Digital transaction risk intelligent early warning method and system based on deep learning

Abstract

The application discloses a kind of digital transaction risk intelligent early warning method and system based on deep learning, it is related to artificial intelligence technical field, comprising: first, obtaining the transaction data stream to be evaluated;Second, the data stream is input into the feature analysis network corresponding to each risk dimension in target risk rating model, and each dimension target behavior feature vector is extracted by the model trained by feature independence loss;Finally, the target risk level label of transaction is determined by combining each dimension feature vector and corresponding risk assessment unit.The method optimizes multi-dimensional feature extraction by feature independence loss, reduces feature redundancy, enhances the uniqueness of each dimension risk representation, effectively improves the accuracy of risk assessment and the generalization ability of the model to complex transaction scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, in particular to a digital transaction risk intelligent early warning method and system based on deep learning. BACKGROUND

[0002] With the rapid development of digital economy and financial technology, transaction risks show significant multi-dimensional interweaving and dynamic evolution characteristics, and traditional risk early warning methods based on rule base or single model face severe challenges. SUMMARY

[0003] The purpose of the present application is to provide a digital transaction risk intelligent early warning method and system based on deep learning.

[0004] In a first aspect, the present application provides a digital transaction risk intelligent early warning method based on deep learning, comprising:

[0005] Obtaining a to-be-evaluated transaction data stream;

[0006] Inputting the to-be-evaluated transaction data stream into a plurality of risk dimensions each corresponding to a target feature analysis network in a target risk rating model for behavior feature recognition processing to obtain a target behavior feature vector corresponding to each risk dimension; the target risk rating model is obtained by training a sample risk feature extraction branch in a sample feature analysis network based on a feature independence loss, the feature independence loss represents the correlation of a target dimension feature vector, and the target dimension feature vector is a dimension feature vector output by a sample risk feature extraction branch corresponding to any two risk dimensions;

[0007] Based on the target behavior feature vector corresponding to each risk dimension and the target risk assessment unit corresponding to each risk dimension, determining a target risk level label corresponding to the to-be-evaluated transaction data stream.

[0008] In a second aspect, the present application provides a server system comprising a server, wherein the server is configured to execute the method of the first aspect.

[0009] Compared with the prior art, the application provides the following beneficial effects: the method and system for intelligent early warning of digital transaction risk based on deep learning disclosed by the application involve the field of artificial intelligence technology, and the following steps are performed: obtaining a to-be-evaluated transaction data stream; inputting the data stream into a feature analysis network corresponding to each risk dimension of a target risk rating model, extracting a target behavior feature vector of each dimension through the model trained by feature independence loss; and combining each dimension feature vector with a corresponding risk assessment unit to determine a target risk level label of the transaction. The method optimizes multi-dimensional feature extraction by feature independence loss, reduces feature redundancy, enhances the uniqueness of risk representation of each dimension, and effectively improves the accuracy of risk assessment and the generalization ability of the model to complex transaction scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0010] In order to more clearly illustrate the technical solutions of the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0011] Figure 1 The step flow diagram of the method for intelligent early warning of digital transaction risk based on deep learning provided by the embodiments of the application is shown in the figure.

[0012] Figure 2 The structural schematic block diagram of the computer device provided by the embodiments of the application is shown in the figure. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solutions and advantages of the embodiments of the application more clear, the following will combine the drawings in the embodiments of the application to clearly and completely describe the technical solutions in the embodiments of the application. Obviously, the described embodiments are some of the embodiments of the application, not all the embodiments. The components of the embodiments of the application described and shown in the drawings here can be arranged and designed in various different configurations.

[0014] The specific embodiments of the application will be described in detail below with reference to the drawings.

[0015] In order to solve the technical problems in the foregoing background art, Figure 1 The flow diagram of the method for intelligent early warning of digital transaction risk based on deep learning provided by the embodiments of the present disclosure is shown in the figure, and the following will introduce the method for intelligent early warning of digital transaction risk based on deep learning in detail.

[0016] Step S201, obtaining a to-be-evaluated transaction data stream;

[0017] In step S202, the target behavior feature recognition network corresponding to each risk dimension in the target risk rating model is used to process the to-be-evaluated transaction data stream to obtain a target behavior feature vector corresponding to each risk dimension; the target risk rating model is obtained by training a sample risk feature extraction branch in a sample feature analysis network based on a feature independence loss, the feature independence loss represents the correlation of a target dimension feature vector, and the target dimension feature vector is a dimension feature vector output by a sample risk feature extraction branch corresponding to any two risk dimensions;

[0018] In step S203, a target risk level label corresponding to the to-be-evaluated transaction data stream is determined based on the target behavior feature vector corresponding to each risk dimension and a target risk assessment unit corresponding to each risk dimension.

[0019] In an embodiment of the present application, the financial institution server continuously receives transaction data of a user through a transaction system real-time data stream pipeline. The to-be-evaluated transaction data stream contains multiple continuous transaction events, each event covering transaction time, transaction amount, merchant ID, merchant type, payment method, device ID, IP address, geographic location, and other core fields. For example, a to-be-evaluated user generates multiple transactions within an hour, including large jewelry transactions, out-of-town electronic product transactions, and device ID replacement records, and other abnormal signals. The server integrates the above data into a structured to-be-evaluated transaction data stream as an input for risk assessment.

[0020] The server inputs the to-be-evaluated transaction data stream into a pre-trained target risk rating model. The model extracts a target behavior feature vector of each risk dimension through a target feature analysis network corresponding to each risk dimension. The training process of the target risk rating model introduces a feature independence loss, minimizes the correlation (such as mutual information) of feature vectors corresponding to any two risk dimensions, such as transaction frequency and amount anomaly dimension features, ensures that each dimension feature independently captures different risk signals, and avoids feature redundancy.

[0021] The target feature analysis network of each risk dimension includes a target behavior feature encoder and a target risk feature hierarchical extractor. Taking the amount anomaly dimension as an example, the target behavior feature encoder adopts the Transformer architecture to convert the transaction amount sequence into normalized features, and then learns the correlation between the amounts (such as the mutation relationship between small transactions and large transactions) through multi-head self-attention mechanism to generate target behavior feature encoding. The target risk feature hierarchical extractor then performs hierarchical processing on the encoding: first, it performs multi-head self-attention calculation through the fourth dynamic feature enhancement component to generate an interaction correlation matrix of transaction amounts, determines the dynamic weight distribution of each transaction event based on the matrix (with higher weights for large transactions), and obtains an enhanced feature representation through weighted aggregation, residual connection, and layer normalization; then it extracts low-level amount statistical features (such as maximum amount, average amount, and amount standard deviation) through the first target risk feature hierarchical extractor, extracts high-level amount anomaly semantic features (such as "sudden large amount" and "continuous high amount") through the fourth high-order feature abstractor combined with the target behavior feature encoding, and extracts core risk features (such as the degree of amount deviation from historical quantile and the proportion of abnormal amount) through the second target risk feature hierarchical extractor; finally, it performs dimension alignment on the core features, low-level features, and target behavior feature encoding through the fourth risk feature integrator, calls the trained weight matrix to calculate the fusion weight coefficient, and generates the target behavior feature vector of the amount anomaly dimension after weighted combination.

[0022] Taking the device environment dimension as another example, the target behavior feature encoder converts the device ID, IP address, and geographic location into embedding vectors and concatenates them, learns the association between the device and the geographic location (such as the correspondence between device replacement and out-of-town transactions) through self-attention mechanism, and generates target behavior feature encoding; the target risk feature hierarchical extractor also performs dynamic feature enhancement, hierarchical feature extraction, and feature integration to extract core risk features such as device replacement frequency, geographic location mutation (such as moving from Beijing to Shanghai within an hour), and IP address cross-segment, and generates the target behavior feature vector of the device environment dimension.

[0023] Similarly, the target feature analysis network of the transaction frequency dimension (extracting transaction interval and high-frequency transaction probability features) and the merchant correlation dimension (extracting merchant type diversity and cross-merchant jump frequency features) follows the above process to finally obtain the target behavior feature vector of each risk dimension.

[0024] The server generates first risk level predictions (e.g., low risk, medium risk, high risk) for each dimension based on the target behavior feature vector of each risk dimension through the corresponding target risk assessment unit (MLP classifier). For example, the amount anomaly dimension outputs a high risk prediction due to the presence of large transaction features, the device environment dimension outputs a high risk prediction due to the presence of geographic location mutation features, the transaction frequency dimension outputs a medium risk prediction due to the shortening of transaction intervals, and the merchant association dimension outputs a low risk prediction due to the diversity of merchant types.

[0025] At the same time, the server inputs the transaction data stream to be evaluated into the target risk confidence modeling unit, which analyzes the overall risk signals (e.g., the number and intensity of strong abnormal features) of the transaction data and outputs a target risk confidence score (0-1, with a higher score indicating a higher confidence of the model in risk assessment). For example, the large transaction and geographic location mutation of the user to be evaluated are both strong risk signals, and the model outputs a high confidence score (e.g., 0.9).

[0026] The server adjusts the weights of each risk dimension based on the target risk confidence score: first, set a base weight for each risk dimension (e.g., amount anomaly 0.35, device environment 0.3, transaction frequency 0.2, merchant association 0.15, determined by business experts and model training), then adjust the weight by "base weight x confidence score + uniform distribution weight" (uniform distribution weight is used to avoid over-reliance on a certain dimension when confidence is low). For example, the maximum weight of the amount anomaly dimension is 0.35 x 0.9 + 0.025 = 0.34, the maximum weight of the device environment dimension is 0.3 x 0.9 + 0.025 = 0.295, the maximum weight of the transaction frequency is 0.2 x 0.9 + 0.025 = 0.205, and the maximum weight of the merchant association is 0.15 x 0.9 + 0.025 = 0.16.

[0027] The server performs a weighted sum of the first risk level predictions of each dimension and the adjusted weights to obtain a second risk level prediction (e.g., 1.475). Then, according to the pre-set risk level threshold (e.g., ≥1.5 is high risk), combined with the target risk confidence score (high confidence), the second risk level prediction is corrected upward to high risk, and the target risk level label of the transaction data stream to be evaluated is finally determined as high risk.

[0028] The server sends the high risk level label to the risk control system, triggering real-time account freezing, SMS / phone notification to the user to verify the authenticity of the transaction, generation of a risk report, and other operations. For example, freezing the account can prevent further fraudulent transactions, notifying the user can promptly confirm whether the transaction was performed by the user, and the risk report records transaction abnormal features (e.g., amount anomaly, device environment anomaly) for risk analysts to analyze the source of the risk and improve the early warning strategy.

[0029] The technical advantages of the embodiment are that the independence of each risk dimension feature is ensured through feature independence loss training, and feature redundancy is avoided; risk signals are gradually mined from low-level statistical features to high-level semantic features through hierarchical feature learning; the false positive / false negative rate is reduced by adjusting the weight of each dimension through confidence weighted decision. The above process realizes real-time and intelligent transaction risk early warning, and effectively prevents financial risks such as card fraud.

