Financial product abnormal transaction detection method and system based on time-space diagram neural network

Abstract

The invention discloses a financial product abnormal transaction detection method and system based on a space-time diagram neural network, and the method comprises the steps: obtaining related data of a financial product, carrying out the preprocessing, and extracting related basic features; obtaining node embedding and edge embedding, obtaining time embedding, splicing time coding and node embedding, and performing attention processing to obtain importance degree; constructing a multivariate heterogeneous graph based on the related data and the related basic features, defining a plurality of meta-paths, and calculating node-level attention based on the node features and the importance degree under the same meta-path; obtaining a final node vector; obtaining a node-level abnormal score and an edge-level abnormal score and carrying out cooperative processing to obtain an abnormal transaction probability; and judging whether an abnormal transaction behavior exists in the financial product transaction scene or not. According to the method, the time sequence space bimodal heterogeneous graph is constructed, the transaction network covering multiple entities is constructed, and accurate anomaly detection can be realized.

Description

Technical Field

[0001] The present invention relates to the field of computer-related technologies, and in particular to a method and system for detecting abnormal transactions of financial products based on a spatiotemporal graph neural network. Background Art

[0002] Existing technologies for detecting abnormal financial product transactions primarily rely on daily transaction thresholds or statistical indicators (such as Z-scores and variance analysis). These methods identify anomalies by analyzing individual transactions or accounts in isolation. However, these methods suffer from drawbacks such as isolated analysis and static rules. Consequently, current detection capabilities are insufficient for addressing hidden anomalies in complex transaction networks, making it difficult to achieve both accuracy and real-time performance.

[0003] In general, current abnormal transaction identification typically analyzes individual transactions in isolation, ignoring the relationships between accounts. For example, it fails to detect the fragmentation of transactions by linked accounts to circumvent transaction limits through decentralized transactions. It also struggles to track covert high-frequency trading operations where the same device simultaneously logs into multiple accounts, leading to missed detection of organized, cross-account abnormal trading patterns.

[0004] In addition, current anomaly identification methods only analyze transaction data at a single time node in isolation, ignoring the continuity and logic of transactions in the time series. It is easy to ignore the temporal relationship between different transactions and it is difficult to capture the dynamically changing risk characteristics in transactions.

[0005] In short, the current anomaly identification methods are not comprehensive and flexible enough for detecting abnormal transactions. Summary of the Invention

[0006] In response to the shortcomings of the prior art, the present invention provides a method and system for detecting abnormal transactions of financial products based on a spatiotemporal graph neural network.

[0007] In order to solve the above technical problems, the present invention is solved by the following technical solutions: A method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks, comprising the following steps: Obtain relevant data of financial products and preprocess them to extract relevant basic features, including node features, edge features, and time features. Relevant data includes node type data, edge type data, and transaction time; Node features and edge features are concatenated and encoded respectively to obtain node embedding and edge embedding, time features are transformed and encoded to obtain time embedding, time encoding is concatenated with node embedding and attention processing is performed to obtain the degree of importance; Based on relevant data and related basic features, a multivariate heterogeneous graph is constructed and multiple meta-paths are defined. Node-level attention is calculated based on node features and importance within the same meta-path. Path-level attention is calculated based on node-level attention within different meta-paths to obtain the final node vector. Based on the final node vector, we obtain the node-level anomaly score and edge-level anomaly score and perform collaborative processing to obtain the abnormal transaction probability; By using abnormal transaction probability, preset time period and preset dynamic probability threshold, it is determined whether there is abnormal trading behavior in the financial product trading scenario.

[0008] As an implementable embodiment, the node type data includes accounts, financial products, and usage devices; Edge data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns. The node characteristics of accounts include identity characteristics and transaction capability characteristics; the node characteristics of financial products include basic identification characteristics and business attribute characteristics; the node characteristics of devices used include physical characteristics, behavioral characteristics, and historical operation records; The edge features of the transaction relationship include basic transaction attribute features and behavioral features. The basic transaction attribute features include transaction amount, transaction volume, and transaction timestamp; the behavioral features include the number of transactions; the edge features of the login relationship include login geographic location and IP address ownership.

