Method and system for detecting abnormal transactions of financial products based on spatio-temporal graph neural network

Abstract

The application discloses a financial product abnormal transaction detection method and system based on a space-time graph neural network, and the method comprises the following steps: obtaining related data of a financial product and performing preprocessing, and extracting related basic features; obtaining node embedding and edge embedding, obtaining time embedding, splicing time coding and node embedding, and performing attention processing to obtain importance degree; constructing a multivariate heterogeneous graph based on the related data and the related basic features, defining a plurality of meta-paths, and calculating node-level attention based on node features and the importance degree under the same meta-path; obtaining a final node vector; obtaining a node-level abnormal score and an edge-level abnormal score, and performing collaborative processing to obtain an abnormal transaction probability; and judging whether there is an abnormal transaction behavior in a financial product transaction scene. The application can realize accurate abnormal detection by constructing a time-space dual-modal heterogeneous graph and constructing a transaction network covering multiple entities.

Description

Technical Field

[0001] This invention relates to the field of computer-related technologies, and in particular to a method and system for detecting abnormal transactions in financial products based on a spatiotemporal graph neural network. Background Technology

[0002] In existing technologies, abnormal transaction detection in financial products mainly relies on daily transaction thresholds or statistical indicators (such as Z-scores and analysis of variance) to identify anomalies by performing isolated analysis on individual transactions or accounts. However, this approach suffers from drawbacks such as isolated analysis and static rules. Therefore, current detection capabilities are insufficient when dealing with hidden anomalies in complex transaction networks, making it difficult to balance the requirements of detection accuracy and real-time performance.

[0003] In general, current methods for identifying abnormal transactions typically analyze individual transactions in isolation, ignoring the relationships between accounts. For example, they cannot detect the behavior of related accounts using dispersed transactions to circumvent transaction limits; nor can they track the covert operation of multiple accounts logged in simultaneously on the same device for high-frequency trading, leading to missed detections of organized and cross-account abnormal transaction patterns.

[0004] Furthermore, current anomaly identification methods only perform isolated analysis of transaction data at a single time point, ignoring the continuity and logic of transactions in the time series. They easily overlook the temporal relationships between different transactions and are unable to capture the dynamic risk characteristics in transactions.

[0005] In summary, current anomaly detection methods are not comprehensive or flexible enough for detecting abnormal transactions. Summary of the Invention

[0006] This invention addresses the shortcomings of existing technologies by providing a method and system for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] A method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks includes the following steps:

[0009] Acquire relevant data on financial products and preprocess them to extract relevant basic features, including node features, edge features and time features. The relevant data includes node type data, edge type data and transaction time.

[0010] The node features and edge features are concatenated and encoded to obtain node embeddings and edge embeddings respectively. The temporal features are transformed and encoded to obtain temporal embeddings. The temporal encoding and node embeddings are concatenated and attention processing is performed to obtain the importance level.

[0011] Based on relevant data and basic features, a multivariate heterogeneous graph is constructed and multiple meta-paths are defined. Node-level attention is calculated based on node features and importance under the same meta-path. Path-level attention is calculated based on node-level attention under different meta-paths to obtain the final node vector.

[0012] Based on the final node vector, the node-level anomaly score and the edge-level anomaly score are obtained and processed collaboratively to obtain the probability of abnormal transactions.

[0013] By using the probability of abnormal transactions, preset time periods, and preset dynamic probability thresholds, it is possible to determine whether abnormal transaction behavior exists in financial product trading scenarios.

[0014] As one possible implementation, the node type data includes accounts, financial products, and devices used;

[0015] Edge-type data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns;

[0016] The node characteristics of an account include identity characteristics and transaction capability characteristics; the node characteristics of a financial product include basic identification characteristics and business attribute characteristics; the node characteristics of the device used include physical characteristics, behavioral characteristics, and historical operation records.