[0030] In the embodiment of the application, the target risk level label corresponding to the to-be-evaluated transaction data stream can be determined by inputting the target behavior feature vector corresponding to each risk dimension into the target risk assessment unit corresponding to each risk dimension for risk assessment, and obtaining the first risk level prediction corresponding to each risk dimension.

[0031] The target behavior feature vector corresponding to each risk dimension is input into the target risk assessment unit corresponding to each risk dimension for risk assessment, and the first risk level prediction corresponding to each risk dimension is obtained.

[0032] Based on the first risk level prediction corresponding to each of the plurality of risk dimensions, the target risk level label corresponding to the to-be-evaluated transaction data stream is determined.

[0033] In the embodiment of the application, the target risk level label corresponding to the to-be-evaluated transaction data stream can be determined by inputting the target behavior feature vector corresponding to each risk dimension into the target risk assessment unit corresponding to each risk dimension for risk assessment, and obtaining the first risk level prediction corresponding to each risk dimension.

[0034] The financial institution server obtains a user's to-be-evaluated transaction data stream in real time through a transaction system, the data stream containing 5 continuous transactions of the user in a morning period of a working day, involving catering, jewelry, supermarket, electronic product and other types of merchants, the transaction amount ranging from 100 yuan to 5000 yuan, and there are abnormal signals such as switching from a commonly used device to a strange device and sudden change from a commonly used area to an alien place. The server inputs the data stream into a target risk rating model, extracts the target behavior feature vector corresponding to each dimension through the target feature analysis network of four core risk dimensions of transaction frequency, amount anomaly, merchant association and device environment, and then enters the risk level determination process. First, the server inputs the target behavior feature vector corresponding to each risk dimension into the target risk assessment unit (all are deep learning classifiers trained based on historical risk samples, the input layer dimension matches the feature vector dimension, and the output layer corresponds to three levels of low risk, medium risk and high risk) of the dimension. For the amount anomaly dimension, the target behavior feature vector includes core features such as "maximum transaction amount 5000 yuan (25 times higher than the user's historical average of 200 yuan)", "abnormal amount ratio 40% (2 large transactions account for 40% of the total transactions)", and "amount fluctuation standard deviation 1980 yuan (much higher than the historical average of 300 yuan)". The server inputs the vector into the target risk assessment unit of the amount anomaly dimension, and through forward propagation calculation, the first risk level prediction is high risk (label value 2); for the device environment dimension, the target behavior feature vector includes features such as "switching from a commonly used device to a strange device within 1 hour", "sudden change from a commonly used area to an alien place (the distance between the two places is far, and it is impossible to reach within 1 hour by regular transportation)", and "IP address jumps from a commonly used network segment to a strange network segment". After inputting into the target risk assessment unit of the device environment dimension, the first risk level prediction is high risk (label value 2); for the transaction frequency dimension, the target behavior feature vector includes features such as "average transaction interval 15 minutes (lower than the historical average of 30 minutes)" and "5 transactions completed within 1 hour (more than 90% of the historical hourly transaction times)". After inputting into the target risk assessment unit of the transaction frequency dimension, the first risk level prediction is medium risk (label value 1); for the merchant association dimension, the target behavior feature vector includes features such as "merchant type diversity 4 (catering, jewelry, supermarket, electronics)" and "cross-merchant jump path consistent with historical habits". After inputting into the target risk assessment unit of the merchant association dimension, the first risk level prediction is low risk (label value 0). Next, the server determines the target risk level label based on the first risk level prediction of the above multiple risk dimensions through weighted integration.The server precombines the importance judgment of the risk dimensions (such as large transaction amount and device anomaly being the core signal of fraud) by the business expert and analyzes the risk contribution of each dimension in model training, sets a basic weight for each risk dimension: 0.35 for the amount anomaly dimension, 0.3 for the device environment dimension, 0.2 for the transaction frequency dimension, and 0.15 for the merchant association dimension. Subsequently, the server multiplies the first risk level prediction value of each dimension by the corresponding basic weight and sums them up to obtain a comprehensive risk score: (2 x 0.35) + (2 x 0.3) + (1 x 0.2) + (0 x 0.15) = 1.5. The server further presets a risk level threshold according to the historical risk event review results and the risk tolerance of the business: a comprehensive score < 0.5 is low risk, 0.5 ≤ comprehensive score < 1.5 is medium risk, and comprehensive score ≥ 1.5 is high risk. The comprehensive score this time is 1.5, reaching the high risk threshold, so the server determines that the target risk level label corresponding to the to-be-evaluated transaction data stream is high risk. Finally, the server pushes the high risk label to the risk control system, triggers real-time freezing of the user account (to prevent further fraud), sends a notification to the user (to verify the authenticity of the transaction, such as "Your account has a large amount of jewelry transaction in a foreign place during the morning period. Is it your operation?"), and generates a risk report (records the core risk characteristics of "amount anomaly + device environment anomaly" for risk analysts to analyze the source of risk), etc., realizing intelligent early warning and control of digital transaction risk. This process integrates multiple dimensions through independent risk evaluation and weighting, not only retains the unique risk signals of each risk dimension (such as the strong fraud association of amount anomaly and device environment anomaly), but also avoids the influence of single dimension misjudgment on the overall result, effectively improving the accuracy and reliability of risk warning, meeting the high requirements of financial institutions for real-time transaction risk prevention and control.

[0035] In the embodiments of the present application, the following implementation modes are further provided.

[0036] The target risk confidence modeling unit in the target risk rating model is input into the target risk confidence modeling unit for risk confidence evaluation, and a target risk confidence score is obtained.

[0037] The target risk level label corresponding to the to-be-evaluated transaction data stream is determined based on the first risk level prediction of each of the plurality of risk dimensions, including:

[0038] Based on the target risk confidence score, risk weighting decision is made on the first risk level prediction of each of the plurality of risk dimensions, and a second risk level prediction of the to-be-evaluated transaction data stream is obtained.

[0039] The target risk level label is determined based on the second risk level prediction.

[0040] In the embodiments of the present application, the server of the financial institution obtains the transaction data stream of a user to be evaluated in real time through the transaction system. The data stream contains 5 transactions of the user within a certain period of time, involving catering, jewelry, supermarket, electronic product and other types of merchants, and the transaction amount is from 100 yuan to 5000 yuan. There are abnormal signals such as switching from common equipment to unfamiliar equipment and sudden change of geographic location from common area to distant place. The server has extracted the target behavior feature vector of four dimensions of transaction frequency, amount anomaly, merchant correlation and device environment through the target feature analysis network of multiple risk dimensions of the target risk rating model, and output the first risk level prediction through the target risk assessment unit of each dimension (amount anomaly and device environment are high risk (label value 2), transaction frequency is medium risk (label value 1), and merchant correlation is low risk (label value 0)). The server inputs the transaction data stream into the target risk confidence modeling unit in the target risk rating model (this unit is a deep learning model trained based on historical risk samples, the input layer receives all field features of the transaction data stream, and the output layer outputs a confidence score of 0-1, and the higher the score, the higher the confidence degree of the model to the risk assessment). The unit analyzes the number and intensity of strong risk signals in the transaction data (such as “large jewelry transaction” and “replacement of unfamiliar device” in this transaction, which are high-frequency associated features of historical fraud events), and outputs a target risk confidence score of 0.9 (indicating that the model has a very high confidence in the reliability of the risk signal of this transaction). The server adjusts the basic weight of each risk dimension based on the target risk confidence score (the basic weight is determined by business experts and model training: amount anomaly 0.35, device environment 0.3, transaction frequency 0.2, and merchant correlation 0.15). The adjustment logic is: the maximum weight = basic weight x confidence score + (1-confidence score) / number of risk dimensions (note: the second term is a uniform distribution weight, which is used to avoid excessive dependence on a certain dimension when the confidence is low). Substituting the confidence score 0.9 in this case, the maximum weight of the amount anomaly dimension is calculated as: (0.35x0.9+(1-0.9) / 4=0.315+0.025=0.34); the maximum weight of the device environment dimension is calculated as: (0.3x0.9+0.025=0.27+0.025=0.295); the maximum weight of the transaction frequency dimension is calculated as: (0.2x0.9+0.025=0.18+0.025=0.205); and the maximum weight of the merchant correlation dimension is calculated as: (0.15x0.9+0.025=0.135+0.025=0.16).Subsequently, the server multiplies the first risk level prediction value of each dimension by the corresponding maximum weight and sums them up to obtain a second risk level prediction: second prediction value = (2 x 0.34) + (2 x 0.295) + (1 x 0.205) + (0 x 0.16) = 0.68 + 0.59 + 0.205 = 1.475; the server presets a risk level threshold (based on historical risk event review and business tolerance): a comprehensive score < 0.5 is low risk, 0.5 < comprehensive score < 1.5 is medium risk, and a comprehensive score > 1.5 is high risk. The second risk level prediction value this time is 1.475, which is slightly lower than the high risk threshold, but because the target risk confidence score is 0.9 (very high confidence), the model determines that the strong risk signal of "amount anomaly + device environment anomaly" is sufficient to cover the slight score deviation, so the target risk level label is corrected upward to high risk. The server pushes the high risk label to the risk control system, triggering real-time freezing of the user account, sending a transaction verification notice to the user (such as "your account has a large amount of jewelry transaction in a certain period in a different place, is it operated by yourself?") and generating a risk report (recording "high confidence amount + device anomaly" features), etc., to achieve accurate risk early warning. This process introduces a target risk confidence modeling unit to integrate the reliability assessment of risk signals into weight adjustment, strengthening the influence of strong risk dimensions (such as amount and device anomaly), avoiding the rigid judgment of a single score threshold, and significantly improving the accuracy and adaptability of risk early warning.

[0041] In the embodiment of the application, the target feature analysis network corresponding to each risk dimension in the target risk rating model is used to perform behavior feature identification processing on the to-be-evaluated transaction data stream, and a target behavior feature vector corresponding to each risk dimension is obtained. The implementation can be performed through the following examples.

[0042] The target behavior feature encoder in the target feature analysis network corresponding to each risk dimension is used to perform behavior feature coding on the to-be-evaluated transaction data stream, and a target behavior feature code corresponding to each risk dimension is obtained.

[0043] The target risk feature hierarchical extractor in the target feature analysis network corresponding to each risk dimension is used to perform feature extraction on the target behavior feature code corresponding to each risk dimension, and a target behavior feature vector corresponding to each risk dimension is obtained.