[0009] As an implementable method, the node features and edge features are concatenated and encoded respectively to obtain node embedding and edge embedding, including the following steps: splicing the account node, the financial product node, and the usage device node based on a preset first format to obtain a first text sequence; Encode the first text sequence through the BERT model to obtain a fixed-dimensional node embedding; splicing the edges of the transaction relationship and the edges of the login relationship based on a preset second format to obtain a second text sequence; The second text sequence is encoded through the BERT model to obtain edge embeddings of fixed dimension.

[0010] As an implementation method, transforming and encoding the time feature to obtain time embedding includes the following steps: Convert transaction timestamps to relative time data within the trading day; The relative time data is converted into a time vector by using sine position coding and cosine position coding to form a time vector set; The time interval between two timestamps in the time vector set is calculated, and the time interval is subjected to nonlinear transformation and multi-layer perceptual encoding to obtain time embedding.

[0011] As an implementable method, the following steps are included: Node type data is used as nodes of the heterogeneous graph model, edge type data is used as edges of the heterogeneous graph model, and the semantic association relationship between different types of nodes is used as the meta-path; Assigning different weights to neighbor nodes in the same meta-path is called node-level attention, and assigning importance weights to different meta-paths is called path-level attention; Select the corresponding transformation matrix for the edge type of any node, map different types of node features into the same feature space, and obtain the projected features; Concatenate the current node with the neighboring nodes and perform LeakyReLU processing to obtain the attention coefficient; Aggregate the projection features, corresponding attention coefficients, and importance levels of neighboring nodes to obtain the temporal attention coefficients corresponding to different nodes, and then obtain the low-dimensional density vector of nodes under each meta-path; The global importance of each meta-path is calculated through the node embedding of each meta-path, and the final node embedding is obtained through the global importance and the node embeddings on all meta-paths.

[0012] As an implementable method, obtaining the account risk probability, transaction risk probability, and abnormal transaction probability respectively includes: Based on the final node embedding, the node-level risk probability, i.e., the account risk probability, is obtained through the Sigmoid function of the fully connected layer. Based on the final node embedding, associated node embedding and fixed-dimensional edge embedding, multi-layer perceptron calculation is performed to obtain the edge-level risk probability, i.e., the transaction risk probability. The edge risk probability and transaction risk probability are processed collaboratively to obtain the abnormal transaction probability.

[0013] As an implementable method, the abnormal transaction probability, the preset time period, and the preset dynamic probability threshold are used to determine whether there is abnormal transaction behavior in the financial product transaction scenario, specifically: Based on the probability distribution of transactions in the current time period, an appropriate quantile is selected as the dynamic probability threshold, and the dynamic probability threshold is used to determine whether abnormal trading behavior occurs in the financial product trading scenario.

[0014] A financial product abnormal transaction detection system based on spatiotemporal graph neural network, including: The data acquisition module obtains and preprocesses the relevant data of financial products and extracts relevant basic features, including node features, edge features, and time features. The relevant data includes node type data, edge type data, and transaction time; The data processing module concatenates and encodes node features and edge features to obtain node embedding and edge embedding, transforms and encodes time features to obtain time embedding, concatenates time encoding and node embedding and performs attention processing to obtain the degree of importance; Construct a calculation module, build a multivariate heterogeneous graph based on relevant data and related basic features, and define multiple meta-paths. Calculate node-level attention based on node features and importance in the same meta-path; calculate path-level attention based on node-level attention in different meta-paths to obtain the final node vector. The collaborative processing module obtains the node-level anomaly score and edge-level anomaly score based on the final node vector and performs collaborative processing to obtain the abnormal transaction probability; The anomaly judgment module determines whether there is abnormal trading behavior in the financial product trading scenario based on the abnormal transaction probability, preset time period and preset dynamic probability threshold.

[0015] A computer-readable storage medium stores a computer program, wherein the computer program implements the method described above when executed by a processor.

[0016] A device for detecting abnormal transactions of financial products based on a spatiotemporal graph neural network includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the method described above is implemented.