[0017] The edge features of the transaction relationship include basic transaction attribute features and behavioral features. The basic transaction attribute features include transaction amount, transaction volume, and transaction timestamp; the behavioral features include the number of transactions; the edge features of the login relationship include login geographical location and IP address attribution.

[0018] As one possible implementation, the step of concatenating and encoding node features and edge features to obtain node embeddings and edge embeddings includes the following steps:

[0019] The account node, financial product node, and device node are concatenated based on a preset first format to obtain a first text sequence;

[0020] The first text sequence is encoded using the BERT model to obtain fixed-dimensional node embeddings;

[0021] The edges of the transaction relationship and the login relationship are concatenated based on a preset second format to obtain the second text sequence;

[0022] The second text sequence is encoded using the BERT model to obtain fixed-dimensional edge embeddings.

[0023] As one possible implementation, the transformation and encoding of time features to obtain a time embedding includes the following steps:

[0024] Convert transaction timestamps into relative time data within the transaction day;

[0025] The relative time data is converted into a time vector to form a time vector set by using sine position encoding and cosine position encoding respectively;

[0026] The time interval between each pair of timestamps in the time vector set is calculated, and the time interval is subjected to nonlinear transformation and multilayer perceptual encoding to obtain the time embedding.

[0027] One possible implementation includes the following steps:

[0028] Node type data is used as nodes in the heterogeneous graph model, edge type data is used as edges in the heterogeneous graph model, and the semantic association between nodes of different types is used as meta-paths.

[0029] Assigning different weights to neighboring nodes under the same meta-path is node-level attention, while assigning importance weights to different types of meta-paths is path-level attention.

[0030] By selecting the appropriate transformation matrix for the edge type of any node, the features of different types of nodes are mapped to the same feature space to obtain the projected features;

[0031] The attention coefficient is obtained by concatenating the current node with its neighboring nodes and performing LeakyReLU processing.

[0032] The projection features, corresponding attention coefficients, and importance of neighboring nodes are aggregated to obtain the temporal attention coefficients for different nodes, and then the low-dimensional density vector of nodes under each meta-path is obtained.

[0033] The global importance of each meta-path is calculated by using the node embeddings of each meta-path. The final node embedding is obtained by combining the global importance with the node embeddings of all meta-paths.

[0034] As one possible implementation method, obtaining the account risk probability, transaction risk probability, and abnormal transaction probability respectively includes:

[0035] Based on the final node embedding, the node-level risk probability, i.e. the account risk probability, is obtained through the Sigmoid function of the fully connected layer;

[0036] Based on the final node embedding, the associated node embedding, and the fixed-dimensional edge embedding, a multilayer perceptron is used to calculate the edge-level risk probability, which is the transaction risk probability.

[0037] By coordinating the edge risk probability and the transaction risk probability, the abnormal transaction probability is obtained.

[0038] As one possible implementation, the method of determining whether abnormal trading behavior exists in a financial product trading scenario by using abnormal transaction probability, a preset time period, and a preset dynamic probability threshold specifically involves:

[0039] Based on the probability distribution of transactions in the current time period, an appropriate quantile is selected as a dynamic probability threshold. The dynamic probability threshold is used to determine whether abnormal trading behavior occurs in the financial product trading scenario.

[0040] A financial product abnormal transaction detection system based on spatiotemporal graph neural network includes:

[0041] The data acquisition module acquires relevant data of financial products and preprocesses it, extracting relevant basic features, including node features, edge features and time features. The relevant data includes node type data, edge type data and transaction time.

[0042] The data processing module concatenates and encodes node features and edge features to obtain node embeddings and edge embeddings, transforms and encodes temporal features to obtain temporal embeddings, concatenates the temporal encoding with the node embeddings and performs attention processing to obtain the importance level.

[0043] The computation module is constructed to build a multivariate heterogeneous graph based on relevant data and basic features and to define multiple meta-paths. Node-level attention is calculated based on node features and importance under the same meta-path; path-level attention is calculated based on node-level attention under different meta-paths to obtain the final node vector.

