the temperature gradient spatial distribution of the capital network caused by a single transaction based on the operational curvature change spectrum feature vector and the real-time account capital transaction data to generate an entropy change index; a curvature detection module, configured to set a curvature detection threshold based on an entropy change indicator, detect a spectral feature vector of an operation curvature change using the adjusted curvature detection threshold, perform multi-scale pattern matching on the device's silent state interval, and acquire device peripheral signal data based on an interface operation event stream; The pressure value convolution fusion module is used to perform spatiotemporal convolution fusion of the acquired device peripheral signal data and the pressure value sequence to perform pressure testing; The risk warning generation module is used to perform spatiotemporal correlation analysis on the operational curvature change spectrum feature vector, entropy change index, and stress test results, identify multi-dimensional abnormal signals, and generate cross-scale risk warning instructions.

[0013] The beneficial effects of the present invention are: The present invention regards device operation behavior, capital network dynamics and physical environment characteristics as interrelated risk carriers rather than isolated analysis objects. From the data collection stage, it covers multi-dimensional interactive information such as touch trajectory, pressure change, device movement and operation events, providing three-dimensional original materials for subsequent analysis. This comprehensiveness ensures that risk signals will not be missed due to data loss. On this basis, by extracting the spectral characteristics of the operation curvature, the microscopic operation habits are converted into quantifiable biometric codes. At the same time, combined with the verification process compliance and the device silent mode analysis, the initial risk portrait is constructed from three levels: how the operation is performed, whether it complies with the specifications, and whether the pause is abnormal. This multi-perspective feature extraction avoids the one-sidedness of a single behavioral feature.

[0014] The solution deeply integrates operational characteristics with the dynamics of the capital network. It uses the local entropy growth rate to capture the immediate transmission of operational anomalies to capital risks, leverages the capital network's temperature gradient to reflect the spatial diffusion of risk, and uses the entropy change indicator to quantitatively integrate the two. This design enables risk assessment to both pinpoint the source of the operation and track the systemic impact at the capital level, resolving the disconnect between operational and capital analysis in traditional techniques. The combination of dynamic threshold adjustment, multi-scale silent pattern matching, and environmental signal acquisition enables risk detection to adapt to changes in risk levels in real time. It also verifies the authenticity of risks through physical environmental characteristics, effectively distinguishing between accidental operational errors and substantial fraud.

[0015] By integrating multi-dimensional risk signals from operations, funds, and the environment through spatiotemporal correlation analysis, and combining multi-indicator collaborative anomaly identification with graded early warning, the entire risk identification process forms a closed loop, from capturing subtle operational anomalies to verifying fluctuations in the fund network, and then confirming risk scenarios based on environmental characteristics, ultimately outputting targeted disposal instructions. This comprehensive, multi-dimensional, and dynamic approach not only improves the accuracy of fraud risk identification, but also adapts to the concealment and complexity of diverse fraud methods, achieving an upgrade from passive defense to active early warning, providing systematic protection for financial transaction security. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A flowchart of a real-time anti-fraud monitoring method for financial transactions provided by an embodiment of the present invention; Figure 2 A flowchart for identifying periods of missing routine verification steps and device silent state intervals provided by an embodiment of the present invention; Figure 3 A flow chart for generating an entropy change index provided by an embodiment of the present invention; Figure 4 A flowchart of performing multi-scale pattern matching on the silent state interval of the device provided in an embodiment of the present invention; Figure 5 A flowchart of performing a stress test according to an embodiment of the present invention; Figure 6 A flowchart of generating cross-scale risk warning instructions provided by an embodiment of the present invention; Figure 7 This is a structural block diagram of a real-time anti-fraud monitoring system for financial transactions provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0018] Figure 1 A flowchart of a real-time anti-fraud monitoring method for financial transactions provided by an embodiment of the present invention is shown in FIG. Figure 1 As shown, the method includes: S100 collects user device interaction data in real time, including touch track coordinate sequence, pressure value sequence, three-axis acceleration data and interface operation event stream; For the touch track coordinate sequence, a high-frequency sampling frequency of 200Hz is used to continuously record the X / Y coordinates on the device screen, generating a coordinate point every 5ms. The start and end timestamps of the track are also synchronously marked, and the screen area where the track is located is precisely demarcated. This high-frequency sampling design is designed to capture the subtle dynamic characteristics of user finger operations, including arc changes and speed fluctuations in natural sliding. These characteristics are often closely related to the user's physiological habits and are essential data for distinguishing genuine users from fraudsters.