[0044] In the embodiments of the present application, an exemplary financial institution server obtains a user's to-be-evaluated transaction data stream in real time through a transaction system, which contains 5 consecutive transactions of the user within a certain period of time, involving transaction amount (100 yuan, 5000 yuan, 800 yuan, 3000 yuan, 200 yuan), device ID (frequent device X, frequent device X, frequent device X, unfamiliar device Y, unfamiliar device Y), geographic location (frequent area A, frequent area A, frequent area A, unfamiliar area B, unfamiliar area B), merchant type (dining, jewelry, supermarket, electronics, dining), and other core fields. The server needs to extract the target behavior feature vector for the four core risk dimensions of amount anomaly, device environment, transaction frequency, and merchant association. The server splits the to-be-evaluated transaction data stream according to the risk dimensions and inputs the corresponding dimension target behavior feature encoder (all based on the Transformer sequence modeling module, which is used to convert the original transaction data into structured feature encoding and capture the association between transactions). Amount anomaly dimension: the server extracts the transaction amount sequence (100 yuan, 5000 yuan, 800 yuan, 3000 yuan, 200 yuan) in the data stream, first normalizes the amount (with the user's historical average amount of 200 yuan as the benchmark, converting it to a normalized value of 0.5, 25, 4, 15, 1), and then inputs it into the target behavior feature encoder of the amount anomaly dimension. The encoder learns the association between amounts (such as the sudden change of “100 yuan to 5000 yuan” and the continuous large amount of “5000 yuan to 3000 yuan”) through a multi-head self-attention mechanism, generating a 128-dimensional target behavior feature encoding (denoted as E_amt), which contains time sequence association information of the amount sequence. Device environment dimension: the server extracts the device ID sequence (X, X, X, Y, Y) and geographic location sequence (A, A, A, B, B) in the data stream, converts the device ID into a 128-dimensional embedding vector (the embedding vector of frequent device X is pre-trained from historical data), and converts the geographic location into a latitude and longitude embedding vector (the latitude and longitude of frequent area A are preset values, and the latitude and longitude of unfamiliar area B are new values), then concatenates the two into a 256-dimensional input, and inputs it into the target behavior feature encoder of the device environment dimension. The encoder learns the association between the device and the geographic location (such as the normal combination of “device X to area A” and the abnormal combination of “device Y to area B”) through a self-attention mechanism, generating a 128-dimensional target behavior feature encoding (denoted as E_dev), which contains collaborative anomaly information of the device and the geographic location. The server inputs the target behavior feature encoding of each dimension into the corresponding dimension target risk feature hierarchical extractor (all are deep learning modules containing dynamic enhancement, hierarchical extraction, and feature integration, which are used to extract hierarchical risk features from low-level statistical features to high-level semantic features from the encoding). Amount anomaly dimension: the server inputs E_amt into the target risk feature hierarchical extractor of the amount anomaly dimension.First, the dynamic feature enhancement component performs multi-head self-attention calculation on E_amt to generate an interaction correlation matrix of transaction amounts (a 5x5 matrix, with elements representing the correlation strength of the amounts of two transactions, such as the correlation strength of "5000 yuan→3000 yuan" being 0.9), and determines the dynamic weights of each transaction based on the matrix (larger transactions have higher weights, such as the weight of 5000 yuan being 0.35), and obtains the enhanced feature representation (denoted as F_amt_enh) through weighted aggregation, residual connection, and layer normalization. Next, the low-level feature extractor (2-layer MLP) extracts statistical features (such as the maximum amount of 5000 yuan, the average amount of 1820 yuan, and the amount standard deviation of 1980 yuan) from F_amt_enh to generate a low-level feature vector (denoted as F_amt_low). Then, the high-level feature abstractor (CNN) concatenates F_amt_low with E_amt, extracts semantic features (such as "sudden large amount" and "continuous high amount") through convolution operation, and generates a high-level feature vector (denoted as F_amt_high). Finally, the feature integrator aligns the dimensions of F_amt_low, F_amt_high, and E_amt (compressed to 128 dimensions), calls the trained weight matrix to calculate the fusion weights (such as F_amt_high accounting for 0.45), and generates the target behavior feature vector of the amount anomaly dimension (denoted as V_amt, 128 dimensions) through weighted combination, which contains core risk features such as "amount deviating from historical 99% percentile" and "abnormal amount accounting for 40%". Device environment dimension: The server inputs E_dev into the target risk feature layered extractor of the device environment dimension. First, the dynamic feature enhancement component performs self-attention calculation on E_dev to generate an interaction correlation matrix of devices and geographic locations (such as the correlation strength of "device Y→region B" being 0.95), determines the dynamic weights (strange devices and distant locations have higher weights), and obtains the enhanced feature representation (denoted as F_dev_enh). Next, the low-level feature extractor extracts statistical features (such as device replacement frequency of 1 time / hour and geographic location mutation distance (far beyond the normal traffic range)), and generates a low-level feature vector (denoted as F_dev_low). Then, the high-level feature abstractor concatenates F_dev_low with E_dev, extracts semantic features (such as "device replacement and distant transaction coordination anomaly"), and generates a high-level feature vector (denoted as F_dev_high). Finally, the feature integrator fuses F_dev_low, F_dev_high, and E_dev to generate the target behavior feature vector of the device environment dimension (denoted as V_dev, 128 dimensions), which contains core risk features such as "device switching from common X to strange Y" and "geographic location from A to B".Through the above process, the server obtains target behavior feature vectors (V_amt, V_dev, V_freq, V_mer) of four risk dimensions of amount anomaly, device environment, transaction frequency, and merchant correlation respectively, each vector containing hierarchical risk features (low-level statistical features and high-level semantic features) of the corresponding dimension, providing structured input for subsequent risk level prediction. This process captures the correlation between transactions through the target behavior feature encoder, and realizes hierarchical mining of features through the target risk feature hierarchical extractor, retaining the time sequence information of the original data and extracting high-value risk semantic features, laying a solid foundation for subsequent risk assessment.

[0045] In the embodiment of the application, the target risk feature hierarchical extractor corresponding to each risk dimension comprises a third dynamic feature enhancement component, a third high-order feature abstractor, a target risk feature extraction branch, and a third risk feature integrator; the target behavior feature code corresponding to each risk dimension is input into the target risk feature hierarchical extractor in the target feature analysis network corresponding to each risk dimension to perform a feature extraction operation, and a target behavior feature vector corresponding to each risk dimension is obtained, which can be implemented through the following examples.

[0046] The target behavior feature code corresponding to each risk dimension is input into the third dynamic feature enhancement component corresponding to each risk dimension to perform dynamic feature enhancement, and a third enhanced feature representation corresponding to each risk dimension is obtained.

[0047] The target behavior feature code corresponding to each risk dimension and the third enhanced feature representation corresponding to each risk dimension are input into the third high-order feature abstractor corresponding to each risk dimension to perform high-order feature abstraction, and a first target feature vector corresponding to each risk dimension is obtained.

[0048] The target behavior feature code corresponding to each risk dimension and the third enhanced feature representation corresponding to each risk dimension are input into the target risk feature extraction branch corresponding to each risk dimension to perform risk feature hierarchical extraction, and a fourth dimension feature vector corresponding to each risk dimension is obtained.

[0049] The fourth dimension feature vector corresponding to each risk dimension, the first target feature vector corresponding to each risk dimension, the target behavior feature code corresponding to each risk dimension, and the third enhanced feature representation corresponding to each risk dimension are input into the third risk feature integrator corresponding to each risk dimension to perform multi-dimensional risk feature integration, and a target behavior feature vector corresponding to each risk dimension is obtained.

[0050] In the embodiment of the application, the financial institution server has converted the amount sequence (100 yuan, 5000 yuan, 800 yuan, 3000 yuan, 200 yuan) in the user transaction data stream to be evaluated into a 128-dimensional target behavior feature code (denoted as E_amt) through the target behavior feature encoder, which captures the timing correlation between the amounts (such as the mutation of “100 yuan→5000 yuan”). Next, the server inputs E_amt into the target risk feature hierarchical extractor of the amount anomaly dimension, and performs the following steps: the server inputs E_amt into the third dynamic feature enhancement component (feature enhancement module based on multi-head self-attention mechanism). The component first performs multi-head self-attention calculation on E_amt: it maps E_amt into query (Query), key (Key), and value (Value) matrices through linear transformation, calculates the dot product of the query and the key to obtain the attention score (such as the attention score of “5000 yuan” and “3000 yuan” is 0.9, indicating that both are large-amount transactions and the correlation is high), and then normalizes the interaction correlation matrix (5x5 matrix, the element represents the amount correlation strength of the two transactions) through the Softmax function. Based on the interaction correlation matrix, the component determines the dynamic weight distribution of each transaction event (the weight of large-amount transactions is higher, such as the weight of 5000 yuan is 0.35, the weight of 3000 yuan is 0.25, and the weight of 100 yuan is 0.1). Subsequently, the component performs weighted aggregation operation on the value (Value) matrix in E_amt using the dynamic weight, generating an initial enhanced representation (128-dimensional). In order to preserve the original feature information, the component performs residual connection on the initial enhanced representation and E_amt (initial enhanced representation+E_amt), and adjusts the feature distribution through layer normalization (Layer Normalization), finally obtaining the third enhanced feature representation (denoted as F_amt_enh3, 128-dimensional). This representation strengthens the signal of key features such as large-amount transactions and weakens the interference of small-amount transactions. The server splices E_amt (original behavior feature code) and F_amt_enh3 (dynamic enhanced feature) into a 256-dimensional vector (fusion of original correlation and enhanced key features), and inputs it into the third high-order feature abstractor (CNN-based semantic feature extraction module). The abstractor performs convolution operation on the spliced vector through a 3x3 convolution kernel, extracts local correlation patterns in the amount sequence (such as the mutation pattern of “small amount→large amount→small amount” and the continuous pattern of “large amount→large amount”), and then compresses the feature dimension through the MaxPooling layer (MaxPooling), retaining the most significant pattern information. Subsequently, the abstractor maps the pooled features to high-level semantic features (such as “sudden large-amount transaction” and “continuous high-amount fluctuation”) through the fully connected layer (ReLU activation function), generating the first target feature vector (denoted as F_amt_high1, 64-dimensional). This vector no longer contains specific amount values, but abstracts the semantic information of “abnormal amount pattern”, which is more in line with the high-level needs of risk assessment.The server concatenates E_amt and F_amt_enh3 into a 256-dimensional vector and inputs it into the target risk feature extraction branch (a hierarchical feature extraction module based on MLP). The branch adopts a two-layer fully connected network: the first layer (input 256-dimensional, output 128-dimensional, ReLU activation) extracts low-level statistical features (such as the maximum amount of 5000 yuan, the average amount of 1820 yuan, and the amount standard deviation of 1980 yuan); the second layer (input 128-dimensional, output 128-dimensional, ReLU activation) extracts medium-level risk features (such as the degree of deviation of the amount from the historical 99% percentile, the proportion of abnormal amounts of 40% (2 large transactions accounting for 40% of the total transactions), and the interval time of large transactions (15 minutes)). Through hierarchical extraction, the branch generates a fourth-dimensional feature vector (denoted as F_amt_branch4, 128-dimensional). This vector contains specific risk statistical indicators and is the “quantitative basis” for risk assessment. The server inputs F_amt_branch4 (fourth-dimensional feature, quantitative indicator), F_amt_high1 (first target feature, semantic pattern), E_amt (original behavior code, time sequence association), and F_amt_enh3 (third enhanced feature, key signal) into the third risk feature integrator (a feature fusion module based on attention mechanism). The integrator performs the following operations: dimension alignment: compress F_amt_high1 (64-dimensional) to 128-dimensional through linear projection to keep consistent with other inputs (all 128-dimensional); weight calculation: call the attention weight matrix (128x4) learned in the training phase to calculate the fusion weight of each input feature (such as F_amt_branch4 accounting for 0.3, F_amt_high1 accounting for 0.4, E_amt accounting for 0.2, and F_amt_enh3 accounting for 0.1); weighted fusion: perform weighted linear combination on the four input features according to the fusion weight to generate intermediate fusion features (128-dimensional); nonlinear mapping and residual connection: introduce nonlinearity to the intermediate fusion features through the ReLU activation function, and then perform residual connection with E_amt (intermediate fusion features + E_amt); finally, adjust the feature distribution through layer normalization to generate the target behavior feature vector of the amount anomaly dimension (denoted as V_amt, 128-dimensional). V_amt integrates low-level statistical indicators (such as the proportion of abnormal amounts), medium-level risk features (such as the amount deviation), high-level semantic patterns (such as sudden large amounts), and original time sequence associations (such as transaction order), fully capturing all risk signals of the amount anomaly dimension and providing comprehensive feature input for subsequent risk level prediction. Through the above process, the server obtains the target behavior feature vector V_amt (128-dimensional) of the amount anomaly dimension. Similarly, the target risk feature hierarchical extractors of the device environment, transaction frequency, and merchant association dimensions follow this process to generate the target behavior feature vectors of the corresponding dimensions (such as V_dev, V_freq, and V_mer).These vectors will serve as the core input for subsequent risk assessment, supporting the server to achieve accurate transaction risk warning. This process enhances key signals through dynamic feature enhancement, extracts semantic patterns through high-order feature abstraction, obtains quantitative indicators through hierarchical feature branches, integrates multi-features to fuse all-level information, realizes the deep transformation from raw transaction data to structured risk features, and provides a solid feature foundation for risk assessment.

