Financial risk management and control system and method

Abstract

The invention relates to the technical field of financial risk management and control, and discloses a financial risk management and control system and method, and the system comprises a data collection module, a data preprocessing module, a knowledge graph construction module, an AC-Bi LSTM model module, a dynamic feature fusion module, a result output module, and a dynamic early warning module. The transaction flow, the public opinion report and the Internet of Things equipment log are integrated, the transaction flow is structured data, the public opinion report is unstructured data, the Internet of Things equipment log is time series data, the data preprocessing module is used for matching abnormal values of the data by adopting a regular expression, filling missing transaction records through time series interpolation, and performing normalization processing; the output format is unified. According to the financial risk management and control system and method, by integrating multi-source data such as a transaction flow, a public opinion text and an enterprise relation network, the constructed spatial-temporal characteristic matrix can cover more than 90% of risk signal dimensions, and the information island problem of a traditional single data source is effectively solved.

Description

Technical Field

[0001] The present invention relates to the technical field of financial risk management and control, and in particular to a system and method for financial risk management and control. Background Art

[0002] Financial risk management is a management process in which financial institutions or enterprises use systematic methods to identify, evaluate, monitor and deal with various risks such as market, credit and operation risks faced in financial activities in order to minimize potential losses and ensure the sound operation of the institution. Its essence is to reduce the probability of risk events or the actual scale of losses through active intervention.

[0003] After searching, a financial risk management system and method disclosed in the invention patent with Chinese patent number CN119887398A is found. The invention patent configures identification rules, configures multiple risk scenarios and risk identification rules, and configures at least one risk identification rule for each risk scenario. The risk identification rule is associated with a corresponding risk identification model; establishes a model, establishes a risk identification model and a risk indicator, and the calculation result of the risk indicator can be referenced by another risk indicator and the risk identification model. After the risk identification model calculates and analyzes the acquired data information, it can obtain a risk identification result; collects target data, obtains data information of the target business, and inputs the information into the corresponding risk identification model; risk identification, drives the risk identification model through a specific driving path to perform pre-, mid-, and post-risk identification, and obtains a risk identification result after calculating and analyzing the acquired data information. The risk identification model calculates and analyzes the acquired data information, obtains a risk identification result, and judges the risk identification result according to the preset risk identification rules to identify a risk event; risk management, controls the risk event to carry out a corresponding disposal process, and provides information reminders to the target users of the risk event.

[0004] However, in actual operation, this solution only relies on historical data to build a fixed rule base, and does not integrate dynamic risk signals in real-time transactions (such as changes in device fingerprints and abnormal cross-platform fund flows), resulting in a lag in the identification of new fraud patterns. The traditional logistic regression model only analyzes user attributes and transaction records, and does not integrate multimodal data such as device signals and geographic location. The coverage rate of complex risk patterns is low, resulting in poor risk control effects. Therefore, a system and method for financial risk management is proposed to solve the above problems. Summary of the Invention

[0005] (1) Technical problems solved

[0006] In response to the shortcomings of the existing technology, the present invention provides a system and method for financial risk management, which has the advantages of high risk management efficiency and better response to complex situations. It solves the problem that in actual operation, the solution only relies on historical data to build a fixed rule base, fails to integrate dynamic risk signals in real-time transactions (such as device fingerprint changes and abnormal cross-platform fund flows), resulting in delayed recognition of new fraud patterns, adopts traditional logistic regression models, only analyzes user attributes and transaction records, fails to integrate multimodal data such as device signals and geographic location, and has low coverage of complex risk patterns, thus leading to poor risk control effects.

[0007] (2) Technical solution

[0008] To achieve the above-mentioned high risk management efficiency and facilitate better response to complex situations, the present invention provides the following technical solutions: a financial risk management system, including a data acquisition module, a data preprocessing module, a knowledge graph construction module, an AC-BiLSTM model module, a dynamic feature fusion module, a result output module and a dynamic early warning module;

[0009] The data collection module integrates transaction flows, public opinion reports, and IoT device logs, where transaction flows are structured data, public opinion reports are unstructured data, and IoT device logs are time series data.

