A fund flow monitoring method and system based on knowledge graph fusion calculation

Abstract

The application discloses a kind of based on knowledge graph fusion computing's fund flow monitoring method and system, it is related to intelligent risk control technical field, including, acquisition customer name and in-line and outside identification, after being preprocessed, it is connected to probe and loop mining by graph database, generate customer association graph, and acquisition target customer ID and transaction flow, construct fund flow time series graph;Using graph neural network extracts local graph features from customer association graph and fund flow time series graph, and local graph features are fused into global feature vector, input graph prediction model restores cross-institutional fund path, and outputs global fusion graph;Based on global fusion graph, carry out Do-calculus cause-effect verification calculation fund reflux probability change value, dynamically generate counterfactual query scene, and after path necessity verification, generate high-confidence abnormal path archives.The application improves the intelligent level and risk control efficiency of fund flow monitoring system.

Description

Technical Field

[0001] This invention relates to the field of intelligent risk control technology, and in particular to a method and system for monitoring cash flow based on knowledge graph fusion computing. Background Technology

[0002] With the rapid development of fintech, fund flow monitoring, as a crucial component of anti-money laundering, risk control, and compliance management, is facing increasingly complex challenges. Traditional fund flow monitoring methods primarily rely on rule-based systems and statistical analysis, focusing on pattern recognition and anomaly detection of account transaction behavior. In recent years, graph computing technology has been gradually introduced into the financial risk control field. By modeling customer, account, and transaction relationships as graph structures, it enables the overall visualization and dynamic tracking of the fund flow network. Particularly in applications combining knowledge graphs and graph neural networks, researchers are attempting to utilize graph embedding techniques to extract complex topological features, thereby improving the accuracy and interpretability of anomaly detection.

[0003] While existing technologies have made some progress in graph structure modeling, significant shortcomings remain in practical applications. First, most systems construct only single-dimensional relationship graphs, such as customer relationship graphs or transaction flow graphs, failing to effectively integrate heterogeneous information from multiple sources, resulting in an incomplete characterization of complex fund return paths. Second, existing models have weaknesses in causal reasoning capabilities, struggling to infer potential intervention effects from observed data, thus affecting their causal explanatory and predictive abilities for abnormal behavior. For example, while some systems can identify high-frequency transfers, they cannot determine whether this behavior constitutes a "closed-loop fund system" or a "money laundering cycle," lacking in-depth analysis of the underlying logical mechanisms of fund flows. Furthermore, traditional methods, when facing cross-institutional data isolation issues, typically employ centralized aggregation, ignoring the heterogeneity and dynamic evolution characteristics between nodes, thus limiting the model's generalization ability. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a fund flow monitoring method based on knowledge graph fusion computation to solve the problems of insufficient graph fusion capability and weak interpretability of abnormal behavior in the prior art.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a fund flow monitoring method based on knowledge graph fusion computing, which includes: collecting customer names and internal / external identifiers, performing preprocessing, and then using a graph database to perform connectivity detection and loop mining to generate a customer relationship graph; collecting target customer IDs and transaction records to construct a fund flow time series graph; using a graph neural network to extract local graph features from the customer relationship graph and the fund flow time series graph, fusing the local graph features into a global feature vector, inputting it into a graph prediction model to reconstruct cross-institutional fund paths, and outputting a global fusion graph; based on the global fusion graph, performing Do-calculus causal verification to calculate the change value of fund return probability, dynamically generating counterfactual query scenarios, and after verifying the necessity of the path, generating a high-confidence abnormal path file.

[0008] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the preprocessing includes standardization, missing value imputation, and abnormal data filtering, and generates a customer basic information table.

[0009] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the step of generating a customer relationship graph by performing connectivity detection and loop mining through a graph database is as follows:

[0010] Extract relationships from the customer basic information table, generate customer relationship data, and build a graph database;

[0011] Based on the graph database, a graph index is built to generate a preliminary customer relationship graph.

[0012] Connectivity detection and community discovery are performed on the initial customer relationship graph to generate a customer relationship graph with community segmentation results;

[0013] A loop detection algorithm is performed on the customer relationship graph with community segmentation results, and the special structure of the critical path is identified to generate customer relationship with critical path labeling.

[0014] Obtain the comprehensive relationship strength of customer relationships marked on the critical path, visualize the layout, and generate a customer relationship graph.

[0015] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the specific steps for collecting target customer IDs and transaction records to construct a time-series fund flow graph are as follows:

[0016] Data cleaning and transaction direction marking are performed on the target customer ID and transaction flow to generate transaction data;

[0017] The transaction counterparty information in the transaction data is matched with nodes in the customer relationship graph, and customers are classified to generate transaction data with customer classification.

[0018] After sorting the transaction data with customer classification according to time sequence, a transaction network is constructed and optimized to generate a preliminary time-series map of fund flows.