[0017] The present invention has significant technical effects due to the adoption of the above technical solutions: The present invention constructs a time-space bimodal heterogeneous graph and a transaction network covering multiple entities, which can achieve accurate anomaly detection and make anomaly detection comprehensive and flexible. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 It is a schematic diagram of the overall process of the method of the present invention; Figure 2 It is a schematic diagram of the overall structure of the system of the present invention. DETAILED DESCRIPTION

[0020] The present invention will be further described in detail below with reference to the examples. The following examples are intended to explain the present invention but the present invention is not limited to the following examples.

[0021] Example 1: A method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks, comprising the following steps: S100: Obtain relevant data of financial products and perform preprocessing to extract relevant basic features, including node features, edge features, and time features. The relevant data includes node type data, edge type data, and transaction time. S200, concatenating and encoding the node features and edge features to obtain node embedding and edge embedding, transforming and encoding the time features to obtain time embedding, concatenating the time encoding with the node embedding and performing attention processing to obtain the importance level; S300: construct a multivariate heterogeneous graph based on relevant data and relevant basic features and define multiple meta-paths; calculate node-level attention based on node features and importance in the same meta-path; calculate path-level attention based on node-level attention in different meta-paths to obtain a final node vector; S400: Based on the final node vector, a node-level anomaly score and an edge-level anomaly score are obtained and processed in a coordinated manner to obtain an abnormal transaction probability; S500: Determine whether there is abnormal trading behavior in the financial product trading scenario based on the abnormal trading probability, the preset time period, and the preset dynamic probability threshold.

[0022] In one embodiment, the relevant data of financial products can be understood as raw data, which includes real-time transaction data of financial products (such as transaction records, account information, and device logs). Preprocessing includes outlier processing, duplicate value processing, or other preprocessing. Outliers are extreme values ​​that significantly deviate from other observations in the data set. Currently, there are many ways to process outliers. This application directly relies on existing outlier processing methods in the outlier processing module, which will not be repeated here. Duplicate values ​​are records in a dataset that are identical or contain duplicate key information. They may appear in a single row, column, or a combination of columns. Currently, there are many ways to handle duplicate values, including direct deletion, merging, or marking them without deleting them. This application directly relies on existing outlier handling methods in its duplicate value handling module, which will not be discussed here.

[0023] Raw data includes multiple data types, such as node-type data and edge-type data. Node-type data includes accounts, financial products, and devices used. Edge-type data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns. The node characteristics of accounts include identity characteristics and transaction capability characteristics; the node characteristics of financial products include basic identification characteristics and business attribute characteristics; the node characteristics of devices used include physical characteristics, behavioral characteristics, and historical operation records; The edge features of the transaction relationship include basic transaction attribute features and behavioral features. The basic transaction attribute features include transaction amount, transaction volume, and transaction timestamp; the behavioral features include the number of transactions; the edge features of the login relationship include login geographic location and IP address ownership.

[0024] Specifically, the extracted node features are account node features, financial product node features and device node features. The account node features include at least identity features (account ID, account type), trading capability features (capital size, position concentration, average holding period, etc.); financial product node features include at least basic identification features (digital code, sector type, etc.), business attribute features (risk level, industry classification, price fluctuation limit, etc.); device node features include at least physical features (device ID, device type, operating system, etc.), behavioral features (login frequency, commonly used IP address segments, etc.), and historical operation records.

[0025] Edge features are extracted, including transaction edge features and login edge features. The transaction edge features include basic transaction attributes (transaction amount, transaction volume, transaction timestamp, etc.) and behavioral features (number of transactions, order cancellation rate, deviation from the market fluctuation range, etc.); login edge features include login geographic location, IP address ownership, etc.

[0026] In one embodiment, the step of concatenating and encoding the node features and the edge features to obtain the node embedding and the edge embedding comprises the following steps: splicing the account node, the financial product node, and the usage device node based on a preset first format to obtain a first text sequence; Encode the first text sequence through the BERT model to obtain a fixed-dimensional node embedding; splicing the edges of the transaction relationship and the edges of the login relationship based on a preset second format to obtain a second text sequence; The second text sequence is encoded through the BERT model to obtain edge embeddings of fixed dimension.