[0044] The collaborative processing module obtains node-level and edge-level anomaly scores based on the final node vector and performs collaborative processing to obtain the probability of abnormal transactions.

[0045] The anomaly detection module determines whether abnormal trading behavior exists in financial product trading scenarios by using the probability of abnormal transactions, preset time periods, and preset dynamic probability thresholds.

[0046] A computer-readable storage medium storing a computer program, characterized in that the computer program, when executed by a processor, implements the method described above.

[0047] A device for detecting abnormal transactions in financial products based on a spatiotemporal graph neural network includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the method described above.

[0048] This invention, by adopting the above technical solutions, has significant technical effects:

[0049] This invention constructs a temporal-spatial bimodal heterogeneous graph to build a transaction network covering multiple entities, enabling accurate anomaly detection and making the anomaly detection comprehensive and flexible. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a schematic diagram of the overall process of the method of the present invention;

[0052] Figure 2 This is a schematic diagram of the overall structure of the system of the present invention. Detailed Implementation

[0053] The present invention will be further described in detail below with reference to the embodiments. The following embodiments are explanations of the present invention, but the present invention is not limited to the following embodiments.

[0054] Example 1:

[0055] A method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks includes the following steps:

[0056] S100. Obtain relevant data on financial products and preprocess them, extracting relevant basic features, including node features, edge features and time features. The relevant data includes node type data, edge type data and transaction time.

[0057] S200. The node features and edge features are concatenated and encoded to obtain node embeddings and edge embeddings respectively. The temporal features are transformed and encoded to obtain temporal embeddings. The temporal encoding and node embeddings are concatenated and attention processing is performed to obtain the importance level.

[0058] S300. Construct a multivariate heterogeneous graph based on relevant data and basic features, and define multiple meta-paths. Calculate node-level attention based on node features and importance under the same meta-path; calculate path-level attention based on node-level attention under different meta-paths to obtain the final node vector.

[0059] S400: Based on the final node vector, obtain the node-level anomaly score and the edge-level anomaly score, and perform collaborative processing to obtain the probability of abnormal transactions;

[0060] S500 determines whether abnormal trading behavior exists in financial product trading scenarios by using abnormal transaction probability, preset time period, and preset dynamic probability threshold.

[0061] In one embodiment, the relevant data of the financial product can be understood as the raw data, which includes real-time transaction data of the financial product (such as transaction records, account information, and device logs). Preprocessing includes outlier handling, duplicate value handling, or other preprocessing. Outliers are extreme values ​​that significantly deviate from other observations in the dataset. There are many ways to handle outliers. This application directly relies on existing outlier handling methods in its outlier handling module, which will not be elaborated here.

[0062] Duplicate values ​​refer to records in a dataset that are completely identical or contain the same key information. They may appear in a single row, a single column, or a combination of multiple columns. Currently, there are many ways to handle duplicate values, such as direct deletion, information merging, or marking without deletion. This application directly relies on existing outlier handling methods in its duplicate value handling module, which will not be elaborated upon here.

[0063] The raw data includes various data types, such as node-type data and edge-type data. Node-type data includes accounts, financial products, and devices used. Edge-type data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns.

[0064] The node characteristics of an account include identity characteristics and transaction capability characteristics; the node characteristics of a financial product include basic identification characteristics and business attribute characteristics; the node characteristics of the device used include physical characteristics, behavioral characteristics, and historical operation records.

[0065] The edge features of the transaction relationship include basic transaction attribute features and behavioral features. The basic transaction attribute features include transaction amount, transaction volume, and transaction timestamp; the behavioral features include the number of transactions; the edge features of the login relationship include login geographical location and IP address attribution.