[0051] In the embodiment of the application, the target risk feature hierarchical extractor corresponding to each risk dimension includes a fourth dynamic feature enhancement component, a fourth high-order feature abstractor, a target risk feature extraction branch, and a fourth risk feature integrator, the target risk feature extraction branch corresponding to each risk dimension includes a first target risk feature hierarchical extractor and a second target risk feature hierarchical extractor; the target behavior feature vector corresponding to each risk dimension is obtained by inputting the target behavior feature code corresponding to each risk dimension into the target risk feature hierarchical extractor in the target feature analysis network corresponding to each risk dimension to perform a feature extraction operation.

[0052] The fourth enhanced feature representation corresponding to each risk dimension is obtained by inputting the target behavior feature code corresponding to each risk dimension into the fourth dynamic feature enhancement component corresponding to each risk dimension for dynamic feature enhancement.

[0053] The fifth dimension feature vector corresponding to each risk dimension is obtained by inputting the fourth enhanced feature representation corresponding to each risk dimension into the first target risk feature hierarchical extractor corresponding to each risk dimension for risk feature hierarchical extraction.

[0054] The second target feature vector corresponding to each risk dimension is obtained by inputting the fifth dimension feature vector corresponding to each risk dimension and the target behavior feature code corresponding to each risk dimension into the fourth high-order feature abstractor corresponding to each risk dimension for high-order feature abstraction.

[0055] The sixth dimension feature vector corresponding to each risk dimension is obtained by inputting the second target feature vector corresponding to each risk dimension into the second target risk feature hierarchical extractor corresponding to each risk dimension for risk feature hierarchical extraction.

[0056] The target behavior feature vector corresponding to each risk dimension is obtained by inputting the sixth dimension feature vector corresponding to each risk dimension, the fifth dimension feature vector corresponding to each risk dimension, and the target behavior feature code corresponding to each risk dimension into the fourth risk feature integrator corresponding to each risk dimension for multi-dimensional risk feature integration.

[0057] In the embodiment of the application, the financial institution server has converted the amount sequence (100 yuan, 5000 yuan, 800 yuan, 3000 yuan, 200 yuan) in the user transaction data stream to be evaluated into a 128-dimensional target behavior feature code (denoted as E_amt) through the target behavior feature encoder, which captures the time sequence correlation between the amounts (such as the mutation of “100 yuan→5000 yuan”). Next, the server inputs E_amt into the target risk feature hierarchical extractor of the amount anomaly dimension, and performs the following steps: the server inputs E_amt into the fourth dynamic feature enhancement component (feature enhancement module based on multi-head self-attention mechanism). The component first performs multi-head self-attention calculation on E_amt (using 8 attention heads), maps E_amt into query (Query), key (Key), and value (Value) matrices through linear transformation, calculates the dot product of the query and the key to obtain the attention score (such as the attention score of “5000 yuan” and “3000 yuan” is 0.92, indicating that both are large-amount transactions and the correlation degree is high), and then normalizes the interaction correlation matrix (5x5 matrix, the element represents the amount correlation strength of the two transactions) through the Softmax function. Based on the matrix, the component determines the dynamic weight distribution of each transaction event (the weight of large-amount transactions is higher, such as the weight of 5000 yuan is 0.38, the weight of 3000 yuan is 0.27, and the weight of 100 yuan is 0.09). Subsequently, the component performs weighted aggregation operation on the value (Value) matrix in E_amt using the dynamic weight to generate an initial enhanced representation (128-dimensional). In order to preserve the original feature information, the component performs residual connection (initial enhanced representation+E_amt) on the initial enhanced representation and E_amt, adjusts the feature distribution through layer normalization (Layer Normalization), and finally obtains the fourth enhanced feature representation (denoted as F_amt_enh4, 128-dimensional). The representation strengthens the signal of key features such as large-amount transactions and weakens the interference of small-amount transactions. The server inputs F_amt_enh4 into the first target risk feature hierarchical extractor (MLP-based hierarchical feature extraction module). The hierarchical extractor adopts a two-layer fully connected network: the first layer (input 128-dimensional, output 128-dimensional, ReLU activation) extracts low-level statistical features (such as the maximum transaction amount 5000 yuan, the average transaction amount 1820 yuan, and the amount standard deviation 1980 yuan); the second layer (input 128-dimensional, output 128-dimensional, ReLU activation) extracts middle-level risk features (such as the degree of deviation of the amount from the user's historical 99% percentile (25 times), the proportion of abnormal amounts (40%, 2 large-amount transactions account for 40% of the total transactions), and the interval time between large-amount transactions (15 minutes)). Through hierarchical extraction, the hierarchical extractor generates a fifth-dimensional feature vector (denoted as F_amt_low5, 128-dimensional). The vector contains specific risk statistical indicators and is the “quantitative basis” for risk assessment.The server concatenates F_amt_low5 (fifth dimension feature, quantified indicator) and E_amt (original behavior code, time series association) into a 256-dimensional vector (fusion of quantified features and original association information), and inputs it into the fourth high-order feature abstractor (CNN-based semantic feature extraction module). The abstractor performs convolution operation on the concatenated vector through 3x3 convolution kernel (64), extracts local association patterns in the amount sequence (such as "small amount → large amount → small amount" mutation pattern, "large amount → large amount" continuous pattern), and then compresses the feature dimension through the max pooling layer (pooling window size 2) to retain the most significant pattern information. Subsequently, the abstractor maps the pooled features into high-level semantic features (such as "sudden large amount transaction" "continuous high amount fluctuation") through the fully connected layer (input 128-dimensional, output 64-dimensional, ReLU activation), generating a second target feature vector (denoted as F_amt_high2, 64-dimensional). This vector no longer contains specific amount values, but abstracts the semantic information of "abnormal amount pattern", which is more in line with the high-level needs of risk assessment. The server inputs F_amt_high2 into the second target risk feature layering device (MLP-based deepening feature extraction module). The layering device adopts a three-layer fully connected network (input 64-dimensional, intermediate layer 128-dimensional, output 128-dimensional, all using ReLU activation), further extracts core risk features (such as "abnormal amount combination pattern" (large amount + short interval), "high-risk amount threshold breakthrough times" (2 times breakthrough 500 yuan threshold)). Through deepening extraction, the layering device generates a sixth dimension feature vector (denoted as F_amt_core6, 128-dimensional). This vector focuses on the "core risk pattern" of amount anomaly, which is the "key basis" for risk assessment. The server inputs F_amt_core6 (sixth dimension feature, core risk pattern), F_amt_low5 (fifth dimension feature, quantified indicator), and E_amt (original behavior code, time series association) into the fourth risk feature integrator (attention mechanism-based feature fusion module).The integrator performs the following operations: dimension alignment: keeping F_amt_core6 (128 dimensions), F_amt_low5 (128 dimensions) and E_amt (128 dimensions) consistent in dimension (all 128 dimensions) through linear projection; weight calculation: calling the attention weight matrix (128*3) learned in the training stage to calculate the fusion weight of each input feature (e.g., F_amt_core6 accounts for 0.45, F_amt_low5 accounts for 0.35, and E_amt accounts for 0.2); weighted fusion: performing weighted linear combination on the three input features according to the fusion weight to generate an intermediate fusion feature (128 dimensions); nonlinear mapping and residual connection: introducing nonlinearity to the intermediate fusion feature through a ReLU activation function, and then performing residual connection with E_amt (intermediate fusion feature + E_amt), and finally adjusting the feature distribution through layer normalization to generate the target behavior feature vector of the amount abnormal dimension (denoted as V_amt, 128 dimensions). V_amt integrates low-level statistical indicators (such as the proportion of abnormal amount), medium-level risk features (such as the amount deviation degree), high-level semantic patterns (such as sudden large amount), and original time sequence correlation (such as transaction order), and fully captures all risk signals of the amount abnormal dimension, providing comprehensive feature input for subsequent risk level prediction. Through the above process, the server obtains the target behavior feature vector V_amt (128 dimensions) of the amount abnormal dimension. Similarly, the target risk feature extractors of the device environment, transaction frequency, and merchant association dimensions all process according to this process, and generate the target behavior feature vectors of the corresponding dimensions (such as V_dev, V_freq, and V_mer). These vectors will serve as the core input for subsequent risk assessment, supporting the server to achieve accurate transaction risk early warning. This process strengthens key signals through dynamic feature enhancement, obtains multi-dimensional quantitative features through hierarchical extraction, extracts semantic patterns through high-order abstraction, deepens the focus on core risks through hierarchical deepening, and integrates and fuses all-level information through multi-feature integration, realizing the deep transformation from raw transaction data to structured risk features, and providing a solid feature foundation for risk assessment.

[0058] In the embodiment of the present application, the dynamic feature enhancement of the target behavior feature encoding input into the fourth dynamic feature enhancement component corresponding to each risk dimension can be implemented through the following examples.

[0059] Perform multi-head self-attention calculation on the target behavior feature encoding to generate an interaction correlation matrix;

[0060] Based on the interaction correlation matrix, determine the dynamic weight distribution of the transaction event features in the to-be-evaluated transaction data stream;

[0061] According to the dynamic weight distribution, perform a weighted aggregation operation on the target behavior feature encoding to generate an initial enhanced representation;

[0062] The initial enhanced representation is connected with layer normalization processing through a residual connection to generate the fourth enhanced feature representation.