[0027] In a practical implementation, LLM embedding encoding is performed on account nodes, securities nodes, and device nodes. Based on the characteristics of the data input layer, these nodes are formatted and concatenated into text sequences, for example: "Account type: institution; Fund size: 1 million; Ownership period: 30 days;..." The pre-trained BERT model is used to encode the text and output fixed-dimensional node embeddings.

[0028] LLM embedding encoding is performed on transaction relationships and login edges. Based on the characteristics of the data input layer, the data is formatted and concatenated into a text sequence, for example: "Transaction amount: 50,000 yuan, transaction volume: XXXX; deviation from base price: +1.5%;..." The pre-trained BERT model is used to encode the text and output a fixed-dimensional dense vector edge embedding.

[0029] The BERT model is a pre-trained language representation model that uses bidirectional context encoding and Transformer-based deep pre-training. The model architecture includes a multi-layer bidirectional Transformer Encoder as its foundational component, with no decoder. Its parameter sizes include BERT-Base and BERT-Large. BERT-Base has 12 layers, 768 hidden layers, 12 attention heads, and 110M parameters; BERT-Large has 24 layers, 1024 hidden layers, 16 attention heads, and 340M parameters.

[0030] The pre-training task process is as follows: randomly masking 15% of the tokens in the input and predicting the original words, alleviating the one-way limitation of traditional language models and achieving deep bidirectional contextual understanding; NSP can determine whether a sentence pair (A, B) is continuous text (a binary classification task), enhancing sentence-level representation.

[0031] Its core dense vector node embedding, that is, in BERT, the dense vector representation specification of words / sentences is called, for example: TokenEmbedding: 768 / 1024-dimensional vector for each token in the vocabulary; SegmentEmbedding: embedding to distinguish sentence pairs (A / B); PositionEmbedding: retaining sequence position information; Context Embedding: the final output is a dynamic vector (not a static word vector).

[0032] In actual use, fine-tuning is basically required according to the usage scenario, such as adding task-specific output layers and fine-tuning all parameters on downstream tasks.

[0033] In this embodiment, if the BERT model is associated with graph embedding, the BERT model is used for knowledge graphs or heterogeneous graphs: the node text (such as entity description) is encoded by the BERT model as the initial node feature, and then GNN (such as GAT, RGCN) can be connected to further aggregate graph structure information to form text-enhanced node embedding or edge embedding.

[0034] In addition, the present invention introduces a time encoder, so that the timestamp not only contains the absolute time point, but also implies periodicity and interval. The transaction time is converted into a vector, allowing the spatiotemporal graph neural network model to understand the temporal dependencies of transaction behaviors. The time feature is transformed and encoded to obtain time embedding, which includes the following steps: Convert transaction timestamps to relative time data within the trading day; The relative time data is converted into a time vector by using sine position coding and cosine position coding to form a time vector set; The time interval between two timestamps in the time vector set is calculated, and the time interval is subjected to nonlinear transformation and multi-layer perceptual encoding to obtain time embedding.

[0035] In this embodiment, the transaction timestamp of the financial product is converted into relative time data within the transaction day; Multi-frequency encoding is performed through sine position encoding and cosine position encoding to convert the timestamp into a time feature vector :

[0036]

[0037] in, represents a constant, which is 3600 in this embodiment, and is used to control the frequency difference between different dimensions so that the sine and cosine functions of different dimensions have different periods. It represents the timestamp of the 2kth dimension at the tth moment in the time code, so the timestamp set is expressed as:

[0038] Calculate the timestamps of each pair in the timestamp set The time interval is expressed as: ; The time interval is transformed nonlinearly. By using logarithmic compression to avoid numerical explosion, the transformed time interval is obtained, which is expressed as follows:

[0039] The transformed time interval is encoded using a multi-layer perceptron (MLP) to obtain the timestamp of the encoded time interval, which is expressed as follows:

[0040] Based on the weight of recent behavior, exponential decay enhancement is performed to obtain the time encoding of the adjusted time interval, which is expressed as follows:

[0041] in, Indicates the control decay rate; After embedding the time coding features with the nodes, they are input into the attention mechanism to obtain the importance level;

[0042] represents the eigenvector of the i-th node in the graph, Represents the eigenvector of the jth node in the graph, initially set That is, a node embedding of fixed dimension.