[0019] The pressure value sequence is collected using the device's built-in capacitive pressure sensor, which captures the pressure applied to the screen in real time at a frequency of 100Hz. Each pressure value is then correlated with the rate of change of pressure at the corresponding coordinate point. This approach aims to fill in the information gaps in the coordinate trajectory through dynamic changes in the pressure dimension. While real users naturally adjust their pressure based on their intended operation, fraudulent activity often exhibits abnormal characteristics, such as uniform or sudden changes in pressure distribution. Recording the rate of change of pressure can further amplify these differences.

[0020] Three-axis acceleration data is collected using a MEMS accelerometer. A 50Hz sampling frequency ensures real-time capture of the device's motion while avoiding redundant data. High-frequency noise with an amplitude less than 0.05g is filtered out to ensure that only meaningful device motion information (such as slight shaking of the user holding the device or its stable state when placed on a desktop) is retained. This provides a basis for subsequent identification of the device's silent state interval. Without noise filtering, interference from environmental vibrations could lead to misjudgment of the device's static state, affecting the accuracy of silent mode matching.

[0021] The collection of interface operation event streams focuses on recording all details of user interaction behaviors on the interface, including operation types such as clicks, slides, and inputs, the control ID that triggers the operation, the duration of the operation, and the interval between two adjacent operations.

[0022] S200, extracting a characteristic vector of a frequency spectrum of an operation curvature change based on the touch trajectory coordinate sequence, and identifying a period of missing routine verification steps and a device silent state interval based on the three-axis acceleration data and the interface operation event stream; When extracting the spectral feature vector of the operation curvature change, the touch trajectory coordinate sequence collected in S100 is first smoothed. This step filters out the high-frequency noise in the trajectory, making the trajectory curve closer to the actual operation intention and avoiding the interference of accidental fluctuations on feature extraction; then, the continuous coordinate points in the time domain are converted into frequency domain signals through Fourier transform, and the curvature change of the spatial trajectory is decomposed into components of different frequencies. The amplitude, phase and main frequency components of the 0-5Hz frequency band are extracted. This is because the natural frequency of human hand operations is usually in this range. Fraudulent behavior often manifests as spectral disorder or main frequency offset in this frequency band. The construction of a 128-dimensional feature vector is to systematize these spectral features and form a quantifiable operation biometric code, thereby realizing the implicit identification of the identity of the operating subject.

[0023] The process of identifying the period of missing routine verification steps is based on the preset normal verification process operation event sequence. This sequence is generated by analyzing the verification process of a large number of historical risk-free transactions, including the time sequence relationship of necessary steps such as SMS verification code input and fingerprint verification. The deviation of the real-time interface operation event stream from the benchmark sequence is calculated using the dynamic time warping (DTW) algorithm. It is used to solve the problem of inconsistent lengths of two sequences (for example, the normal process may be slightly longer due to network delay), and divided by Normalization eliminates the impact of sequence length differences, objectively reflecting the degree of deviation between real-time operations and standard processes. Marking periods of significant and persistent deviation aims to capture process shortcuts, a common phenomenon in fraudulent activity. To expedite operations, fraudsters often skip key verification steps. These deviations are not accidental fluctuations but rather signals of deliberate risk evasion. This process can identify such anomalies in real time during ongoing operations, providing early clues for risk warnings.

[0024] When identifying the device's silent state interval, the system monitors periods of 3 consecutive seconds without any interface operation events and with the absolute value of the three-axis acceleration less than 0.02g. The 3-second duration setting is sufficient to distinguish brief pauses in normal operation and capture abnormal silence with fraudulent characteristics. The three-axis acceleration threshold setting is used to eliminate interference caused by slight shaking of the device by the user, ensuring that the judgment of silence is based on the stable state of the device.

[0025] The start time, duration, and last operation type before the end of the recording interval are used to correlate the silent state with the preceding and following operations. Silence during normal use is often related to user decisions, while silence in fraudulent scenarios often accompanies preparations for abnormal operations. These details can be used to further distinguish the nature of the silence.