[0063] In the embodiments of the present application, for example, the technical process of the fourth dynamic feature enhancement component is described in detail by taking the dynamic enhancement of the target behavior feature encoding of a user's abnormal dimension of amount by a financial institution server as an example. The financial institution server has converted the 5 amount sequences (100 yuan, 5000 yuan, 800 yuan, 3000 yuan, and 200 yuan) in the user's transaction data stream to be evaluated into 128-dimensional target behavior feature encoding (denoted as E_amt) through the target behavior feature encoder. E_amt captures the time sequence association between the amounts (such as the mutation of “100 yuan→5000 yuan” and the continuous large amount of “5000 yuan→3000 yuan”) through the Transformer self-attention mechanism, which is the basis input for subsequent feature extraction. The server inputs E_amt into the multi-head self-attention layer (with 8 attention heads) of the fourth dynamic feature enhancement component. First, E_amt (128-dimensional) is mapped into a query matrix Q (128-dimensional), a key matrix K (128-dimensional), and a value matrix V (128-dimensional) through linear transformation. Then, the dot product attention score of each attention head is calculated: wherein Q i , K i , and V i are the sub-matrices of the i-th attention head (each head processes 16-dimensional features, 128-dimensional / 8 heads = 16-dimensional), d k = 16 is the key vector dimension used to scale the dot product result to avoid the gradient vanishing of Softmax due to too large numerical value. Taking the 2nd transaction (5000 yuan) and the 4th transaction (3000 yuan) as examples, the Q i and K iThe dot product result is scaled to 0.92 (indicating a very high degree of correlation, all large transactions); the dot product result of the first transaction (100 yuan) and the fifth transaction (200 yuan) is 0.15 (low correlation, both small transactions). Each attention head generates a 5x5 correlation sub-matrix (5 transactions), and the sub-matrix of 8 heads is spliced and combined into the final interaction correlation matrix (5x5, element value range 0-1) through linear transformation. The matrix clearly presents the amount correlation strength of each transaction with other transactions, such as the correlation strength of the second transaction (5000 yuan) with the fourth transaction (3000 yuan) is 0.92, and the correlation strength with the first transaction (100 yuan) is 0.08. The server performs Softmax normalization on each row of the interaction correlation matrix (representing the correlation strength of a certain transaction with all other transactions) to obtain the dynamic weight of the transaction event (the sum of the weights is 1). For example: the row vector of the second transaction (5000 yuan) is [0.08, 0.45, 0.12, 0.30, 0.05 (corresponding to the correlation strength with the first to fifth transactions)], and after Softmax normalization, the dynamic weight is 0.38 (the highest proportion, because the transaction has the strongest correlation with other large transactions); the row vector of the fourth transaction (3000 yuan) is [0.10, 0.35, 0.15, 0.32, 0.08], and after normalization, the dynamic weight is 0.27; the row vector of the third transaction (800 yuan) is [0.20, 0.18, 0.30, 0.22, 0.10], and after normalization, the dynamic weight is 0.18; the row vector of the fifth transaction (200 yuan) is [0.30, 0.15, 0.20, 0.25, 0.10], and after normalization, the dynamic weight is 0.10; the row vector of the first transaction (100 yuan) is [0.40, 0.10, 0.25, 0.15, 0.10], and after normalization, the dynamic weight is 0.07. The dynamic weight distribution focuses on large transactions (the weights of the second and fourth transactions are 0.65 in total), and weakens the influence of small transactions (the weights of the first and fifth transactions are 0.17 in total), which is consistent with the risk focus of the "amount anomaly" dimension. The server combines the value matrix V (128 dimensions, from the linear transformation of the target behavior feature encoding) with the dynamic weight distribution to perform weighted aggregation: where w t is the dynamic weight of the tthtransaction (such as w_2=0.38), and V tV vector of the tth transaction (128 dimensions). Taking the 2nd transaction (5000 yuan) as an example, its V vector contains the characteristic signal of "large transaction", multiplied by the weight 0.38, and becomes the core contributor of the initial enhanced representation; the V vector of the 4th transaction (3000 yuan) is multiplied by the weight 0.27, which supplements the characteristic signal of "sustained large amount"; the V vector of the small transaction is low in weight and has negligible effect on the initial enhanced representation. The final generated initial enhanced representation (128 dimensions) strengthens the key features such as "large transaction" and "sustained large amount", and weakens the interference of "small transaction". In order to retain the time sequence correlation information (such as transaction order) of the original target behavior feature code, the server performs element-wise addition on the initial enhanced representation and the original E_amt: residual connection result = initial enhanced representation + E_amt; after residual connection, the server performs layer normalization on the result to adjust the feature distribution (normalizing the mean to 0 and the variance to 1) to avoid gradient vanishing caused by excessively large feature values. Finally, the fourth enhanced feature representation (denoted as F_amt_enh4, 128 dimensions) is generated. F_amt_enh4 fuses the key features of dynamic enhancement (large transaction signal) and the original time sequence correlation (transaction order), highlighting the core risk signal of the amount anomaly and retaining the original structure of the transaction data, laying a foundation for subsequent hierarchical feature extraction. Through the above process, the server obtains the fourth enhanced feature representation F_amt_enh4 (128 dimensions) of the amount anomaly dimension. This representation will be used as the input of the subsequent first target risk feature layerizer to further extract low-level statistical features (such as maximum amount and abnormal amount proportion). Similarly, the target behavior feature codes of the device environment and transaction frequency dimensions are processed by the fourth dynamic feature enhancement component to generate the fourth enhanced feature representation of the corresponding dimension, supporting subsequent risk feature extraction. This process captures the correlation between transactions through multi-head self-attention, focuses on key features through dynamic weights, strengthens risk signals through weighted aggregation, retains original information through residual connection and layer normalization, and realizes precise enhancement of target behavior feature coding, providing more effective feature input for risk assessment.

[0064] In the embodiment of the application, the multi-dimensional risk feature integration of the sixth-dimensional feature vector corresponding to each risk dimension, the fifth-dimensional feature vector corresponding to each risk dimension and the target behavior feature code corresponding to each risk dimension into the fourth risk feature integrator corresponding to each risk dimension can be implemented through the following examples.

[0065] Perform a dimension alignment operation on the input sixth-dimensional feature vector, fifth-dimensional feature vector and target behavior feature code to obtain a projection feature representation of uniform dimensions;

[0066] The fusion weight coefficients of each feature vector in the projection feature representation are calculated by calling the weight matrix obtained in the training phase;

[0067] Based on the fusion weight coefficients, a weighted linear combination operation is performed on the projection feature representation;

[0068] The weighted result is mapped through a nonlinear activation function to generate a fusion feature vector;

[0069] The fusion feature vector and the target behavior feature code are connected by residual connection and normalized to generate the target behavior feature vector.

[0070] In the embodiment of the present application, an exemplary embodiment is taken as an example of the integration of multi-dimensional risk features of the financial institution server on the amount anomaly dimension of a certain user to illustrate the technical process of the "fourth risk feature integrator" in detail. The financial institution server has obtained three input features of the amount anomaly dimension through the previous steps of the target risk feature layering extractor: the sixth-dimensional feature vector (denoted as F_amt_core6, 128 dimensions): containing "abnormal amount combination mode (large transaction + 15-minute short interval)" "high-risk amount threshold (500 yuan) breakthrough times (2 times)" and other core risk pattern features; the fifth-dimensional feature vector (denoted as F_amt_low5, 128 dimensions): containing "maximum transaction amount 5000 yuan" "average transaction amount 1820 yuan" "abnormal amount proportion 40% (2 large transactions account for 40% of the total transactions)" and other quantitative risk indicators; and the target behavior feature code (denoted as E_amt, 128 dimensions): containing "100 yuan→5000 yuan→800 yuan→3000 yuan→200 yuan" transaction amount time sequence correlation features. The server inputs F_amt_core6 (core risk pattern), F_amt_low5 (quantitative indicator), and E_amt (time sequence correlation) into the dimension alignment module of the fourth risk feature integrator. Although the three features are all 128 dimensions, in order to eliminate the distribution differences of the features extracted by different modules (such as F_amt_core6 from semantic abstraction and E_amt from time sequence coding), the integrator projects each feature through a linear projection layer (input 128 dimensions, output 128 dimensions, and the weights are learned in the training stage): F_amt_core6 generates a projected core feature (P_core, 128 dimensions) after linear projection, retaining the semantic information of the "abnormal amount combination mode"; F_amt_low5 generates a projected quantitative feature (P_low, 128 dimensions) after linear projection, retaining the "maximum amount" "abnormal proportion" and other quantitative indicators; and E_amt generates a projected time sequence feature (P_seq, 128 dimensions) after linear projection, retaining the structure information of the "transaction amount time sequence correlation". After dimension alignment, the three projected features are in the same feature space, laying a foundation for subsequent fusion. The server calls the attention weight matrix (W_att, 128x3, corresponding to the three projected features) learned in the training stage to calculate the fusion weight coefficients (the sum of the weights is 1) of each projected feature. The core logic of the attention mechanism is to give higher weights to features that are more important for risk assessment. Taking the amount anomaly dimension as an example, high-risk samples (such as fraud) in the training data usually contain "core risk patterns" (such as large + short interval) and "quantitative indicators" (such as high abnormal amount proportion), and "time sequence correlation" is auxiliary information.Therefore, the weight distribution of W_att to the three projected features is: P_core (core risk pattern): 0.45 (highest proportion, because the core pattern is a direct manifestation of risk); P_low (quantitative indicator): 0.35 (second, because the quantitative indicator is a quantitative basis for risk); P_seq (time sequence correlation): 0.2 (lowest, because the time sequence correlation is auxiliary information). The fusion weight is normalized by the Softmax function to ensure that the sum of the weights is 1. The server multiplies the three projected features with the corresponding fusion weights, and then linearly combines (element addition) to generate the intermediate fusion feature (F_merge, 128 dimensions): F_merge = 0.45·P_core + 0.35·P_low + 0.2·P_seq; Taking the "abnormal amount combination pattern" feature in P_core as an example, its value is 0.9 (indicating high intensity of this pattern), multiplied by the weight 0.45, it contributes 0.405 to F_merge; the "abnormal amount proportion 40%" feature in P_low has a value of 0.8, multiplied by the weight 0.35, it contributes 0.28 to F_merge; the "100 yuan -> 5000 yuan" time sequence correlation feature in P_seq has a value of 0.7, multiplied by the weight 0.2, it contributes 0.14 to F_merge. F_merge fuses the key information of the three features, highlighting the contribution of "core risk pattern" and "quantitative indicator". To capture the complex relationship between features, the server inputs F_merge into the ReLU activation function (sets negative values to 0 and preserves positive values), strengthens useful features (such as the positive signal of "core risk pattern"), and suppresses noise: F_fusion = ReLU(F_merge); for example, a certain dimension in F_merge has a value of -0.1 (noise), which becomes 0 after ReLU; a certain dimension has a value of 0.6 (useful feature), which remains 0.6. Finally, the fusion feature vector (F_fusion, 128 dimensions) is generated, which contains multi-dimensional risk features after non-linear transformation. To preserve the time sequence correlation information of the original target behavior feature encoding (such as transaction order), the server performs residual connection (element addition) between F_fusion (fusion feature) and E_amt (original target behavior feature encoding): F_res = F_fusion + E_amt; After residual connection, the server performs layer normalization (normalizes the mean to 0 and the variance to 1) on F_res to avoid large feature values causing gradient vanishing in subsequent modules (such as the target risk assessment unit), while enhancing the model's generalization ability. Finally, the target behavior feature vector in the amount anomaly dimension (V_amt, 128 dimensions) is generated.V_amt fuses the core risk pattern (P_core), quantitative indicators (P_low), and time sequence correlation (P_seq) three types of features, highlights the core risk signals of the amount anomaly (such as the "large amount + short interval" pattern), and retains the original structure of the transaction data (such as the transaction order), thereby providing comprehensive and accurate feature inputs for subsequent risk level prediction. Through the above process, the server obtains V_amt (128 dimensions) in the amount anomaly dimension. Similarly, the features in the device environment, transaction frequency, and other dimensions are processed by the fourth risk feature integrator to generate the target behavior feature vectors in the corresponding dimensions (such as V_dev and V_freq). These vectors will serve as the core inputs for subsequent risk assessment, supporting the server to implement accurate transaction risk early warning. This process aligns the feature space through dimension alignment, focuses on key features through attention weight, fuses multi-dimensional information through weighted combination, captures complex relationships through nonlinear mapping, retains original information through residual connection and regularization, and accurately integrates multi-dimensional risk features, thereby providing a solid feature foundation for risk assessment.