[0010] The data preprocessing module uses regular expressions to match outliers in the data, fills in missing transaction records through time series interpolation, and performs normalization to unify the output format;

[0011] The knowledge graph construction module integrates multi-source data such as user portraits, transaction records, and device information to construct capital flow paths and association networks between entities and capture implicit risk transmission patterns.

[0012] The AC-BiLSTM model module includes a bidirectional long short-term memory network (BiLSTM) module, an attention mechanism (Attention) module, and a convolutional neural network (CNN) module;

[0013] The dynamic feature fusion module maps the topological structure of the knowledge graph (spatial dimension) and transaction fluctuations (temporal dimension) into a three-dimensional tensor to achieve cross-modal feature association;

[0014] The result output module imports the real-time monitoring data into the AC-BiLSTM model module to predict the risk situation, and once an abnormality is found, the dynamic warning module quickly intercepts it.

[0015] Preferably, the AC-BiLSTM model module includes the following modules:

[0016] 1D-CNN: 3 layers of convolutional kernels, activated by ReLU, extracting local features such as transaction frequency mutations;

[0017] BiLSTM: A 128-unit bidirectional network that captures the long-term evolution of customer behavior.

[0018] Attention: A dual-channel attention module that optimizes the weights of time-sensitive events (such as high-frequency trading) and spatially associated entities (such as abnormal accounts) to achieve precise focus on key risk factors.

[0019] Preferably, the method for financial risk management includes the following steps:

[0020] Step 1: Integrate structured and unstructured data such as transaction flow, public opinion text, and corporate relationship network to construct a spatiotemporal feature matrix (time step × feature dimension);

[0021] Step 2: Knowledge graph embedding: GraphSAGE is used to generate 128-dimensional entity vectors, and Path2Vec is used to encode the capital flow path to form a topological feature space.

[0022] Step 3: Build an AC-BiLSTM risk management model;

[0023] Step 4: Output the results and generate a risk transmission path heat map and anomaly interception report.

[0024] Preferably, in step 2, the construction of the knowledge graph includes the following steps:

[0025] Step 201: Normalize transaction flow, public opinion reports, IoT device logs, and other data;

[0026] Step 202: Design the graph TD

[0027] A[Cardholder]->|Use|B(Mobile Device)

[0028] B->|Frequent Change|C{Risk Mark}

[0029] A->|Transfer to|D[virtual account]

[0030] D->|Associate|E[Exchange Wallet]

[0031] Step 203: Graph database storage, the storage strategy is Neo4j shard storage, the main shard stores active users who have transacted in the past 30 days, and historical data is archived to cold storage;

[0032] Step 204: Generate knowledge graph embeddings. For node embedding, GraphSAGE samples a 3-hop neighborhood to generate a 128-dimensional vector. Accounts with a cosine similarity greater than 0.85 are considered to be associated accounts. For path embedding, 50 transaction paths are generated using random walks, and Word2Vec is used to train a 100-dimensional path vector.

[0033] Preferably, in step 3, the AC-BiLSTM risk management model construction includes the following steps:

[0034] Step 301: Divide the original time series into overlapping time series blocks of a fixed length of thirty days, and construct a three-dimensional input tensor (number of samples × time steps × feature dimensions);

[0035] Step 302: Min-Max normalization is performed on heterogeneous features such as device fingerprint, transaction amount, and geographic location to eliminate dimensional differences;

[0036] Step 303: A two-layer one-dimensional convolutional network (Conv1D) is used with 64 convolution kernels of width 3 to extract local temporal patterns and capture short-term patterns such as sudden changes in transaction frequency and cyclical fluctuations.

[0037] Step 304: Deploy a bidirectional LSTM layer (128 units) to scan the time series data forward and backward, modeling the interaction between historical dependencies and future trends, and identifying long-term behaviors such as inter-month cashing.