[0026] like Figure 2 As shown, the identification of the missing period of the conventional verification step and the device silent state interval specifically includes: S210 , smoothing the touch trajectory coordinate sequence and converting it into a frequency domain signal, extracting the amplitude, phase, and main frequency component of the curvature change in the 0-5 Hz frequency band, and constructing a frequency spectrum feature vector of the operation curvature change; S220, comparing the operation event sequence of the preset normal verification process, and calculating the deviation between the interface operation event flow and the operation event sequence: ; in, Represents the real-time collected interface operation event stream (including the event sequence of operation type, control ID, etc.), Represents the operational event sequence of the preset normal verification process (a standard event sequence extracted from historical risk-free transactions), is the dynamic time warping distance between the two sequences, and are the lengths of the two sequences respectively; S230, marking the period when the deviation exceeds 30% and lasts for more than 10 seconds, and obtaining the period when the routine verification step is missing; S240: The monitoring device has no interface operation events for 3 consecutive seconds, and the absolute values ​​of the three-axis acceleration are all less than 0.02g. The start time, duration, and last operation type before the end of the time interval are recorded to obtain the device silent state interval.

[0027] S300, based on the operational curvature change spectrum feature vector and in combination with the real-time acquired account fund transaction data, dynamically calculate the local entropy growth rate caused by a single transaction and the spatial distribution of the fund network temperature gradient to generate an entropy change index; Based on the discreteness of the spectral feature vector of the operation curvature variation extracted in S200, combined with the transaction amount, transaction object association, and historical transaction frequency, the entropy change rate is calculated every 100ms. Entropy here essentially reflects the degree of disorder in the operation characteristics. Normal users have relatively stable operating habits, low discreteness in curvature characteristics, and gradual entropy changes. Fraudulent behavior, on the other hand, is often accompanied by sudden changes in operation characteristics, resulting in a sudden increase in discreteness and a faster entropy growth rate. Incorporating key transaction attributes (amount, object, and frequency) into the calculation ensures that the entropy growth rate not only reflects anomalies in the operation itself but also correlates with the transaction's risk level. This allows the local entropy growth rate to capture both operational anomalies and the risk exposure of the transaction itself.

[0028] When constructing the spatial distribution of the temperature gradient of a capital network, we first abstract the capital transaction network within which an account resides into a graph structure consisting of nodes (accounts) and edges (transaction relationships). This abstraction aims to transform complex capital flow relationships into a computable network model. Using the node's transaction activity (number of transactions in the last 24 hours, reflecting account activity) and edge weight (percentage of transaction value, reflecting transaction importance) as parameters, we calculate the node activity index for each node using the heat conduction equation. This essentially simulates the heat propagation of capital flows: active nodes (high-frequency trading accounts) transfer activity to connected nodes like a heat source, and large transactions (high-weight edges) accelerate this transfer.

[0029] Generating a temperature gradient matrix with geographical regions as the dimension is to associate this network activity with physical space, and reflect the flow trend of funds in different regions through gradient changes: under normal circumstances, the temperature gradient of the capital network presents a smooth distribution that matches economic activities; while fraudulent fund transfers often break this smoothness, forming abnormal areas with sudden local temperature rises or gradient changes.

[0030] When generating the entropy change index, the peak of the local entropy growth rate curve and the maximum change in the capital network temperature gradient are weighted and integrated to produce a quantitative indicator ranging from 0 to 10. The logic behind this integration is that the local entropy growth rate reflects immediate operational risk, while changes in the capital network temperature gradient reflect systemic risk at the capital flow level. The weighted combination of the two allows for the superposition of risks from micro-operational anomalies and macro-capital anomalies.

[0031] The weighting (with a higher weight for local entropy increase) reflects that operational anomalies are the source of risk. Operational anomalies often precede capital anomalies, providing an earlier warning of risk. Capital network anomalies, on the other hand, can verify whether operational anomalies have translated into substantial capital risk. When the local entropy growth rate reaches its peak due to operational anomalies, if the change in the capital network temperature gradient is minimal, it may be an operational error or temporary disruption. However, if both increase significantly simultaneously, it is highly likely that risk transmission is caused by fraudulent activity. At this point, the entropy change indicator will jump to a higher level, providing a clear quantitative basis for subsequent risk assessment.

[0032] like Figure 3 As shown, the dynamic calculation of the local entropy growth rate and the temperature gradient spatial distribution of the capital network caused by a single transaction generates an entropy change index, which specifically includes: S310, based on the discreteness of the eigenvector of the operational curvature change spectrum, combined with the amount of a single transaction, the relevance of the transaction object, and the historical transaction frequency, calculate the entropy value change rate every 100ms to obtain a continuous local entropy growth rate curve: ; in, for The information entropy of the moment, , is the eigenvector of the operating curvature change spectrum The probability density of the components (obtained by normalizing the eigenvectors), It is the sampling interval, reflecting the rate of change of the discreteness of the operation characteristics within every 100ms, and indirectly reflects the stability of the transaction behavior.