[0071] In the embodiments of the present application, the target risk rating model is obtained through the following process, including:

[0072] obtain a first sample transaction behavior sequence data set;

[0073] input the first sample transaction behavior sequence data set into the sample feature analysis network corresponding to each of the plurality of risk dimensions in the initial risk feature coding model to perform behavior feature identification processing, and obtain a sample dimension feature vector corresponding to each risk dimension;

[0074] determine a feature independence loss corresponding to a risk dimension combination based on the sample dimension feature vectors corresponding to the risk dimension combination; the risk dimension combination is any two of the plurality of risk dimensions;

[0075] train the sample risk feature extraction branch corresponding to the risk dimension combination based on the feature independence loss corresponding to the risk dimension combination, and obtain the target risk rating model.

[0076] In the embodiments of the present application, the sample feature analysis network corresponding to each risk dimension includes a sample behavior feature encoder and a sample risk feature hierarchical extractor, the sample risk feature hierarchical extractor includes a first dynamic feature enhancement component, a first high-order feature abstractor, a sample risk feature extraction branch, and a first risk feature integrator; the first sample transaction behavior sequence data set is input into the sample feature analysis network corresponding to each of the plurality of risk dimensions in the initial risk feature coding model to perform behavior feature identification processing, and obtain a sample dimension feature vector corresponding to each risk dimension, which can be implemented through the following example.

[0077] inputting the first sample transaction behavior sequence dataset into the sample behavior feature encoder corresponding to each risk dimension to perform behavior feature coding, to obtain sample behavior feature coding corresponding to each risk dimension;

[0078] inputting the sample behavior feature coding corresponding to each risk dimension into the first dynamic feature enhancement component corresponding to each risk dimension to perform dynamic feature enhancement, to obtain first enhanced feature representation corresponding to each risk dimension;

[0079] inputting the first enhanced feature representation corresponding to each risk dimension and the sample behavior feature coding corresponding to each risk dimension into the first high-order feature abstractor corresponding to each risk dimension to perform high-order feature abstraction, to obtain first sample feature vector corresponding to each risk dimension;

[0080] inputting the first enhanced feature representation corresponding to each risk dimension and the sample behavior feature coding corresponding to each risk dimension into the sample risk feature extraction branch corresponding to each risk dimension to perform risk feature hierarchical extraction, to obtain first dimension feature vector corresponding to each risk dimension;

[0081] inputting the first sample feature vector corresponding to each risk dimension, the first dimension feature vector corresponding to each risk dimension, the first enhanced feature representation corresponding to each risk dimension and the sample behavior feature coding corresponding to each risk dimension into the first risk feature integrator corresponding to each risk dimension to perform multi-dimensional risk feature integration, to obtain second sample feature vector corresponding to each risk dimension.

[0082] In the embodiments of the present application, the following implementations are further provided.

[0083] obtaining a first risk level label corresponding to each sample transaction behavior sequence in the first sample transaction behavior sequence dataset;

[0084] inputting the second sample feature vector corresponding to each risk dimension into the sample risk assessment unit corresponding to each risk dimension in the initial risk feature coding model to perform risk assessment, to obtain third risk level prediction corresponding to each risk dimension;

[0085] inputting the first sample transaction behavior sequence dataset into the sample risk confidence modeling unit in the initial risk feature coding model to perform risk confidence assessment, to obtain a sample risk confidence score corresponding to each sample transaction behavior sequence in the first sample transaction behavior sequence dataset;

[0086] predicting a third risk level corresponding to each of the plurality of risk dimensions based on the sample risk confidence score, to obtain a fourth risk level prediction corresponding to each sample transaction behavior sequence in the first sample transaction behavior sequence data set;

[0087] determining a first confidence loss based on the fourth risk level prediction and the first risk level label;

[0088] The training of the sample risk feature extraction branch corresponding to the risk dimension combination based on the feature independence loss corresponding to the risk dimension combination, to obtain the target risk rating model, comprises:

[0089] The training of the sample risk feature extraction branch corresponding to the risk dimension combination based on the feature independence loss corresponding to the risk dimension combination, and the training of the sample risk confidence modeling unit based on the first confidence loss, to obtain the target risk rating model.

[0090] In the embodiment of the application, the sample feature analysis network corresponding to each risk dimension comprises a sample behavior feature encoder and a sample risk feature hierarchical extractor, the sample risk feature hierarchical extractor comprises a second dynamic feature enhancement component, a second high-order feature abstractor, a sample risk feature extraction branch and a second risk feature integrator, the sample risk feature extraction branch comprises a first sample risk feature hierarchical extractor and a second sample risk feature hierarchical extractor; the behavior feature recognition processing of the sample feature analysis network corresponding to each of the plurality of risk dimensions in the initial risk feature coding model by inputting the first sample transaction behavior sequence data set, to obtain the sample dimension feature vector corresponding to each risk dimension, can be implemented by the following examples.

[0091] The behavior feature coding of the sample behavior feature encoder corresponding to each risk dimension by inputting the first sample transaction behavior sequence data set, to obtain the sample behavior feature coding corresponding to each risk dimension;

[0092] The dynamic feature enhancement of the second dynamic feature enhancement component corresponding to each risk dimension by inputting the sample behavior feature coding corresponding to each risk dimension, to obtain the second enhanced feature representation corresponding to each risk dimension;

[0093] The risk feature hierarchical extraction of the first sample risk feature hierarchical extractor corresponding to each risk dimension by inputting the second enhanced feature representation corresponding to each risk dimension, to obtain the second dimension feature vector corresponding to each risk dimension;

[0094] inputting the third sample feature vector corresponding to each risk dimension into a second sample risk feature layering unit corresponding to each risk dimension to perform risk feature layering extraction, to obtain a third dimension feature vector corresponding to each risk dimension;

[0095] inputting the third dimension feature vector corresponding to each risk dimension, the second dimension feature vector corresponding to each risk dimension, and the sample behavior feature code corresponding to each risk dimension into a second risk feature integrator corresponding to each risk dimension to perform multi-dimensional risk feature integration, to obtain a fourth sample feature vector corresponding to each risk dimension.

[0096] inputting the third dimension feature vector corresponding to each risk dimension, the second dimension feature vector corresponding to each risk dimension, and the sample behavior feature code corresponding to each risk dimension into a second risk feature integrator corresponding to each risk dimension to perform multi-dimensional risk feature integration, to obtain a fourth sample feature vector corresponding to each risk dimension.

[0097] In the embodiments of the present application, the following implementation modes are further provided.

[0098] obtaining a first risk level label corresponding to each sample transaction behavior sequence in the first sample transaction behavior sequence data set;

[0099] inputting the fourth sample feature vector corresponding to each risk dimension into a sample risk assessment unit corresponding to each risk dimension in the initial risk feature coding model to perform risk assessment, to obtain a fifth risk level prediction corresponding to each risk dimension;

[0100] inputting the first sample transaction behavior sequence data set into a sample risk confidence modeling unit in the initial risk feature coding model to perform risk confidence assessment, to obtain a sample risk confidence score corresponding to each sample transaction behavior sequence in the first sample transaction behavior sequence data set;

[0101] based on the sample risk confidence score, performing risk weighted decision on the fifth risk level prediction corresponding to each of the plurality of risk dimensions, to obtain a sixth risk level prediction corresponding to each sample transaction behavior sequence in the first sample transaction behavior sequence data set;

[0102] based on the sixth risk level prediction and the first risk level label, determining a second confidence loss;

[0103] based on the feature independence loss corresponding to the risk dimension combination, training the sample risk feature extraction branch corresponding to the risk dimension combination, to obtain the target risk rating model, including:

[0104] based on the feature independence loss corresponding to the combination of risk dimensions, training the sample risk feature extraction branch corresponding to the combination of risk dimensions, and based on the second confidence loss, training the sample risk confidence modeling unit, to obtain the target risk rating model.

[0105] In the embodiments of the present application, the following implementation modes are further provided.

[0106] obtaining a second sample transaction behavior sequence data set and a second risk level label corresponding to each sample transaction behavior sequence in the second sample transaction behavior sequence data set;

[0107] inputting the second sample transaction behavior sequence data set into the sample feature analysis network corresponding to each risk dimension in the initial risk feature encoding model for behavior feature identification processing, to obtain a fifth sample feature vector corresponding to each risk dimension;

[0108] inputting the fifth sample feature vector corresponding to each risk dimension into the sample risk assessment unit corresponding to each risk dimension for risk assessment, to obtain a seventh risk level prediction corresponding to each risk dimension;

[0109] based on the seventh risk level prediction corresponding to each risk dimension and the second risk level label, determining a dimension risk loss corresponding to each risk dimension;

[0110] The training of the sample risk feature extraction branch corresponding to the combination of risk dimensions based on the feature independence loss corresponding to the combination of risk dimensions includes:

[0111] based on the feature independence loss corresponding to the combination of risk dimensions, training the sample risk feature extraction branch corresponding to the combination of risk dimensions, and based on the dimension risk loss corresponding to each risk dimension, training the sample multi-dimensional feature encoding backbone corresponding to each risk dimension in the initial risk feature encoding model, to obtain the target risk rating model; the sample multi-dimensional feature encoding backbone corresponding to each risk dimension is a branch structure in the sample feature analysis network corresponding to each risk dimension, except for the sample risk feature extraction branch corresponding to each risk dimension.