[0066] Specifically, extracting node features means extracting account node features, financial product node features, and device node features. The account node features include at least identity features (account ID, account type) and trading capability features (capital size, position concentration, average holding period, etc.). The financial product node features include at least basic identification features (digital code, sector type, etc.) and business attribute features (risk level, industry classification, price fluctuation limit, etc.). The device node features include at least physical features (device ID, device type, operating system, etc.), behavioral features (login frequency, commonly used IP address range, etc.) and historical operation records.

[0067] Edge features are extracted, including transaction edge features and login edge features. The transaction edge features include basic transaction attributes (transaction amount, transaction volume, transaction timestamp, etc.) and behavioral features (number of transactions, cancellation rate, deviation from market fluctuation range, etc.). The login edge features include login geographical location, IP address attribution, etc.

[0068] In one embodiment, the step of concatenating and encoding node features and edge features to obtain node embeddings and edge embeddings includes the following steps:

[0069] The account node, financial product node, and device node are concatenated based on a preset first format to obtain a first text sequence;

[0070] The first text sequence is encoded using the BERT model to obtain fixed-dimensional node embeddings;

[0071] The edges of the transaction relationship and the login relationship are concatenated based on a preset second format to obtain the second text sequence;

[0072] The second text sequence is encoded using the BERT model to obtain fixed-dimensional edge embeddings.

[0073] In a practical implementation, LLM embedding encoding is performed on account nodes, securities nodes, and device nodes. Based on the features of the data input layer, these nodes are concatenated into a text sequence according to a specified format, such as: "Account type: Institutional; Fund size: 1 million; Holding period: 30 days;...". A pre-trained BERT model is used to encode the text, outputting fixed-dimensional node embeddings.

[0074] LLM embedding encoding is applied to transaction relationships and login edges. Based on the features of the data input layer, the data is concatenated into a text sequence according to a specified format, such as: "Transaction amount: 50,000 yuan, transaction volume: XXXX; deviation from base price: +1.5%; ...". A pre-trained BERT model is used to encode the text, outputting dense vector edge embeddings of fixed dimensions.

[0075] The BERT model is a pre-trained language representation model that utilizes bidirectional context encoding and deep pre-training based on Transformers. The model architecture includes basic components: a multi-layer bidirectional Transformer Encoder, but no decoder. Its parameter scale includes BERT-Base and BERT-Large. BERT-Base has 12 layers, 768-dimensional hidden layers, 12 attention heads, and 110M parameters; BERT-Large has 24 layers, 1024-dimensional hidden layers, 16 attention heads, and 340M parameters.

[0076] The pre-training task involves randomly masking 15% of the tokens in the input, predicting the original words, alleviating the one-way limitation of traditional language models, and achieving deep bidirectional contextual understanding; NSP can determine whether sentence pairs (A,B) are continuous text (binary classification task), enhancing sentence-level representation.

[0077] Its core dense vector node embedding, that is, in BERT, the dense vector representation specification of words / sentences is called, for example: TokenEmbedding: a 768 / 1024-dimensional vector for each token in the vocabulary; SegmentEmbedding: embedding that distinguishes sentence pairs (A / B); PositionEmbedding: preserving sequence position information; Context embedding: the final output is a dynamic vector (non-static word vector).

[0078] In actual use, fine-tuning is generally required based on the usage scenario. For example, by adding a task-specific output layer, all parameters can be fine-tuned on the downstream task.

[0079] In this embodiment, if the BERT model is associated with graph embedding, the BERT model can be used for knowledge graphs or heterogeneous graphs: the node text (such as entity description) is encoded by the BERT model as the initial node feature, which can then be further aggregated by GNN (such as GAT, RGCN) to form text-enhanced node embeddings or edge embeddings.