[0033] S320: The fund transaction network where the account is located is abstracted into a graph structure consisting of nodes and edges. The node activity index of each node is calculated using the heat conduction equation, with the transaction activity of the node and the weight of the edge as parameters: ; in, For the The activity index of each account node, is the weight coefficient, take 0.6, It is The number of transactions per account node in the past 24 hours, is the maximum number of transactions per node in the network, It is with The set of edges connecting account nodes, It's the edge The transaction amount, It is the total amount of all transactions in the network.

[0034] Generate a temperature gradient matrix with geographic area as the dimension: ; in, For geographic coordinates The temperature gradient vector at The geographic coordinates obtained by spatial interpolation The activity index, and The activity change rates in the east-west and north-south directions are shown. The matrix dimensions are consistent with the geographic partitioning accuracy.

[0035] Obtain the spatial distribution of temperature gradient of capital network; S330, weighted fusion is performed on the peak value of the local entropy growth rate curve and the maximum change in the capital network temperature gradient to obtain a quantitative index of 0-10, generating an entropy change index: ; in, is the entropy change index (range 0-10), is the peak value of the local entropy growth rate curve, is the peak value of the maximum entropy growth rate in historical data, is the maximum change in the temperature gradient of the capital network, It is the reference gradient change (taken as the historical 95% percentile value). The entropy change characteristics of the two dimensions are integrated into a unified indicator through weighted normalization.

[0036] S400: Setting a curvature detection threshold based on an entropy change indicator, detecting a frequency spectrum feature vector of an operation curvature change using the adjusted curvature detection threshold, performing multi-scale pattern matching on the device's silent state interval, and acquiring device peripheral signal data based on an interface operation event stream. Using the entropy change indicator distribution of historically normal transactions as a benchmark, the amplitude of the eigenvector of the operational curvature change spectrum corresponding to the 95th percentile value was selected as the initial threshold. This benchmark was chosen to anchor the characteristic boundaries of most normal operations, ensuring that the initial threshold effectively filters out normal fluctuations while not missing potential risks due to excessive leniency. Dynamically adjusting the threshold based on the real-time entropy change indicator is crucial to dynamically adjust detection sensitivity based on risk level. When the entropy change indicator indicates a high transaction risk, lowering the threshold can more sensitively capture subtle curvature anomalies and avoid missed detections in high-risk scenarios. When the risk is lower, a higher threshold reduces the probability of normal operations being misclassified as anomalies. This dynamic adjustment mechanism ensures that the detection process is more aligned with the real-time risk situation.

[0037] When performing multi-scale pattern matching on device silence intervals, we use three time windows of 10s, 30s, and 60s to segment the intervals. This multi-scale design is based on the varying durations of silence in different fraud scenarios: in remote control fraud, the gaps between control command transmissions may manifest as brief silences of 10-30 seconds; whereas in group fraud, waiting for instructions from accomplices may result in longer silences of 60s or more. This multi-scale window approach comprehensively captures silence characteristics of varying durations, avoiding the omission of features often associated with a single window scale.

[0038] After extracting the device status features within each window, cosine similarity matching is performed with the silent patterns in the historical sample library. The historical sample library contains typical features of the device silent period in known fraud cases. Cosine similarity quantifies the vector angle between real-time features and sample features to objectively judge the similarity between the two. Windows with a matching degree exceeding 0.8 are recorded. The purpose is to screen out abnormal silent intervals that are highly similar to known fraud patterns and provide a behavioral pattern-level basis for risk judgment.

[0039] The acquisition is triggered synchronously based on the timestamps of the interface operation event stream. This time synchronization mechanism ensures the temporal correlation between signal data and operational behavior, allowing subsequent analysis to match environmental characteristics with operational characteristics in the time dimension. Specifically, the WiFi signal strength matrix constructed by scanning the surrounding APs every 5 seconds can reflect the network environment in which the device is located; the sequence of geomagnetic field intensity fluctuations collected every second can capture subtle changes in the physical location of the device (whether it is in a fixed location); the ambient light spectrum data in the 400-700nm band can assist in determining the lighting environment in which the device is located and whether it can recognize faces, etc. These signal data can provide the physical environment characteristics of the device, and form cross-verification with operational characteristics and silent mode. Normal operation is usually accompanied by stable environmental signals, while fraudulent behavior often causes significant changes in surrounding signals, thereby adding verification evidence of the environmental dimension to risk identification.