[0112] In the embodiments of the present application, an exemplary server extracts user continuous transaction data of the past 6 months from a financial institution transaction system database, and constructs two types of sample data sets: a first sample transaction behavior sequence data set: data content: contains 2 million user 5 continuous transaction sequences, covering normal transactions (such as dining, supermarket small consumption) and risk transactions (such as out-of-town large-scale fraud, large-scale consumption within 1 hour after device replacement). Each transaction record contains transaction amount, device ID, geographic location, merchant type, transaction time and other fields. Label annotation: through artificial review and rule engine (such as "out-of-town + large + device replacement" to determine high risk), label the overall risk level label (150 million low-risk, 300 thousand medium-risk, 200 thousand high-risk) for each sequence. Example: User B's transaction sequence (labeled as high risk): [100 yuan (dining, common device X, common area A) → 5000 yuan (jewelry, common device X, common area A) → 800 yuan (supermarket, common device X, common area A) → 3000 yuan (electronics, unfamiliar device Y, unfamiliar area B) → 200 yuan (dining, unfamiliar device Y, unfamiliar area B)]. The second sample transaction behavior sequence data set: data content: contains 500,000 user 5 continuous transaction sequences, the data structure is consistent with the first sample, but the label is more detailed, and each risk dimension of each sequence is labeled with a separate risk level (such as "amount anomaly: high risk" "device environment: high risk" "transaction frequency: medium risk"). Use: to strengthen the risk discrimination ability of each risk dimension feature (such as the amount anomaly dimension feature needs to accurately distinguish "normal amount fluctuation" and "abnormal large amount"). The server loads the initial risk feature coding model, which is composed of three core components: a multi-risk dimension sample feature analysis network: for amount anomaly, device environment, transaction frequency, and merchant association, each dimension corresponds to a sample feature analysis network (including sample behavior feature encoder and sample risk feature hierarchical extractor), which is used to extract the sample dimension feature vector of the dimension from the transaction sequence (capture hierarchical risk features from statistics to semantics). Sample risk assessment unit: each risk dimension corresponds to an MLP classifier, which inputs the sample dimension feature vector of the dimension and outputs the risk level prediction of the dimension (such as the amount anomaly dimension outputs "high risk"). Sample risk confidence modeling unit: an MLP model that inputs the complete transaction sequence and outputs the risk confidence score (0-1, the higher the score, the stronger the model's confidence in risk prediction).

[0113] Taking the amount abnormal dimension as an example, the server inputs the first sample transaction behavior sequence data set into the sample feature analysis network of this dimension, and performs the following steps (all operations are taken as the main body of the server): sample behavior feature coding (sample behavior feature encoder): the server converts the transaction amount sequence in the sample (such as user B’s [100 yuan, 5000 yuan, 800 yuan, 3000 yuan, 200 yuan]) into a normalized value (based on the user’s historical average amount of 200 yuan, [0.5, 25, 4, 15, 1] is obtained), and is input into the Transformer encoder (6 layers, 8 heads of self-attention mechanism). The encoder captures the time sequence association between the amounts (such as the sudden surge of “100 yuan to 5000 yuan” and the continuous large amount of “5000 yuan to 3000 yuan”) through multi-head self-attention, and generates a 128-dimensional sample behavior feature code (denoted as E_amt_sample). This code retains the time sequence structure and association information of the transaction amount. Dynamic feature enhancement (first dynamic feature enhancement component): the server inputs E_amt_sample into the first dynamic feature enhancement component (feature enhancement module based on multi-head self-attention): interaction association calculation: E_amt_sample is mapped to a “query (Q)” “key (K)” “value (V)” matrix through linear transformation, the dot product of “query” and “key” is calculated, and the association strength between transactions is obtained (such as the association strength between “5000 yuan” and “3000 yuan” is 0.92, indicating that both are large transactions and the association is very high; the association strength between “100 yuan” and “5000 yuan” is 0.08, and the association is very low). Dynamic weight distribution: Softmax normalization is performed on the association strength of each transaction to obtain dynamic weights (such as “5000 yuan” weight 0.38, “3000 yuan” weight 0.27, and small amount transaction weight <0.1). The higher the weight, the greater the risk contribution of the transaction to the “amount abnormal” dimension. Weighted enhancement and residual retention: the dynamic weights are used to weight and sum the “value (V)” matrix to generate an initial enhanced representation (strengthening key features such as large transactions); then the initial enhanced representation is connected with E_amt_sample in residual (retaining the original time sequence information), and the feature distribution is adjusted through layer normalization to obtain the first enhanced feature representation (denoted as F_amt_enh1, 128-dimensional). High-order feature abstraction (first high-order feature abstractor): the server splices F_amt_enh1 (dynamic enhanced feature) and E_amt_sample (original code) into a 256-dimensional vector, and inputs it into the first high-order feature abstractor (CNN-based semantic feature extraction module): pattern extraction: local association patterns in the amount sequence (such as the sudden abnormal pattern of “small amount → large amount → small amount” and the continuous high-risk pattern of “large amount → large amount”) are extracted through a 3x3 convolution kernel (64 channels).Semantic mapping: compress the feature dimension through the max-pooling layer (window size 2), and then map the pooled features to high-level semantic features (such as "sudden large transaction" and "continuous high amount fluctuation") through the fully connected layer (ReLU activation function) to generate the first sample feature vector (denoted as F_amt_high1, 64-dimensional). This vector no longer contains specific amount values, but abstracts semantic information of "amount abnormal pattern". Risk feature hierarchical extraction (sample risk feature extraction branch): the server concatenates F_amt_enh1 and E_amt_sample into a 256-dimensional vector, which is input into the sample risk feature extraction branch (2-layer MLP network): low-level statistical features: the first layer (input 256-dimensional, output 128-dimensional) extracts statistical indicators (such as maximum transaction amount 5000 yuan, average transaction amount 1820 yuan, and amount standard deviation 1980 yuan); middle-level risk features: the second layer (input 128-dimensional, output 128-dimensional) extracts risk quantification indicators (such as the degree of deviation of amount from user history 99% quantile, and abnormal amount proportion 40% (2 large transactions account for 40% of total transactions)); output: first-dimensional feature vector (denoted as F_amt_low1, 128-dimensional). This vector contains the quantified risk basis of the "amount abnormality" dimension. Multidimensional risk feature integration (first risk feature integrator): the server inputs F_amt_high1 (high-level semantic features), F_amt_low1 (low-level statistical features), F_amt_enh1 (dynamic enhancement features), and E_amt_sample (original encoding) into the first risk feature integrator (feature fusion module based on attention mechanism): dimension alignment: compress F_amt_high1 (64-dimensional) to 128-dimensional through linear projection, and unify the dimensions with other features (all 128-dimensional); fusion weight calculation: call the attention weight matrix learned in the training phase to calculate the fusion weights of each feature (such as F_amt_high1 accounts for 0.45, F_amt_low1 accounts for 0.35, F_amt_enh1 accounts for 0.15, and _amt_sample accounts for 0.05). The higher the weight, the more important the feature is to the risk assessment of the "amount abnormality" dimension; feature fusion and regularization: weighted sum of features according to fusion weights, introduce nonlinearity through ReLU activation function (capture complex relationships between features), then connect with E_amt_sample residual (preserve original time series information), and finally adjust feature distribution through layer normalization to get the sample dimensional feature vector of the amount abnormality dimension (denoted as V_amt_sample, 128-dimensional). Result: the server obtains sample dimensional feature vectors of four risk dimensions (such as V_amt_sample, V_dev_sample, V_freq_sample, and V_mer_sample) through the above process.Each vector integrates the statistical characteristics (such as amount, frequency), semantic characteristics (such as abnormal patterns), and timing characteristics (such as transaction order) of the dimension, providing comprehensive feature input for subsequent risk assessment.

[0114] The core of model training is to minimize the total loss, which is composed of three parts corresponding to the three core objectives of the model: 1. Feature independence loss (ensure that each dimension of the feature is not redundant): Goal: Let the feature vectors of each risk dimension not overlap (such as the "amount anomaly" dimension should be independent of the "device environment" dimension, avoiding confusion between "large transaction" and "remote device" features).

[0115] Computing logic: Take any two risk dimension sample dimension feature vectors (e.g. V_amt_sample (amount abnormality dimension) and V_dev_sample (device environment dimension)); calculate the mutual information of the two vectors (an indicator of feature correlation, the higher the mutual information, the more the feature overlap); take the mutual information as the feature independence loss (the goal is to minimize this loss, let the mutual information <0.1). Example: If the mutual information of V_amt_sample (amount abnormality) and V_dev_sample (device environment) is 0.8 (strong correlation), it means that the two features overlap seriously (e.g. "large transaction" and "off-site device" are highly correlated), and the mutual information needs to be reduced (e.g. to below 0.1) through training. 2. Confidence loss (improve the reliability of risk prediction): Goal: Let the confidence score output by the sample risk confidence modeling unit be consistent with the accuracy of risk prediction (e.g. the confidence score of high risk prediction should be >0.8, and the confidence score of low risk prediction should be <0.2). Computing logic: input the first sample transaction sequence into the model to get the risk level prediction of each dimension (e.g. the amount abnormality dimension outputs "high risk", and the device environment dimension outputs "high risk"); adjust the weight of each dimension with the confidence score output by the sample risk confidence modeling unit (e.g. the amount abnormality dimension weight 0.35x0.9=0.315, and the device environment dimension weight 0.3x0.9=0.27); get the overall risk level prediction (e.g. "high risk") by weighting; use cross-entropy loss to calculate the difference between the overall risk level prediction and the true label (the overall risk level of the first sample) (the smaller the difference, the more consistent the confidence score and the prediction accuracy). Example: User B's true label is "high risk", the model predicts "high risk" and the confidence score is 0.9, the confidence loss is small (about 0.05); if the model predicts "medium risk" but the confidence score is 0.8, the confidence and prediction accuracy are inconsistent, and the confidence loss is large (about 0.5). 3. Dimension risk loss (strengthen the discriminant ability of each dimension feature): Goal: Let the feature vector of each risk dimension accurately distinguish the risk of that dimension (e.g. the features of the amount abnormality dimension should be able to distinguish between "normal amount fluctuation" and "abnormal large amount"). Computing logic: input the second sample transaction sequence into the model to get the risk level prediction of each dimension (e.g. the amount abnormality dimension outputs "high risk"); use mean square error to calculate the difference between the prediction and the true dimension label (the individual risk level of each dimension of the second sample) (the smaller the difference, the stronger the discriminant ability of the dimension feature). Example: In the second sample, the amount abnormality dimension of a user has a true label of "high risk", and the model predicts "high risk", so the dimension risk loss is 0; if the model predicts "medium risk", it means that the discriminant ability of the amount abnormality dimension feature is insufficient, and the dimension risk loss is 1.