[0019] Perform time-series path analysis on the preliminary fund flow time-series map, screen key paths, and generate a fund flow time-series map with key paths;

[0020] Identify abnormal patterns in the time series graph of fund flows with critical paths, generate a time series graph of fund flows with abnormal patterns, and visualize the layout to generate the time series graph of fund flows.

[0021] As a preferred embodiment of the knowledge graph-based fund flow monitoring method of the present invention, the steps of using a graph neural network to extract local graph features from the customer relationship graph and the fund flow time series graph, and fusing the local graph features into a global feature vector, are as follows.

[0022] Extract customer relationship embedding vectors from the customer relationship graph;

[0023] Extracting fund flow embedding vectors from the time-series graph of fund flows;

[0024] An attention mechanism is used to weight and fuse the customer relationship embedding vector and the fund flow embedding vector to generate a global feature vector.

[0025] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the input graph prediction model reconstructs cross-institutional fund paths and outputs a global fusion graph. The specific steps are as follows:

[0026] Based on global feature vectors, a graph prediction model with a Node2Vec architecture is used for Monte Carlo sampling to generate a set of potential cross-institutional funding paths.

[0027] After validating the set of potential cross-institutional funding paths, cross-institutional edges are added to generate a global fusion graph.

[0028] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the specific steps for calculating the change value of fund return probability based on the global fusion graph using Do-calculus causal verification are as follows:

[0029] Identify highly correlated funding paths from the global fusion graph and define causal variables;

[0030] The intervention effect is calculated based on causal variables, and confounding is adjusted using the backdoor criterion to generate the change in the probability of fund return for highly correlated fund paths.

[0031] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the specific steps for dynamically generating counterfactual query scenarios are as follows:

[0032] Based on the change in the probability of capital return, fix non-intervention variables and modify the target path status to generate natural language query statements;

[0033] Based on natural language query statements, the trend of changes in the probability of fund return is obtained, and sensitivity analysis of key influencing factors is performed to generate counterfactual query scenarios.

[0034] As a preferred embodiment of the knowledge graph-based fusion computing-based fund flow monitoring method of the present invention, the steps for generating a high-confidence abnormal path file after verifying the necessity of the path are as follows:

[0035] Perform business significance verification, statistical significance verification, and path marking on counterfactual query scenarios to generate a set of high-confidence abnormal paths;

[0036] Based on the set of high-confidence anomaly paths, time dimension features and association network features are added to generate a high-confidence anomaly path profile.

[0037] Secondly, this invention provides a fund flow monitoring system based on knowledge graph fusion computing, comprising: a graph construction module, used to collect customer names and internal / external identifiers, perform preprocessing, and then perform connectivity detection and loop mining through a graph database to generate a customer relationship graph, and collect target customer IDs and transaction records to construct a fund flow time series graph; a feature fusion module, used to extract local graph features from the customer relationship graph and the fund flow time series graph using a graph neural network, and fuse the local graph features into a global feature vector, inputting it into a graph prediction model to reconstruct cross-institutional fund paths, and outputting a global fused graph; and a fund monitoring module, used to perform Do-calculus causal verification based on the global fused graph to calculate the change value of the fund return probability, dynamically generate counterfactual query scenarios, and after verifying the necessity of the path, generate a high-confidence abnormal path file.

[0038] Thirdly, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the knowledge graph-based fusion computing-based fund flow monitoring method as described in the first aspect of the present invention.

[0039] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the knowledge graph-based fusion computing-based fund flow monitoring method as described in the first aspect of the present invention.

[0040] The beneficial effects of this invention are as follows: by using graph neural networks to extract multi-dimensional features and fuse attention into customer relationship graphs and time-series graphs of fund flows, the accuracy of cross-institutional fund path identification and the generalization ability of the model are improved; at the same time, combined with the Do-calculus causal reasoning mechanism, causal verification and counterfactual analysis of abnormal fund return paths are realized, enhancing the interpretability and confidence of anomaly detection, solving the shortcomings of existing technologies in graph fusion modeling and causal reasoning capabilities, and improving the intelligence level and risk control efficiency of the fund flow monitoring system. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of a fund flow monitoring method based on knowledge graph fusion computing.

[0043] Figure 2 This is a schematic diagram of a fund flow monitoring system based on knowledge graph fusion computing.

[0044] Figure 3 A flowchart for constructing a customer relationship graph.