[0040] like Figure 4 As shown, performing multi-scale pattern matching on the silent state interval of the device specifically includes: S410, using the entropy change index distribution of historical normal transactions as a benchmark, taking the amplitude of the operational curvature change spectrum feature vector corresponding to the 95th percentile value as the initial threshold, and then dynamically adjusting it according to the real-time entropy change index to set the curvature detection threshold; S420: Segment the device silence interval using 10s, 30s, and 60s time windows, extract device status features within each segmented window, and perform cosine similarity matching with silence patterns in the historical sample library. A silence pattern is a characteristic pattern that appears in the historical sample library and corresponds to the device silence interval. Window windows with a matching degree exceeding 0.8 are recorded, and multi-scale pattern matching is performed on the device silence interval. S430, based on the timestamp synchronization trigger collection of the interface operation event stream, scans the surrounding APs every 5 seconds, records the addresses and signal strengths to form a WiFi signal strength matrix; uses the magnetometer to collect three-dimensional components once a second, calculates the fluctuation amplitude, and obtains the geomagnetic field intensity fluctuation sequence; uses the photosensor to obtain the light intensity distribution in the 400-700nm band and obtains the ambient light spectrum data.

[0041] S500: Perform spatiotemporal convolution fusion of the acquired device peripheral signal data and the pressure value sequence to perform a pressure test; The WiFi signal strength matrix acquired in S400, the geomagnetic field intensity fluctuation sequence, the ambient light spectrum data, and the pressure value sequence collected in S100 are combined as inputs for feature extraction through three convolutional layers. The WiFi signal strength matrix reflects the device's network environment, the geomagnetic field intensity fluctuation sequence implies changes in the device's physical location, the ambient light spectrum data reflects the characteristics of the lighting environment, and the pressure value sequence records the changes in force during operation.

[0042] These four types of data belong to different dimensions: network environment, physical space, lighting conditions, and operating force. It's difficult to capture their correlations when analyzed individually. The 3D convolutional layer, however, uses a sliding window to extract the co-variation characteristics of these different data across time and space. When a normal user operates in a typical environment, the WiFi signal is stable, the geomagnetic field fluctuates slightly, the ambient light matches the operating time period, and the pressure value varies regularly with the type of operation. These features, after convolutional fusion, form a stable feature tensor. In fraud scenarios, however, unfamiliar WiFi signals, sudden changes in the geomagnetic field (the device has been moved), ambient light inconsistent with the typical time period, and erratic pressure changes may occur. The fused feature tensor will exhibit significant anomalies. This fusion design aims to break down data silos and integrate dispersed environmental and operating features into comprehensive features that reflect the reality of the scenario, providing more comprehensive input for subsequent risk simulations.

[0043] During stress testing, the system first categorizes transactions into three risk levels: low, medium, and high, based on the entropy change index generated by the S300. This categorization relies on the entropy change index's quantitative assessment of current transaction risk, aligning the intensity of the stress test with the actual risk landscape. A low entropy change index indicates a low risk level, resulting in less simulated disturbances in the simulated funds flow. A high entropy change index indicates a high risk level, resulting in more complex disturbances. Specifically, the low risk level simulates abnormal single transaction amounts, the medium risk level simulates abnormal cross-regional transfer frequencies, and the high risk level simulates chained transfers across multiple accounts. These simulations are based on common fund operation patterns seen in real fraud cases. By perturbing the funds flow, the system observes changes in the correlation between the fused feature tensor and the fund flow pattern, ultimately generating stress test results. The core purpose of this system is to proactively simulate risk scenarios, verifying the abnormal behavior of current transactions under different risk stresses, and determining whether they exhibit typical characteristics of fraudulent activity. While legitimate transactions typically exhibit robust resistance to disturbances during stress testing, fraudulent transactions exhibit significant abnormal responses under specific risk scenarios.

[0044] like Figure 5 As shown, the execution of the stress test specifically includes: S510 takes the WiFi signal strength matrix, the geomagnetic field intensity fluctuation sequence, the ambient light spectrum data, and the pressure value sequence as input, extracts spatiotemporal correlation features through three convolutional layers, and outputs a fused feature tensor for spatiotemporal convolution fusion. S520 sets three risk levels: low, medium, and high, based on the entropy change indicator. The capital path disturbances under the corresponding levels are simulated and the stress test results are obtained: ; in, is the stress test result (risk score, ranging from 0 to 10), is the weight coefficient, take 0.5, Is the simulated trading path The historical normal path The similarity of (normalized by path edit distance), is the fused feature tensor With the base feature tensor The Euclidean distance (obtained by normalizing the maximum distance) is calculated by combining path deviation and feature anomaly to quantify transaction risks at different risk levels.