[0043] In one embodiment, the present application constructs a heterogeneous graph model, uses node type data as nodes of the heterogeneous graph model, uses edge type data as edges of the heterogeneous graph model, and uses semantic associations between different types of nodes as meta-paths; Assigning different weights to neighbor nodes in the same meta-path is called node-level attention, and assigning importance weights to different meta-paths is called path-level attention; Select the corresponding transformation matrix for the edge type of any node, map different types of node features into the same feature space, and obtain the projected features; Concatenate the current node with the neighboring nodes and perform LeakyReLU processing to obtain the attention coefficient; Aggregate the projection features, corresponding attention coefficients, and importance levels of neighboring nodes to obtain the temporal attention coefficients corresponding to different nodes, and then obtain the low-dimensional density vector of nodes under each meta-path; The global importance of each meta-path is calculated through the node embedding of each meta-path, and the final node embedding is obtained through the global importance and the node embeddings on all meta-paths.

[0044] By aggregating different types of node and edge information in a heterogeneous graph model, extracting key features, and dynamically adjusting weights, the model focuses on recent or critical period transactions. For example, it can identify the high-frequency trading relationship between account A and financial product X, as well as account B's potential interest in financial product Y (based on the trading patterns of similar accounts).

[0045] In an actual embodiment, the semantic association relationship between different node types is used as a meta-path, and the attention weight of each meta-path is calculated; Assigning different weights to neighbors in the same meta-path is called node-level attention, and assigning importance weights to different meta-paths is called path-level attention; Node-level attention calculation process: Based on the edge type of any node, the corresponding transformation matrix is ​​selected, and the node features of different node types are mapped to the same feature space to obtain the projected features, which are expressed as follows:

[0046] in, Indicates the edge type of the i-th node, represents the transformation matrix; The association strength between node i and neighbor node j under meta-path P is defined as the attention coefficient. After concatenating the node features, the vector is obtained through a single-layer neural network LeakyReLU, and then the attention coefficient is obtained, which is expressed as follows: , ; in, represents the learnable attention vector of the meta-path P, represents the neighbor nodes of node i based on meta-path, Represents the attention coefficient of neighbor nodes normalized by Softmax; Aggregate the neighbor's projection features, corresponding attention coefficients, and importance levels to calculate the time attention coefficients corresponding to different nodes, and then obtain the low-dimensional density vector of the nodes under the meta-path P, which is expressed as follows:

[0047] represents the Sigmoid function, represents the result of the temporal encoding embedding layer, Represents projection features.

[0048] Path-level attention calculation process: node embedding based on learnable vector q, Tanh and meta-path P , calculate the global importance of each meta-path P, which is expressed as follows: ,

[0049] in, represents the global importance of all meta-paths after Softmax normalization, Indicates the number of nodes, represents the weight matrix, represents the bias vector; The final node embedding is obtained by weighted summing of the nodes on all meta-paths, which is expressed as follows:

[0050] in, Embed the final node.

[0051] In one embodiment, respectively obtaining the account risk probability, the transaction risk probability, and the abnormal transaction probability includes: Based on the final node embedding, the node-level risk probability, i.e., the account risk probability, is obtained through the Sigmoid function of the fully connected layer. Based on the final node embedding, associated node embedding and fixed-dimensional edge embedding, multi-layer perceptron calculation is performed to obtain the edge-level risk probability, i.e., the transaction risk probability. The edge risk probability and transaction risk probability are processed collaboratively to obtain the abnormal transaction probability.

[0052] After obtaining the abnormal transaction probability, based on the probability distribution of transactions in the current time period, an appropriate quantile is selected as the dynamic probability threshold, and the dynamic probability threshold is used to determine whether abnormal trading behavior occurs in the financial product trading scenario.