[0116] The server sums up the feature independence loss, the confidence loss, and the dimension risk loss with weights to obtain a total loss (the weights are determined by business experts and model verification, for example, the feature independence loss accounts for 0.4, the confidence loss accounts for 0.3, and the dimension risk loss accounts for 0.3). The server calculates the gradient of the total loss with respect to the model parameters by using a back propagation algorithm, and updates the model parameters by using an Adam optimizer (learning rate 0.001): the sample risk feature extraction branch: the correlation of each dimension feature (for example, the mutual information between the amount anomaly and the device environment feature) is reduced through the feature independence loss optimization; the sample risk confidence modeling unit: the consistency of the confidence score and the prediction accuracy is improved through the confidence loss optimization; the sample multi-dimensional feature encoding main body (for example, the sample behavior feature encoder and the first dynamic feature enhancement component): the discrimination ability of each dimension feature (for example, the amount anomaly dimension feature can more accurately distinguish between normal and abnormal amounts) is strengthened through the dimension risk loss optimization. Training process example: the first round of training: the total loss is 1.2 (the feature independence loss is 0.5, the confidence loss is 0.4, and the dimension risk loss is 0.3); 10 rounds of training: the total loss is reduced to 0.6 (the feature independence loss is 0.2, the confidence loss is 0.2, and the dimension risk loss is 0.2); 50 rounds of training: the total loss is reduced to 0.3 (the feature independence loss is 0.1, the confidence loss is 0.1, and the dimension risk loss is 0.1), and the model converges (the loss does not decrease significantly).

[0117] Through the above training process, the server obtains a target risk rating model, which has the following core capabilities: feature independence: the mutual information of the feature vectors of each risk dimension is less than 0.1, and they are not redundant (for example, the “amount anomaly” feature and the “device environment” feature do not overlap); risk prediction accuracy: the prediction accuracy rate of high-risk samples is greater than 95%, the prediction accuracy rate of medium-risk samples is greater than 85%, and the prediction accuracy rate of low-risk samples is greater than 90% (for example, the high-risk transaction sequence of user B can be accurately predicted); confidence reliability: the confidence score of high-risk prediction is greater than 0.8, and the confidence score of low-risk prediction is less than 0.2 (for example, the confidence score of high-risk prediction is 0.9, and the confidence score of low-risk prediction is 0.1).

[0118] This process trains a precise target risk rating model through sample data set construction (covering normal and risk transactions), multi-dimensional feature analysis (capturing hierarchical features from statistics to semantics), and multi-loss function optimization (feature independence + confidence + dimension risk). The model can process user transaction data streams in real time, extract independent risk features, and output reliable risk level labels, providing strong support for transaction risk prevention and control of financial institutions.

[0119] The embodiment of the present application provides a computer device 100, the computer device 100 includes a processor and a nonvolatile memory storing computer instructions, when the computer instructions are executed by the processor, the computer device 100 executes the aforementioned deep learning-based digital transaction risk intelligent early warning method. As shown in Figure 2 Figure 2 The structural block diagram of the computer device 100 provided by the embodiment of the present application is shown. The computer device 100 includes a memory 111, a processor 112 and a communication unit 113. In order to realize the transmission or interaction of data, the memory 111, the processor 112 and the communication unit 113 are directly or indirectly electrically connected with each other. For example, the electrical connection between these elements can be realized by one or more communication buses or signal lines.

[0120] The foregoing description is made with reference to specific embodiments. However, the above illustrative discussion is not intended to be exhaustive or to limit the disclosure to the precise forms disclosed. Many modifications and variations are possible in light of the above teachings. The embodiments are chosen and described in order to best explain the principles of the disclosure and its practical application and to thereby enable others skilled in the art to best utilize the disclosure and various embodiments with various modifications as are suited to the particular use contemplated.​

Claims

1. A method for intelligent early warning of digital transaction risks based on deep learning, characterized in that, include: Obtain the data stream of the transaction to be evaluated; The transaction data stream to be evaluated is input into the target feature parsing network corresponding to each of the multiple risk dimensions in the target risk rating model for behavioral feature recognition processing, to obtain the target behavioral feature vector corresponding to each risk dimension; the target risk rating model is trained on the sample risk feature extraction branch in the sample feature parsing network based on feature independence loss, the feature independence loss characterizes the correlation of the target dimension feature vector, and the target dimension feature vector is the dimension feature vector output by the sample risk feature extraction branch corresponding to any two risk dimensions; The target behavior feature vector corresponding to each risk dimension is input into the target risk assessment unit corresponding to each risk dimension for risk assessment, and the first risk level prediction corresponding to each risk dimension is obtained. Based on the first risk level prediction corresponding to each of the multiple risk dimensions, the target risk level label corresponding to the transaction data stream to be evaluated is determined. The method further includes: The transaction data stream to be evaluated is input into the target risk confidence modeling unit in the target risk rating model to evaluate the risk confidence and obtain the target risk confidence score. The step of determining the target risk level label corresponding to the transaction data stream to be evaluated based on the first risk level prediction corresponding to each of the multiple risk dimensions includes: Based on the target risk confidence score, risk-weighted decision-making is performed on the first risk level prediction corresponding to each of the multiple risk dimensions to obtain the second risk level prediction corresponding to the transaction data stream to be evaluated. Based on the second risk level prediction, the target risk level label is determined; The target risk rating model is trained through the following process: Obtain the first sample transaction behavior sequence dataset; The first sample transaction behavior sequence dataset is input into the sample feature parsing network corresponding to each of the multiple risk dimensions in the initial risk feature encoding model for behavioral feature recognition processing, so as to obtain the sample dimension feature vector corresponding to each risk dimension. Based on the sample dimension feature vectors corresponding to the risk dimension combination, the feature independence loss corresponding to the risk dimension combination is determined; the risk dimension combination is any two of the plurality of risk dimensions. Based on the feature independence loss corresponding to the risk dimension combination, the sample risk feature extraction branch corresponding to the risk dimension combination is trained to obtain the target risk rating model.

2. The method according to claim 1, characterized in that, The step involves inputting the transaction data stream to be evaluated into the target feature parsing network corresponding to each of the multiple risk dimensions in the target risk rating model for behavioral feature recognition processing, to obtain the target behavioral feature vector corresponding to each risk dimension, including: The transaction data stream to be evaluated is input into the target behavior feature encoder in the target feature parsing network corresponding to each risk dimension for behavior feature encoding, so as to obtain the target behavior feature code corresponding to each risk dimension. The target behavior feature encoding corresponding to each risk dimension is input into the target risk feature hierarchical extractor in the target feature parsing network corresponding to each risk dimension to perform feature extraction operation, thereby obtaining the target behavior feature vector corresponding to each risk dimension.

3. The method according to claim 2, characterized in that, The target risk feature hierarchical extractor corresponding to each risk dimension includes a third dynamic feature enhancement component, a third higher-order feature abstractor, a target risk feature extraction branch, and a third risk feature integrator; the step of inputting the target behavior feature encoding corresponding to each risk dimension into the target risk feature hierarchical extractor in the target feature parsing network corresponding to each risk dimension to perform feature extraction operation, and obtaining the target behavior feature vector corresponding to each risk dimension, includes: The target behavior feature encoding corresponding to each risk dimension is input into the third dynamic feature enhancement component corresponding to each risk dimension for dynamic feature enhancement, so as to obtain the third enhanced feature representation corresponding to each risk dimension. The target behavior feature encoding corresponding to each risk dimension and the third enhanced feature representation corresponding to each risk dimension are input into the third higher-order feature abstractor corresponding to each risk dimension for higher-order feature abstraction to obtain the first target feature vector corresponding to each risk dimension. The target behavior feature encoding and the third enhanced feature representation corresponding to each risk dimension are input into the target risk feature extraction branch corresponding to each risk dimension to perform risk feature hierarchical extraction, thereby obtaining the fourth dimension feature vector corresponding to each risk dimension. The fourth-dimensional feature vector, the first target feature vector, the target behavior feature encoding, and the third enhanced feature representation corresponding to each risk dimension are input into the third risk feature integrator corresponding to each risk dimension for multi-dimensional risk feature integration to obtain the target behavior feature vector corresponding to each risk dimension.

4. The method according to claim 2, characterized in that, The target risk feature hierarchical extractor corresponding to each risk dimension includes a fourth dynamic feature enhancement component, a fourth higher-order feature abstractor, a target risk feature extraction branch, and a fourth risk feature integrator. The target risk feature extraction branch corresponding to each risk dimension includes a first target risk feature hierarchical extractor and a second target risk feature hierarchical extractor. The step of inputting the target behavior feature encoding corresponding to each risk dimension into the target risk feature hierarchical extractor in the target feature parsing network corresponding to each risk dimension to perform feature extraction operations and obtain the target behavior feature vector corresponding to each risk dimension includes: The target behavior feature encoding corresponding to each risk dimension is input into the fourth dynamic feature enhancement component corresponding to each risk dimension for dynamic feature enhancement, so as to obtain the fourth enhanced feature representation corresponding to each risk dimension. The fourth enhanced feature representation corresponding to each risk dimension is input into the first target risk feature layerer corresponding to each risk dimension to perform risk feature layer extraction, thereby obtaining the fifth dimension feature vector corresponding to each risk dimension. The fifth dimension feature vector corresponding to each risk dimension and the target behavior feature encoding corresponding to each risk dimension are input into the fourth higher-order feature abstractor corresponding to each risk dimension for higher-order feature abstraction to obtain the second target feature vector corresponding to each risk dimension. The second target feature vector corresponding to each risk dimension is input into the second target risk feature layerer corresponding to each risk dimension to perform risk feature layer extraction, thereby obtaining the sixth dimension feature vector corresponding to each risk dimension. The sixth-dimensional feature vector, the fifth-dimensional feature vector, and the target behavior feature encoding corresponding to each risk dimension are input into the fourth risk feature integrator corresponding to each risk dimension for multi-dimensional risk feature integration to obtain the target behavior feature vector corresponding to each risk dimension.

5. The method according to claim 4, characterized in that, The step of encoding the target behavior features corresponding to each risk dimension and inputting them into the fourth dynamic feature enhancement component corresponding to each risk dimension for dynamic feature enhancement includes: Multi-head self-attention computation is performed on the target behavior feature encoding to generate an interaction association matrix; Based on the interaction correlation matrix, the dynamic weight distribution of each transaction event feature in the transaction data stream to be evaluated is determined; Based on the dynamic weight distribution, a weighted aggregation operation is performed on the target behavior feature encoding to generate an initial enhanced representation; The initial enhanced representation is processed by residual connection and layer normalization to generate the fourth enhanced feature representation.

6. The method according to claim 4, characterized in that, The process of integrating the sixth-dimensional feature vector, the fifth-dimensional feature vector, and the target behavior feature encoding corresponding to each risk dimension into the fourth-dimensional risk feature integrator for multi-dimensional risk feature integration includes: Perform a dimension alignment operation on the input sixth-dimensional feature vector, the fifth-dimensional feature vector, and the target behavior feature encoding to obtain a unified-dimensional projected feature representation; The weight matrix obtained during the training phase is invoked to calculate the fusion weight coefficients of each feature vector in the projected feature representation; Based on the fusion weight coefficients, a weighted linear combination operation is performed on the projected feature representation; The weighted results are mapped using a non-linear activation function to generate a fused feature vector; The fused feature vector and the target behavior feature encoding are subjected to residual connection and regularization processing to generate the target behavior feature vector.

7. A server system, characterized in that, Includes a server, the server being used to perform the method according to any one of claims 1-6.

Images