[0045] S600: Performing spatiotemporal correlation analysis on the operational curvature change spectrum feature vector, entropy change index, and stress test results to identify multi-dimensional abnormal signals and generate cross-scale risk warning instructions.

[0046] Using a time series association rule algorithm, we can uncover the inherent temporal connections between the spectral feature vectors of operational curvature changes, entropy change indicators, and stress test results. By analyzing the temporal relationship between a sudden increase in the entropy change indicator and an abnormal operational curvature, or the synchronization between abnormal stress test results and the previous two, this temporal correlation can capture the transmission path of risk signals.

[0047] In normal trading, fluctuations in various indicators tend to be independent and gradual. However, in fraudulent activity, operational anomalies often precede changes in financial risk indicators, forming a traceable time series. Furthermore, spatial clustering (such as DBSCAN) can be used to analyze the spatial correlation between stress test results and environmental spectral data. For example, it can determine whether high-risk stress test results are concentrated in specific Wi-Fi environments or geomagnetic field regions. This spatial correlation can verify whether risks are tied to abnormal environments and avoid misinterpreting isolated indicator fluctuations as systemic risks. This dual-dimensional analysis design, encompassing both time and space, overcomes the limitations of single-dimensional analysis, enabling both the temporal evolution of risk and the spatial distribution of risk, providing a comprehensive analytical framework for anomaly identification.

[0048] When identifying multi-dimensional abnormal signals, it's necessary to set anomaly thresholds for the operational curvature change spectrum feature vector, entropy change indicator, and stress test results. These thresholds are not fixed values ​​but are dynamically adjusted based on the distribution of historically normal trading patterns and risk tolerance.

[0049] The threshold for the operational curvature feature must be able to distinguish between natural operational fluctuations and deliberately simulated abnormal trajectories. The threshold for the entropy change indicator must reflect the degree of coordinated disorder between the capital network and the operational characteristics. The threshold for the stress test results must correspond to the tolerance for path perturbations at different risk levels. While flagging single-indicator anomalies can capture localized risk points, flagging coordinated anomalies across multiple indicators can identify systemic risks. This design aims to avoid misjudgments caused by single-indicator anomalies while improving the reliability of risk identification through multi-indicator collaborative verification.

[0050] In normal transactions, abnormal operation curvature may occur due to temporary operational inexperience, but the entropy change indicator and stress test results are stable. In this case, only a single indicator is marked as abnormal. In fraud scenarios, there is often a coordinated phenomenon of abnormal operation curvature, a sudden increase in entropy change indicators, and disordered stress test results. Multi-indicator abnormality marking can accurately capture this systemic risk.

[0051] When generating cross-scale risk warning instructions, the severity of the abnormal signal must be graded: a single-indicator abnormality corresponds to low risk, two-indicator abnormalities correspond to medium risk, and three-indicator abnormalities correspond to high risk. This grading is not a simple summation of numbers, but rather is based on the weight of each indicator in risk transmission. Operational curvature abnormalities reflect source operational risk, entropy change indicators reflect financial network risk, and stress test results reflect scenario resistance risk. The superposition of multiple-indicator abnormalities means that the risk has spread from the local level to the system level. The instruction content must include the abnormality type, the time period of occurrence, the characteristics of the associated equipment, and the disposal recommendations (such as suspending trading and triggering secondary verification). Its purpose is to provide risk control personnel or systems with specific and executable response plans, achieving a closed loop from risk identification to risk disposal.

[0052] Specifically: For low-risk warnings, only enhanced monitoring is prompted; for medium-risk warnings, additional verification (face recognition) is required; for high-risk warnings, transactions are directly suspended and security checks are triggered. This graded response can effectively prevent and control risks while reducing interference with normal transactions.