[0038] Step 305: Dynamically calculate the importance score of each time step through the attention layer, focusing on abnormal time periods, such as large transfers in the early morning;

[0039] Step 306: Fully connected prediction, compressing the feature dimension followed by two dense connection layers (Dense), outputting the risk probability.

[0040] Preferably, the specific control operation after the AC-BiLSTM risk control model is integrated with the knowledge graph includes the following steps:

[0041] S1 input:

[0042] Time series data: transaction amount, location, and merchant type in the past 30 days;

[0043] Graph data: cardholder-associated devices, recent abnormal transfer paths;

[0044] S2 processing flow:

[0045] CNN layer: Detects five consecutive small-value cross-border test transactions in a single day;

[0046] LSTM layer: identifies monthly consumption cycles that deviate from the baseline by 30% or more;

[0047] Graph embedding: associate newly bound devices with unverified ones and funds transferred to the virtual currency platform;

[0048] Attention mechanism: The weight of device change features is increased to 0.61.

[0049] S3 output: Risk probability value 0.93, triggering real-time transaction interception.

[0050] S4 generates an interception report to facilitate user inquiries and sends information to the user's communication device for reminders.

[0051] Preferably, the constraints of the AC-BiLSTM risk management model include real-time constraints, computing resource constraints, and feature dimension constraints.

[0052] Preferably, the real-time constraint is that the risk assessment of a single transaction must be responded to within 200ms, which is subject to the real-time risk control requirements of financial supervision.

[0053] Preferably, the computing resource constraint is that the GPU memory utilization does not exceed 80% (to ensure the stability of multi-node parallel computing under the cloud-edge collaborative architecture), and the feature dimension constraint is that the input feature dimension is fixed to 30 time steps × 8 features (including dynamic indicators such as transaction amount, geographic location, device fingerprint, etc.).

[0054] (3) Beneficial effects

[0055] Compared with the existing technology, the present invention provides a system and method for financial risk management, which has the following beneficial effects:

[0056] 1. This financial risk management system and method integrates multi-source data such as transaction flows, public opinion texts, and corporate relationship networks to construct a spatiotemporal feature matrix that can cover more than 90% of risk signal dimensions, effectively solving the information island problem of traditional single data sources.

[0057] 2. This financial risk management system and method enhances time series detection capabilities by building an AC-BiLSTM risk management model. The CNN layer in the AC-BiLSTM architecture captures transaction frequency mutation characteristics. Combined with BiLSTM's 30-day cycle modeling, this achieves a higher F1-score detection rate for fraud detection and keeps the false alarm rate below 1.2%. The 256-dimensional spatiotemporal tensor concatenation layer enables cross-modal feature coupling, and the dual-channel Attention mechanism improves the recall rate of associated risk identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 This is a schematic diagram of the financial risk management system of the present invention;

[0059] Figure 2 This is a flow chart of the financial risk management process of the present invention. DETAILED DESCRIPTION

[0060] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0061] See also Figure 1-2 ,A financial risk management and control system, including a data acquisition module, a data preprocessing module, a knowledge graph construction module, an AC-BiLSTM model module, a dynamic feature fusion module, a result output module and a dynamic warning module;

[0062] The data collection module integrates transaction flows, public opinion reports, and IoT device logs, where transaction flows are structured data, public opinion reports are unstructured data, and IoT device logs are time series data.

[0063] The data preprocessing module uses regular expressions to match outliers in the data, fills in missing transaction records through time series interpolation, and performs normalization to unify the output format;

[0064] The knowledge graph construction module integrates multi-source data such as user portraits, transaction records, and device information to construct capital flow paths and association networks between entities and capture implicit risk transmission patterns.

[0065] The AC-BiLSTM model module includes a bidirectional long short-term memory network (BiLSTM) module, an attention mechanism (Attention) module, and a convolutional neural network (CNN) module;

[0066] The dynamic feature fusion module maps the topological structure of the knowledge graph (spatial dimension) and transaction fluctuations (temporal dimension) into a three-dimensional tensor to achieve cross-modal feature association;

[0067] The result output module imports the real-time monitoring data into the AC-BiLSTM model module to predict the risk situation, and once an abnormality is found, the dynamic warning module quickly intercepts it.