[0080] Furthermore, this invention introduces a time encoder, where timestamps not only contain absolute time points but also implicitly include periodicity and intervals. Transaction times are transformed into vectors, enabling the spatiotemporal graph neural network model to understand the temporal dependencies of transaction behavior. The transformation and encoding of time features to obtain time embeddings includes the following steps:

[0081] Convert transaction timestamps into relative time data within the transaction day;

[0082] The relative time data is converted into a time vector to form a time vector set by using sine position encoding and cosine position encoding respectively;

[0083] The time interval between each pair of timestamps in the time vector set is calculated, and the time interval is subjected to nonlinear transformation and multilayer perceptual encoding to obtain the time embedding.

[0084] In this embodiment, the transaction timestamp of the financial product is converted into relative time data within the transaction day;

[0085] Multi-frequency coding is performed using sine and cosine position coding to convert timestamps into time feature vectors. :

[0086]

[0087]

[0088] in, This represents a constant, 3600 in this embodiment, used to control the frequency differences between different dimensions, so that the sine and cosine functions in different dimensions have different periods. Let represent the timestamp of the 2kth dimension at time t in the time encoding. Therefore, the set of timestamps is represented as:

[0089]

[0090] Calculate pairwise timestamps in the timestamp set The time interval is expressed as: ;

[0091] By performing a nonlinear transformation on the time interval, and by compressing large-scale time differences using logarithms to avoid numerical explosion, the transformed time interval is obtained, as follows:

[0092]

[0093] The transformed time interval is encoded using a multilayer perceptron (MLP) to obtain a timestamp for the encoded time interval, as shown below:

[0094]

[0095] The time-encoding of the adjusted time interval is obtained by applying exponential decay enhancement based on the weights of recent behavior, as shown below:

[0096]

[0097] in, This indicates control over the decay rate;

[0098] After embedding the temporal encoding features with the nodes, the information is input into an attention mechanism to obtain the degree of importance.

[0099]

[0100] This represents the feature vector of the i-th node in the graph. This represents the feature vector of the j-th node in the graph, initially set to... This refers to fixed-dimensional node embedding.

[0101] In one embodiment, this application constructs a heterogeneous graph model, using node type data as nodes of the heterogeneous graph model, edge type data as edges of the heterogeneous graph model, and semantic associations between nodes of different types as meta-paths.

[0102] Assigning different weights to neighboring nodes under the same meta-path is node-level attention, while assigning importance weights to different types of meta-paths is path-level attention.

[0103] By selecting the appropriate transformation matrix for the edge type of any node, the features of different types of nodes are mapped to the same feature space to obtain the projected features;

[0104] The attention coefficient is obtained by concatenating the current node with its neighboring nodes and performing LeakyReLU processing.

[0105] The projection features, corresponding attention coefficients, and importance of neighboring nodes are aggregated to obtain the temporal attention coefficients for different nodes, and then the low-dimensional density vector of nodes under each meta-path is obtained.

[0106] The global importance of each meta-path is calculated by using the node embeddings of each meta-path. The final node embedding is obtained by combining the global importance with the node embeddings of all meta-paths.

[0107] By aggregating different types of node and edge information from heterogeneous graph models, key features are extracted, and then dynamic weight adjustments are made. Time encoding affects the attention weights of edges, enabling the model to focus on recent or key period transactions. For example, it can obtain the high-frequency trading relationship between account A and financial product X, and the potential interest of account B in financial product Y (based on the trading patterns of similar accounts).

[0108] In a practical implementation, the semantic relationships between different node types are used as meta-paths, and then the attention weight of each meta-path is calculated.

[0109] Assigning different weights to neighbors within the same meta-path is node-level attention; assigning importance weights to different meta-paths is path-level attention.