[0053] like Figure 6 As shown, the spatiotemporal correlation analysis is performed to identify multi-dimensional abnormal signals and generate cross-scale risk warning instructions, specifically including: S610, analyzing the correlation between the operational curvature change spectrum feature vector, the entropy change index, and the stress test result in the time dimension, and simultaneously analyzing the spatial correlation between the stress test result and the environmental spectrum data; S620: Set the operational curvature change spectrum feature vector, the abnormal threshold of the entropy change index, and the abnormal threshold of the stress test result, mark single-indicator abnormalities and multi-indicator coordinated abnormalities, and identify multi-dimensional abnormal signals; S630, based on: single indicator abnormality is low risk, two indicator abnormalities are medium risk, and three indicator abnormalities are high risk, judge the severity of the abnormal signal and generate a cross-scale risk warning instruction based on the severity.

[0054] Figure 7 A structural block diagram of a real-time anti-fraud monitoring system for financial transactions provided by an embodiment of the present invention is shown in FIG. Figure 7 As shown, the system includes: The real-time data acquisition module 100 is used to collect user device interaction data in real time, including touch track coordinate sequence, pressure value sequence, three-axis acceleration data and interface operation event stream; The curvature feature extraction module 200 is used to extract the spectral feature vector of the operation curvature change based on the touch trajectory coordinate sequence, and to identify the period of missing routine verification steps and the device silent state interval based on the three-axis acceleration data and the interface operation event stream; An entropy change index calculation module 300 is configured to dynamically calculate the local entropy growth rate and the temperature gradient spatial distribution of the capital network caused by a single transaction based on the operational curvature change spectrum feature vector and in combination with the account fund transaction data acquired in real time, thereby generating an entropy change index; a curvature detection module 400 for setting a curvature detection threshold based on an entropy change indicator, detecting a spectral feature vector of an operation curvature change using the adjusted curvature detection threshold, performing multi-scale pattern matching on the device's silent state interval, and acquiring device peripheral signal data based on an interface operation event stream; The pressure value convolution fusion module 500 is used to perform spatiotemporal convolution fusion on the acquired device peripheral signal data and the pressure value sequence to perform pressure testing; The risk warning generation module 600 is used to perform spatiotemporal correlation analysis on the operational curvature change spectrum feature vector, entropy change index, and stress test results, identify multi-dimensional abnormal signals, and generate cross-scale risk warning instructions.

[0055] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0056] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

[0057] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A real-time anti-fraud monitoring method for financial transactions, characterized in that: The method comprises: Real-time collection of user device interaction data, including touch track coordinate sequence, pressure value sequence, three-axis acceleration data and interface operation event stream; Extracting a spectral feature vector of the operation curvature change based on the touch trajectory coordinate sequence, and identifying a period of missing routine verification steps and a device silent state interval based on the three-axis acceleration data and the interface operation event stream; Based on the operational curvature change spectrum feature vector and in combination with the real-time account fund transaction data, the local entropy growth rate caused by a single transaction and the spatial distribution of the fund network temperature gradient are dynamically calculated to generate an entropy change index; Setting a curvature detection threshold based on the entropy change index, and using the adjusted curvature detection threshold to detect the spectral feature vector of the operation curvature change, performing multi-scale pattern matching on the silent state interval of the device, and obtaining device peripheral signal data based on the interface operation event stream; The acquired device peripheral signal data is fused with the pressure value sequence through spatiotemporal convolution to perform stress testing. The operation curvature change spectrum feature vector, entropy change index, and stress test results are subjected to spatiotemporal correlation analysis to identify multi-dimensional abnormal signals and generate cross-scale risk warning instructions.

2. The method according to claim 1, characterized in that The identification of the period of missing routine verification steps and the device silent state period specifically includes: The touch trajectory coordinate sequence is smoothed and converted into a frequency domain signal. The amplitude, phase, and main frequency components of the curvature change in the 0-5 Hz frequency band are extracted to construct the spectral feature vector of the operation curvature change. Compare the operation event sequence of the preset normal verification process, calculate the deviation between the interface operation event flow and the operation event sequence, mark the period where the deviation exceeds 30% and lasts for more than 10 seconds, and obtain the period where the regular verification step is missing; The monitoring device has no interface operation events for 3 consecutive seconds, and the absolute values ​​of the three-axis acceleration are all less than 0.02g. The start time, duration and last operation type before the end of the time interval are recorded to obtain the device silent state interval.