[0053] That is, based on the final node embedding , through the fully connected layer Sigmoid function, the risk probability of the account is obtained, which is expressed as follows:

[0054] Among them, the node embedding , node features (such as account history behavior, risk labels, transaction frequency), fully connected layer weight matrix , bias term The Sigmoid function compresses the output to , represents the account risk probability; Based on the final node embedding , associated node embedding Edge embedding is used to perform multi-layer perceptron calculations to obtain the transaction risk probability, which is expressed as follows:

[0055] Among them, the associated node embedding , transaction edge features That is, a fixed-dimensional dense vector edge embedding, and the vector dimension after splicing is , the Sigmoid function compresses the output to , represents the transaction risk probability; The node-level anomaly score and the edge-level anomaly score are processed together to obtain the abnormal transaction probability, which is expressed as follows:

[0056] in, Adjustments are made based on empirical values, and finally the probability of abnormal transactions is obtained.

[0057] This invention uses a dynamic threshold adaptive mechanism to automatically adjust the threshold based on real-time transaction distribution, avoiding the lag of static thresholds. The specific method is to adjust the threshold based on the sliding time window. Based on the probability distribution of recent transactions (here, the last 7 days can be used), a specific quantile is used as the dynamic threshold to deal with sudden abnormal behavior in high-frequency trading scenarios. It is expressed as follows: ,when , the corresponding node is marked as an abnormal node.

[0058] Example 2: A financial product abnormal transaction detection system based on spatiotemporal graph neural network, such as Figure 2 Shown, including: The data acquisition module 100 acquires and preprocesses relevant data of financial products to extract relevant basic features, including node features, edge features, and time features. The relevant data includes node type data, edge type data, and transaction time; The data processing module 200 concatenates and encodes the node features and edge features to obtain node embeddings and edge embeddings, transforms and encodes the time features to obtain time embeddings, concatenates the time encodings with the node embeddings and performs attention processing to obtain the importance level; Constructing a calculation module 300 to construct a multivariate heterogeneous graph based on relevant data and relevant basic features and define multiple meta-paths, calculating node-level attention based on node features and importance within the same meta-path; and calculating path-level attention based on node-level attention within different meta-paths to obtain a final node vector. The collaborative processing module 400 obtains the node-level anomaly score and the edge-level anomaly score based on the final node vector and performs collaborative processing to obtain the abnormal transaction probability; The abnormality judgment module 500 judges whether there is abnormal trading behavior in the financial product trading scenario based on the abnormal transaction probability, the preset time period and the preset dynamic probability threshold.

[0059] Various changes and modifications can be made without departing from the spirit and scope of the present invention, and all equivalent technical solutions also fall within the scope of the present invention.

[0060] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referenced to each other.

[0061] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, apparatus, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0062] The present invention is described with reference to the flowcharts and / or block diagrams of the method, terminal device (system), and computer program product according to the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the process in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0063] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0064] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable terminal device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0065] It should be noted that: References in this specification to "one embodiment" or "an embodiment" mean that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Therefore, appearances of the phrases "one embodiment" or "an embodiment" in various places throughout this specification do not necessarily refer to the same embodiment.

Claims

1. A method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks, characterized in that: The following steps are involved: Obtain relevant data of financial products and preprocess them to extract relevant basic features, including node features, edge features, and time features. Relevant data includes node type data, edge type data, and transaction time; Node features and edge features are concatenated and encoded respectively to obtain node embedding and edge embedding; time features are transformed and encoded to obtain time embedding, and the time encoding is concatenated with the node embedding and attention processing is performed to obtain the degree of importance; Based on relevant data and related basic features, a multi-dimensional heterogeneous graph is constructed and multiple meta-paths are defined. Node-level attention is calculated based on node features and importance within the same meta-path. Calculate path-level attention based on node-level attention under different meta-paths to obtain the final node vector; Based on the final node vector and edge embedding, the node-level anomaly score and edge-level anomaly score are obtained and processed collaboratively to obtain the abnormal transaction probability; By using abnormal transaction probability, preset time period and preset dynamic probability threshold, it is determined whether there is abnormal trading behavior in the financial product trading scenario.

2. The method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks according to claim 1 is characterized in that: The node type data includes accounts, financial products and used devices; Edge data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns. The node characteristics of an account include identity characteristics and transaction capability characteristics; The node characteristics of financial products include basic identification characteristics and business attribute characteristics; the node characteristics of the equipment used include physical characteristics, behavioral characteristics, and historical operation records; The edge features of transaction relationships include basic transaction attribute features and behavioral features. Basic transaction attribute features include transaction amount, transaction volume, and transaction timestamp. Behavioral features include the number of transactions; edge features of login relationships include login geographic location and IP address ownership.