[0068] exist Figure 1 and Figure 2 The AC-BiLSTM model module includes the following modules:

[0069] 1D-CNN: 3 layers of convolutional kernels, activated by ReLU, extracting local features such as transaction frequency mutations;

[0070] BiLSTM: A 128-unit bidirectional network that captures the long-term evolution of customer behavior.

[0071] Attention: A dual-channel attention module that optimizes the weights of time-sensitive events (such as high-frequency trading) and spatially associated entities (such as abnormal accounts) to achieve precise focus on key risk factors.

[0072] exist Figure 2 The financial risk management method includes the following steps:

[0073] Step 1: Integrate structured and unstructured data such as transaction flow, public opinion text, and corporate relationship network to construct a spatiotemporal feature matrix (time step × feature dimension);

[0074] Step 2: Knowledge graph embedding: GraphSAGE is used to generate 128-dimensional entity vectors, and Path2Vec is used to encode the capital flow path to form a topological feature space.

[0075] Step 3: Build an AC-BiLSTM risk management model;

[0076] Step 4: Output the results and generate a risk transmission path heat map and anomaly interception report.

[0077] Example 1

[0078] In step 2, the construction of the knowledge graph includes the following steps:

[0079] Step 201: Normalize transaction flow, public opinion reports, IoT device logs, and other data;

[0080] Step 202: Design the graph TD

[0081] A[Cardholder]->|Use|B(Mobile Device)

[0082] B->|Frequent Change|C{Risk Mark}

[0083] A->|Transfer to|D[virtual account]

[0084] D->|Associate|E[Exchange Wallet]

[0085] Step 203: Graph database storage, the storage strategy is Neo4j shard storage, the main shard stores active users who have transacted in the past 30 days, and historical data is archived to cold storage;

[0086] Step 204: Generate knowledge graph embeddings. For node embedding, GraphSAGE samples a 3-hop neighborhood to generate a 128-dimensional vector. Accounts with a cosine similarity greater than 0.85 are considered to be associated accounts. For path embedding, 50 transaction paths are generated using random walks, and Word2Vec is used to train a 100-dimensional path vector.

[0087] In this embodiment, multi-source data such as transaction records and device information are integrated to construct fund flow paths and association networks between entities and capture implicit risk transmission patterns. Key technology: GraphSAGE algorithm is used to generate node embeddings and identify high-risk associated accounts, such as concentrated fund transfer patterns.

[0088] In addition, dynamic graph updates also include hourly monitoring of subgraph structure changes (such as new device bindings and account association changes), and updating node embedding vectors through incremental learning to solve the lag problem of traditional static graphs.

[0089] Example 2

[0090] In step 3, the AC-BiLSTM risk management model construction includes the following steps:

[0091] Step 301: Divide the original time series into overlapping time series blocks of a fixed length of thirty days, and construct a three-dimensional input tensor (number of samples × time steps × feature dimensions);

[0092] Step 302: Min-Max normalization is performed on heterogeneous features such as device fingerprint, transaction amount, and geographic location to eliminate dimensional differences;

[0093] Step 303: A two-layer one-dimensional convolutional network (Conv1 D) is used with 64 convolution kernels of width 3 to extract local temporal patterns and capture short-term patterns such as sudden changes in transaction frequency and cyclical fluctuations.

[0094] Step 304: Deploy a bidirectional LSTM layer (128 units) to scan the time series data forward and backward, modeling the interaction between historical dependencies and future trends, and identifying long-term behaviors such as inter-month cashing.

[0095] Step 305: Dynamically calculate the importance score of each time step through the attention layer, focusing on abnormal time periods, such as large transfers in the early morning;

[0096] Step 306: Fully connected prediction, compressing the feature dimension followed by two dense connection layers (Dense), outputting the risk probability.