3. The method according to claim 2, characterized in that The dynamic calculation of the local entropy growth rate and the temperature gradient spatial distribution of the capital network caused by a single transaction generates an entropy change index, specifically including: Based on the discreteness of the eigenvector of the operational curvature change spectrum, combined with the amount of a single transaction, the relevance of the transaction object, and the historical transaction frequency, the entropy change rate is calculated every 100ms to obtain a continuous local entropy growth rate curve. The capital transaction network where the account resides is abstracted into a graph structure consisting of nodes and edges. Using the node transaction activity and edge weight as parameters, the node activity index of each node is calculated using the heat conduction equation. This generates a temperature gradient matrix with geographical regions as the dimension, and the spatial distribution of the temperature gradient of the capital network is obtained. The peak value of the local entropy growth rate curve and the maximum change in the temperature gradient of the capital network are weighted and fused to obtain a quantitative index of 0-10 to generate an entropy change index.

4. The method according to claim 3, characterized in that The performing multi-scale pattern matching on the silent state interval of the device specifically includes: Based on the entropy change index distribution of historical normal transactions, the amplitude of the operational curvature change spectrum feature vector corresponding to the 95% percentile value is taken as the initial threshold. Then, it is dynamically adjusted according to the real-time entropy change index to set the curvature detection threshold. The device silence interval is segmented using 10s, 30s, and 60s time windows. The device status features within each segmented window are extracted and matched against the silence patterns in the historical sample library using cosine similarity. The silence patterns are characteristic patterns that appear in the historical sample library and match the device silence interval. Windows with a matching degree exceeding 0.8 are recorded, and multi-scale pattern matching is performed on the device silence interval. Based on the timestamp synchronization trigger collection of the interface operation event stream, the surrounding APs are scanned every 5 seconds, and the addresses and signal strengths are recorded to form a WiFi signal strength matrix. The magnetometer collects three-dimensional components once a second, calculates the fluctuation amplitude, and obtains the geomagnetic field intensity fluctuation sequence. The photosensor obtains the light intensity distribution in the 400-700nm band and obtains the ambient light spectrum data.

5. The method according to claim 4, characterized in that The execution of the stress test specifically includes: The WiFi signal strength matrix, geomagnetic field intensity fluctuation sequence, ambient light spectrum data, and pressure value sequence are used as input. Three convolutional layers are used to extract spatiotemporal correlation features. The fused feature tensor is output and then subjected to spatiotemporal convolution fusion. Based on the entropy change indicator, three risk levels of low, medium and high are set, and the disturbance of the capital path under the corresponding levels is simulated respectively, and the stress test results are obtained by execution.

6. The method according to claim 4, characterized in that The above-mentioned spatiotemporal correlation analysis, identification of multi-dimensional abnormal signals, and generation of cross-scale risk warning instructions specifically include: Analyze the correlation between the operational curvature change spectrum feature vector, entropy change index, and stress test results in the time dimension, and analyze the spatial correlation between the stress test results and environmental spectral data; Set the operational curvature change spectrum feature vector, the abnormal threshold of the entropy change index, and the abnormal threshold of the stress test result respectively, mark the abnormality of single indicators and the coordinated abnormality of multiple indicators, and identify multi-dimensional abnormal signals; Basis: Single indicator abnormality is low risk, two indicator abnormalities are medium risk, and three indicator abnormalities are high risk. The severity of the abnormal signal is judged, and a cross-scale risk warning instruction is generated based on the severity.

7. A real-time anti-fraud monitoring system for financial transactions, characterized in that: The system comprises: The real-time data acquisition module is used to collect user device interaction data in real time, including touch track coordinate sequence, pressure value sequence, three-axis acceleration data and interface operation event stream; a curvature feature extraction module for extracting a characteristic vector of a frequency spectrum of an operation curvature change based on the touch trajectory coordinate sequence, and identifying periods of missing routine verification steps and periods of device silence based on the three-axis acceleration data and the interface operation event stream; An entropy change index calculation module is used to dynamically calculate the local entropy growth rate and the temperature gradient spatial distribution of the capital network caused by a single transaction based on the operational curvature change spectrum feature vector and the real-time account capital transaction data to generate an entropy change index; a curvature detection module, configured to set a curvature detection threshold based on an entropy change indicator, detect a spectral feature vector of an operation curvature change using the adjusted curvature detection threshold, perform multi-scale pattern matching on the device's silent state interval, and acquire device peripheral signal data based on an interface operation event stream; The pressure value convolution fusion module is used to perform spatiotemporal convolution fusion of the acquired device peripheral signal data and the pressure value sequence to perform pressure testing; The risk warning generation module is used to perform spatiotemporal correlation analysis on the operational curvature change spectrum feature vector, entropy change index, and stress test results, identify multi-dimensional abnormal signals, and generate cross-scale risk warning instructions.

Images