[0110] Node-level attention calculation process: Based on the edge type of any node, select the corresponding transformation matrix to map the node features of different node types to the same feature space, and obtain the projected features, as shown below:

[0111]

[0112] in, This indicates the edge type of the i-th node. Represents the transformation matrix;

[0113] The attention coefficient is defined as the association strength between node i and its neighbor j along the meta-path P. After concatenating node features, the vector is obtained by passing the vector through a single-layer neural network LeakyReLU, and then the attention coefficient is obtained, as shown below:

[0114] , ;

[0115] in, Let P represent the learnable attention vector of the meta-path P. This represents the meta-path-based neighbor nodes of node i. This represents the attention coefficient of neighboring nodes normalized by Softmax;

[0116] By aggregating the projection features, corresponding attention coefficients, and importance levels of neighbors, the temporal attention coefficients for different nodes are calculated, thus yielding the low-dimensional density vector of nodes under the meta-path P, as shown below:

[0117]

[0118] This represents the Sigmoid function. This represents the result of the time-coded embedding layer. Indicates projection features.

[0119] Path-level attention computation process: node embedding based on learnable vectors q, Tanh, and metapath P. The global importance of each meta-path P is calculated as follows:

[0120] ,

[0121] in, This indicates the global importance of all metapaths after Softmax normalization. Indicates the number of nodes. Represents the weight matrix. Represents the deviation vector;

[0122] The final node embedding is obtained by weighted summing of all nodes along the metapath, as shown below:

[0123]

[0124] in, Embed for the final node.

[0125] In one embodiment, obtaining the account risk probability, transaction risk probability, and abnormal transaction probability respectively includes:

[0126] Based on the final node embedding, the node-level risk probability, i.e. the account risk probability, is obtained through the Sigmoid function of the fully connected layer;

[0127] Based on the final node embedding, the associated node embedding, and the fixed-dimensional edge embedding, a multilayer perceptron is used to calculate the edge-level risk probability, which is the transaction risk probability.

[0128] By coordinating the edge risk probability and the transaction risk probability, the abnormal transaction probability is obtained.

[0129] After obtaining the probability of abnormal transactions, an appropriate quantile is selected as the dynamic probability threshold based on the probability distribution of transactions in the current time period. The dynamic probability threshold is then used to determine whether abnormal transaction behavior has occurred in the financial product transaction scenario.

[0130] In other words, based on the final node embedding The risk probability of an account is obtained by using the sigmoid function of a fully connected layer, as shown below:

[0131]

[0132] Among them, node embedding Node features (such as account history, risk tags, and transaction frequency), and the weight matrix of the fully connected layer. Bias term The Sigmoid function compresses the output to... This indicates the probability of account risk.

[0133] Embedded based on final node Embedded related nodes The edge embedding is used to perform multilayer perceptron calculations to obtain the transaction risk probability, represented as follows:

[0134]

[0135] Among them, the associated node is embedded Transaction edge characteristics This refers to the embedding of dense vector edges of fixed dimensions, and the resulting vector dimension is... The sigmoid function compresses the output to... This indicates the probability of transaction risk.

[0136] By co-processing node-level anomaly scores and edge-level anomaly scores, the probability of anomaly transactions is obtained, as shown below:

[0137]

[0138] in, Adjustments are made based on empirical values ​​to arrive at the probability of abnormal transactions.

[0139] This invention employs a dynamic threshold adaptive mechanism to automatically adjust the threshold based on real-time transaction distribution, avoiding the lag of static thresholds. Specifically, it adjusts the threshold by sliding it across a time window, using a specific quantile as the dynamic threshold based on the probability distribution of recent transactions (which can be the last 7 days). This addresses sudden abnormal behavior in high-frequency trading scenarios, as shown below: ,when If this happens, the corresponding node will be marked as an abnormal node.

[0140] Example 2:

[0141] A financial product abnormal transaction detection system based on spatiotemporal graph neural networks, such as... Figure 2 As shown, it includes:

[0142] The data acquisition module 100 acquires relevant data of financial products and performs preprocessing, extracting relevant basic features, including node features, edge features and time features. The relevant data includes node type data, edge type data and transaction time.

[0143] The data processing module 200 concatenates and encodes the node features and edge features respectively to obtain node embeddings and edge embeddings. It transforms and encodes the time features to obtain time embeddings. It concatenates the time encoding with the node embeddings and performs attention processing to obtain the importance level.