[0097] In this embodiment, by constructing an AC-BiLSTM risk management model, the time series detection capability is enhanced. The CNN layer in the AC-BiLSTM architecture captures the mutation characteristics of transaction frequency. Combined with BiLSTM's 30-day cycle modeling, the fraud detection F1-score detection rate is higher and the false alarm rate is controlled within 1.2%. The 256-dimensional spatiotemporal tensor splicing layer realizes cross-modal feature coupling. Through the dual-channel Attention mechanism, the recall rate of associated risk identification is improved.

[0098] Example 3

[0099] The specific control operations after the AC-BiLSTM risk control model is integrated with the knowledge graph include the following steps:

[0100] S1 input:

[0101] Time series data: transaction amount, location, and merchant type in the past 30 days;

[0102] Graph data: cardholder-associated devices, recent abnormal transfer paths;

[0103] S2 processing flow:

[0104] CNN layer: Detects five consecutive small-value cross-border test transactions in a single day;

[0105] LSTM layer: identifies monthly consumption cycles that deviate from the baseline by 30% or more;

[0106] Graph embedding: associate newly bound devices with unverified ones and funds transferred to the virtual currency platform;

[0107] Attention mechanism: The weight of device change features is increased to 0.61.

[0108] S3 output: Risk probability value 0.93, triggering real-time transaction interception.

[0109] S4 generates an interception report to facilitate user inquiries and sends information to the user's communication device for reminders.

[0110] In this embodiment, through the above steps, the knowledge graph and risk control model are integrated to intercept abnormal situations in a timely manner, thereby reducing losses and ensuring the safety of user funds.

[0111] Specifically, the constraints of the AC-BiLSTM risk management model include real-time constraints, computing resource constraints and feature dimension constraints. The real-time constraint is that the risk assessment of a single transaction must respond within 200ms, which is restricted by the real-time risk control requirements of financial supervision. The computing resource constraint is that the GPU memory utilization rate does not exceed 80% to ensure the stability of multi-node parallel computing under the cloud-edge collaborative architecture. The feature dimension constraint is that the input feature dimension is fixed at 30 time steps × 8 features, including dynamic indicators such as transaction amount, geographic location, and device fingerprint.

[0112] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0113] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A financial risk management system, characterized by: It includes data acquisition module, data preprocessing module, knowledge graph construction module, AC-BiLSTM model module, dynamic feature fusion module, result output module and dynamic warning module; The data collection module integrates transaction flows, public opinion reports, and IoT device logs, where transaction flows are structured data, public opinion reports are unstructured data, and IoT device logs are time series data. The data preprocessing module uses regular expressions to match outliers in the data, fills in missing transaction records through time series interpolation, and performs normalization to unify the output format; The knowledge graph construction module integrates multi-source data such as user portraits, transaction records, and device information to construct capital flow paths and association networks between entities and capture implicit risk transmission patterns. The AC-BiLSTM model module includes a bidirectional long short-term memory network (BiLSTM) module, an attention mechanism (Attention) module, and a convolutional neural network (CNN) module; The dynamic feature fusion module maps the topological structure of the knowledge graph (spatial dimension) and transaction fluctuations (temporal dimension) into a three-dimensional tensor to achieve cross-modal feature association; The result output module imports the real-time monitoring data into the AC-BiLSTM model module to predict the risk situation, and once an abnormality is found, the dynamic warning module quickly intercepts it.

2. A financial risk management system according to claim 1, characterized in that: The AC-BiLSTM model module includes the following modules: 1D-CNN: 3 layers of convolutional kernels, activated by ReLU, extracting local features such as transaction frequency mutations; BiLSTM: A 128-unit bidirectional network that captures the long-term evolution of customer behavior. Attention: A dual-channel attention module that optimizes the weights of time-sensitive events (such as high-frequency trading) and spatially associated entities (such as abnormal accounts) to achieve precise focus on key risk factors.