3. The method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks according to claim 1 is characterized in that: The node features and edge features are spliced ​​and encoded respectively to obtain node embedding and edge embedding, including the following steps: splicing the account node, the financial product node, and the usage device node based on a preset first format to obtain a first text sequence; Encode the first text sequence through the BERT model to obtain a fixed-dimensional node embedding; splicing the edges of the transaction relationship and the edges of the login relationship based on a preset second format to obtain a second text sequence; The second text sequence is encoded through the BERT model to obtain edge embeddings of fixed dimension.

4. The method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that: The time feature is transformed and encoded to obtain time embedding, comprising the following steps: Convert transaction timestamps to relative time data within the trading day; The relative time data is converted into a time vector by using sine position coding and cosine position coding to form a time vector set; The time interval between two timestamps in the time vector set is calculated, and the time interval is subjected to nonlinear transformation and multi-layer perceptual encoding to obtain time embedding.

5. The method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that: The following steps are involved: Node type data is used as nodes of the heterogeneous graph model, edge type data is used as edges of the heterogeneous graph model, and the semantic association relationship between different types of nodes is used as the meta-path; Assigning different weights to neighbor nodes in the same meta-path is called node-level attention, and assigning importance weights to different meta-paths is called path-level attention; Select the corresponding transformation matrix for the edge type of any node, map different types of node features into the same feature space, and obtain the projected features; Concatenate the current node with the neighboring nodes and perform LeakyReLU processing to obtain the attention coefficient; Aggregate the projection features, corresponding attention coefficients, and importance levels of neighboring nodes to obtain the temporal attention coefficients corresponding to different nodes, and then obtain the low-dimensional density vector of nodes under each meta-path; The global importance of each meta-path is calculated through the node embedding of each meta-path, and the final node embedding is obtained through the global importance and the node embeddings on all meta-paths.

6. The method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that: The node-level anomaly score is obtained based on the final node vector and edge embedding, including: Based on the final node embedding, the node-level risk probability, i.e., the account risk probability, is obtained through the Sigmoid function of the fully connected layer. Based on the final node embedding, associated node embedding and fixed-dimensional edge embedding, multi-layer perceptron calculation is performed to obtain the edge-level risk probability, i.e., the transaction risk probability. The edge risk probability and transaction risk probability are processed collaboratively to obtain the abnormal transaction probability.

7. The method for detecting abnormal transactions of financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that: The determination of whether there is abnormal trading behavior in the financial product trading scenario is based on the abnormal trading probability, the preset time period, and the preset dynamic probability threshold, specifically: Based on the probability distribution of transactions in the current time period, an appropriate quantile is selected as the dynamic probability threshold, and the dynamic probability threshold is used to determine whether abnormal trading behavior occurs in the financial product trading scenario.

8. A financial product abnormal transaction detection system based on spatiotemporal graph neural network, characterized by: include: The data acquisition module obtains and preprocesses the relevant data of financial products and extracts relevant basic features, including node features, edge features, and time features. The relevant data includes node type data, edge type data, and transaction time; The data processing module concatenates and encodes node features and edge features to obtain node embedding and edge embedding, transforms and encodes time features to obtain time embedding, concatenates time encoding and node embedding and performs attention processing to obtain the degree of importance; Build a computing module, construct a multi-heterogeneous graph based on relevant data and related basic features, and define multiple meta-paths. Calculate node-level attention based on node features and importance under the same meta-path. Calculate path-level attention based on node-level attention under different meta-paths to obtain the final node vector; The collaborative processing module obtains the node-level anomaly score and edge-level anomaly score based on the final node vector and performs collaborative processing to obtain the abnormal transaction probability; The anomaly judgment module determines whether there is abnormal trading behavior in the financial product trading scenario based on the abnormal transaction probability, preset time period and preset dynamic probability threshold.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. A device for detecting abnormal transactions of financial products based on a spatiotemporal graph neural network, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images