[0144] A computation module 300 is constructed to build a multivariate heterogeneous graph based on relevant data and basic features and to define multiple meta-paths. Node-level attention is calculated based on node features and importance under the same meta-path; path-level attention is calculated based on node-level attention under different meta-paths to obtain the final node vector.

[0145] The collaborative processing module 400 obtains node-level anomaly scores and edge-level anomaly scores based on the final node vector and performs collaborative processing to obtain the probability of abnormal transactions.

[0146] The anomaly detection module 500 determines whether there are abnormal trading behaviors in financial product trading scenarios by using the probability of abnormal transactions, preset time periods, and preset dynamic probability thresholds.

[0147] Various changes and modifications made without departing from the spirit and scope of this invention, and all equivalent technical solutions, also fall within the scope of this invention.

[0148] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0149] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0150] This invention is described with reference to flowchart illustrations and / or block diagrams of the method, terminal device (system), and computer program product according to the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0151] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0152] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0153] It should be noted that:

[0154] The phrase "an embodiment" or "an embodiment" used in this specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the invention. Therefore, the phrase "an embodiment" or "an embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment.

Claims

1. A method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks, characterized in that, Includes the following steps: Acquire relevant data on financial products and preprocess them to extract relevant basic features, including node features, edge features and time features. The relevant data includes node type data, edge type data and transaction time. The node features and edge features are concatenated and encoded separately to obtain node embeddings and edge embeddings; the temporal features are transformed and encoded to obtain temporal embeddings; the temporal encoding and node embeddings are concatenated and attention processing is performed to obtain the importance level. Based on relevant data and basic features, a multivariate heterogeneous graph is constructed and multiple meta-paths are defined. Under the same meta-path, node-level attention is calculated based on node features and importance. Path-level attention is calculated based on node-level attention under different meta-paths to obtain the final node vector; Based on the final node vector and edge embedding, the node-level anomaly score and edge-level anomaly score are obtained and processed collaboratively to obtain the probability of abnormal transactions. The system uses abnormal transaction probability, preset time period, and preset dynamic probability threshold to determine whether abnormal transaction behavior exists in financial product trading scenarios. The node type data includes accounts, financial products, and devices used; the edge type data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns. Node type data is used as nodes in the heterogeneous graph model, edge type data is used as edges in the heterogeneous graph model, and the semantic association between nodes of different types is used as meta-paths. Assigning different weights to neighboring nodes under the same meta-path is node-level attention, while assigning importance weights to different types of meta-paths is path-level attention. By selecting the appropriate transformation matrix for the edge type of any node, the features of different types of nodes are mapped to the same feature space to obtain the projected features; The attention coefficient is obtained by concatenating the current node with its neighboring nodes and performing LeakyReLU processing. The projection features, corresponding attention coefficients, and importance of neighboring nodes are aggregated to obtain the temporal attention coefficients for different nodes, and then the low-dimensional density vector of nodes under each meta-path is obtained. The global importance of each metapath is calculated by embedding the nodes of each metapath. The final node vector is obtained by combining the global importance with the node embeddings of all metapaths.

2. The method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that: The node characteristics of an account include identity characteristics and transaction capability characteristics; The node characteristics of financial products include basic identification characteristics and business attribute characteristics; the node characteristics of the devices used include physical characteristics, behavioral characteristics, and historical operation records. The edge features of a transaction relationship include basic transaction attribute features and behavioral features. Basic transaction attribute features include transaction amount, transaction volume, and transaction timestamp. Behavioral characteristics include the number of transactions; edge characteristics of login relationships include login geographic location and IP address attribution.