3. A method for financial risk management, comprising the method for managing a financial risk management system according to any one of claims 1 to 2, characterized in that: The method for financial risk management and control includes the following steps: Step 1: Integrate structured and unstructured data such as transaction flow, public opinion text, and corporate relationship network to construct a spatiotemporal feature matrix (time step × feature dimension); Step 2: Knowledge graph embedding: GraphSAGE is used to generate 128-dimensional entity vectors, and Path2Vec is used to encode the capital flow path to form a topological feature space. Step 3: Build an AC-BiLSTM risk management model; Step 4: Output the results and generate a risk transmission path heat map and anomaly interception report.

4. The method for financial risk management according to claim 3, characterized in that: In step 2, the construction of the knowledge graph includes the following steps: Step 201: Normalize transaction flow, public opinion reports, IoT device logs, and other data; Step 202: Design the graph TD A[Cardholder]->|Use|B(Mobile Device) B->|Frequent Change|C{Risk Mark} A->|Transfer to|D[virtual account] D->|Associate|E[Exchange Wallet] Step 203: Graph database storage, the storage strategy is Neo4j shard storage, the main shard stores active users who have traded in the past 30 days, and historical data is archived to cold storage; Step 204: Generate knowledge graph embeddings. For node embedding, GraphSAGE samples a 3-hop neighborhood to generate a 128-dimensional vector. Accounts with a cosine similarity greater than 0.85 are considered to be associated accounts. For path embedding, 50 transaction paths are generated using random walks, and Word2Vec is used to train a 100-dimensional path vector.

5. The method for financial risk management according to claim 3, characterized in that: In step 3, the AC-BiLSTM risk management model construction includes the following steps: Step 301: Divide the original time series into overlapping time series blocks of a fixed length of thirty days, and construct a three-dimensional input tensor (number of samples × time steps × feature dimensions); Step 302: Min-Max normalization is performed on heterogeneous features such as device fingerprint, transaction amount, and geographic location to eliminate dimensional differences; Step 303: A two-layer one-dimensional convolutional network (Conv1 D) is used with 64 convolution kernels of width 3 to extract local temporal patterns and capture short-term patterns such as sudden changes in transaction frequency and cyclical fluctuations. Step 304: Deploy a bidirectional LSTM layer (128 units) to scan the time series data forward and backward, modeling the interaction between historical dependencies and future trends, and identifying long-term behaviors such as inter-month cashing. Step 305: Dynamically calculate the importance score of each time step through the attention layer, focusing on abnormal time periods, such as large transfers in the early morning; Step 306: Fully connected prediction, compressing the feature dimension followed by two dense connection layers (Dense), outputting the risk probability.

6. The method for financial risk management according to claim 3, characterized in that: The specific control operations after the AC-BiLSTM risk control model is integrated with the knowledge graph include the following steps: S1 input: Time series data: transaction amount, location, and merchant type in the past 30 days; Graph data: cardholder-associated devices, recent abnormal transfer paths; S2 processing flow: CNN layer: Detects five consecutive small-value cross-border test transactions in a single day; LSTM layer: identifies monthly consumption cycles that deviate from the baseline by 30% or more; Graph embedding: associate newly bound devices with unverified ones and funds transferred to the virtual currency platform; Attention mechanism: The weight of device change features is increased to 0.

61. S3 output: Risk probability value 0.93, triggering real-time transaction interception. S4 generates an interception report to facilitate user inquiries and sends information to the user's communication device for reminders.

7. The method for financial risk management according to claim 3, characterized in that: The constraints of the AC-BiLSTM risk management model include real-time constraints, computing resource constraints, and feature dimension constraints.

8. The method for financial risk management according to claim 7, characterized in that: The real-time constraint is that the risk assessment of a single transaction must be responded to within 200ms, which is subject to the real-time risk control requirements of financial regulators.

9. The method for financial risk management according to claim 7, characterized in that: The computing resource constraint is that the GPU memory utilization rate does not exceed 80% (to ensure the stability of multi-node parallel computing under the cloud-edge collaborative architecture), and the feature dimension constraint is that the input feature dimension is fixed to 30 time steps × 8 features (including dynamic indicators such as transaction amount, geographic location, device fingerprint, etc.).

Images