3. The method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that, The step of concatenating and encoding node features and edge features to obtain node embeddings and edge embeddings includes the following steps: The account node, financial product node, and device node are concatenated based on a preset first format to obtain a first text sequence; The first text sequence is encoded using the BERT model to obtain fixed-dimensional node embeddings; The edges of the transaction relationship and the login relationship are concatenated based on a preset second format to obtain the second text sequence; The second text sequence is encoded using the BERT model to obtain fixed-dimensional edge embeddings.

4. The method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that, The process of transforming and encoding the time features to obtain the time embedding includes the following steps: Convert transaction timestamps into relative time data within the transaction day; The relative time data is converted into a time vector to form a time vector set by using sine position encoding and cosine position encoding respectively; The time interval between each pair of timestamps in the time vector set is calculated, and the time interval is subjected to nonlinear transformation and multilayer perceptual encoding to obtain the time embedding.

5. The method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that, The node-level anomaly score obtained based on the final node vector and edge embedding includes: Based on the final node vector, the node-level risk probability, i.e. the account risk probability, is obtained through the Sigmoid function of the fully connected layer; Based on the final node vector, the embedded related nodes, and the edge embedding of a fixed dimension, a multilayer perceptron is used to calculate the edge-level risk probability, which is the transaction risk probability. By combining the probability of account risk and the probability of transaction risk, the probability of abnormal transactions is obtained.

6. The method for detecting abnormal transactions in financial products based on spatiotemporal graph neural networks according to claim 1, characterized in that, The method of determining whether abnormal trading behavior exists in a financial product trading scenario by using abnormal transaction probability, a preset time period, and a preset dynamic probability threshold specifically involves: Based on the probability distribution of transactions in the current time period, an appropriate quantile is selected as a dynamic probability threshold. The dynamic probability threshold is used to determine whether abnormal trading behavior occurs in the financial product trading scenario.

7. A financial product abnormal transaction detection system based on spatiotemporal graph neural network, characterized in that, include: The data acquisition module acquires relevant data of financial products and preprocesses it, extracting relevant basic features, including node features, edge features and time features. The relevant data includes node type data, edge type data and transaction time. The data processing module concatenates and encodes node features and edge features to obtain node embeddings and edge embeddings, transforms and encodes temporal features to obtain temporal embeddings, concatenates the temporal encoding with the node embeddings and performs attention processing to obtain the importance level. The computation module is constructed to build a multivariate heterogeneous graph based on relevant data and basic features and to define multiple meta-paths. Under the same meta-path, node-level attention is calculated based on node features and importance. Path-level attention is calculated based on node-level attention under different meta-paths to obtain the final node vector; The collaborative processing module obtains node-level and edge-level anomaly scores based on the final node vector and performs collaborative processing to obtain the probability of abnormal transactions. The anomaly detection module determines whether there are abnormal trading behaviors in financial product trading scenarios by using the probability of abnormal transactions, preset time periods, and preset dynamic probability thresholds. The node type data includes accounts, financial products, and devices used; the edge type data includes transaction relationships between accounts and financial products, login relationships between accounts and devices, and account similarity calculated based on historical transaction patterns. Node type data is used as nodes in the heterogeneous graph model, edge type data is used as edges in the heterogeneous graph model, and the semantic association between nodes of different types is used as meta-paths. Assigning different weights to neighboring nodes under the same meta-path is node-level attention, while assigning importance weights to different types of meta-paths is path-level attention. By selecting the appropriate transformation matrix for the edge type of any node, the features of different types of nodes are mapped to the same feature space to obtain the projected features; The attention coefficient is obtained by concatenating the current node with its neighboring nodes and performing LeakyReLU processing. The projection features, corresponding attention coefficients, and importance of neighboring nodes are aggregated to obtain the temporal attention coefficients for different nodes, and then the low-dimensional density vector of nodes under each meta-path is obtained. The global importance of each metapath is calculated by embedding the nodes of each metapath. The final node vector is obtained by combining the global importance with the node embeddings of all metapaths.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.

9. A device for detecting abnormal transactions in financial products based on a spatiotemporal graph neural network, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 6.

Images