[0045] Figure 4 A flowchart for constructing a time-series graph of fund flows. Detailed Implementation

[0046] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0047] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0048] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0049] Reference Figures 1-4 This is one embodiment of the present invention, which provides a method for monitoring cash flow based on knowledge graph fusion computing, including the following steps:

[0050] S1: Collect customer names and internal / external identifiers, perform preprocessing, and then use a graph database to perform connectivity detection and loop mining to generate a customer relationship graph and simultaneously construct a time-series graph of fund flows;

[0051] S1.1: Collect customer names and internal / external identifiers, preprocess them, and generate a customer basic information table;

[0052] Furthermore, customer names are extracted from customer information storage, ensuring they include the complete company name or individual name. Internal and external identifiers are also obtained to clearly distinguish between internal and external customers. Customer names undergo character encoding standardization processing to eliminate issues such as mixed simplified and traditional characters, differences between full-width and half-width characters, and inconsistencies in special symbols. Logical validation is performed on internal and external identifiers to ensure their values ​​conform to predefined encoding standards. The processed customer names and internal / external identifiers are then associated and stored according to customer ID, generating a structured customer basic information table.

[0053] S1.2: Extract the relationships based on the customer basic information table and generate customer relationship tables;

[0054] Furthermore, equity relationships, employment relationships, related enterprise relationships, guarantee relationships, co-borrower relationships, and account association relationships are extracted from the customer basic information table;

[0055] All relationships are deduplicated and conflict-resolved to generate customer relationships;

[0056] Furthermore, the equity relationships, employment relationships, and related enterprise relationships in the enterprise registration information database are integrated with the guarantee relationships, co-borrower relationships, and account relationships within the bank to construct a unified relationship data pool. Accurate deduplication is achieved through hash value comparison and Bloom filters, and the Levenshtein distance algorithm is used to solve the name difference problem, ensuring the uniqueness of entities.

[0057] For differences in equity ratios, business registration data is used first; for conflicts in guarantee amounts, the maximum value from each source is taken. The validity of senior executives' tenure is verified by cross-checking resignation certificates and business registration change records. Business logic rules are used to detect the reverse constraints between guarantees and equity relationships, such as the guarantee amount for a company holding 60% of the shares not exceeding 40% of the net assets of the guaranteed party. Any abnormal relationships detected are manually reviewed and marked.

[0058] The strength of equity relationships is determined by the inverse logarithmic ratio of shareholding ratio to the total number of related enterprise relationships; the strength of guarantee relationships is determined by the proportion of the amount and the time decay factor; and the strength of account associations is determined by the transaction frequency and the dispersion of the amount. A standardized output table with weighted coefficients is generated, which includes core fields such as relationship type, subject ID, object ID, and strength value, to meet the regulatory requirements for data governance in the banking industry.

[0059] S1.3: Connectivity detection and loop mining are performed using a graph database to generate a customer relationship graph;

[0060] S1.3.1: Establish a graph database based on the customer basic information table and customer relationships;

[0061] Furthermore, the customer ID, customer name, and in-line / out-of-line identifiers are extracted from the customer basic information table as node attributes. Edge attributes such as relationship type, starting node ID, ending node ID, and association strength coefficient are obtained from customer relationships. A graph database structure is created, defining node and edge types and configuring data type constraints. A batch import operation is performed to convert customer basic information into node entities and customer relationships into edge entities. A primary key index for customer ID, an edge index for relationship type, and a composite index for in-line / out-of-line identifiers are established. The integrity of node and edge references is verified to ensure that the endpoints of each edge exist in the node set. Finally, an initialization report containing the number of nodes, the number of edges, and the average degree is generated, completing the graph database construction.

[0062] S1.3.2: Based on the graph database, establish a graph index and generate a preliminary customer relationship graph;

[0063] Furthermore, the customer ID in the customer basic information table is mapped to a unique node identifier, the customer name is used as a label, and the in-line and out-of-line identifiers are used as classification attributes; the equity relationship, guarantee relationship, and account relationship in the customer relationship are parsed as independent edge types, and the relationship strength coefficient is used as the edge weight attribute; the relationship table is traversed to create edge entities that precisely connect nodes, ensuring that the starting node ID and the ending node ID are accurately located; after the index is built, isolated nodes and null attribute values ​​are detected; when the node creation rate is 100% and the edge import rate is ≥99%, a preliminary customer relationship graph is generated.

[0064] S1.3.3: Connectivity detection is performed on the preliminary customer relationship graph using the Connected Component Analysis algorithm, and community detection is performed using the Louvain community detection algorithm to generate a customer relationship graph with community partitioning results;

[0065] Furthermore, a breadth-first search is performed on the initial customer relationship graph to traverse all nodes, identifying interconnected subgraph structures as connected components, and labeling the connected component number to which each node belongs. Based on the connected component numbers, the initial customer relationship graph is divided into several independent subgraphs. The Louvain community detection algorithm is applied to each connected component subgraph. Initially, each node is treated as an independent community. The modularity gain is iteratively calculated, and nodes are moved to adjacent communities. When the modularity no longer increases, the first stage of community partitioning is completed. The communities discovered in the first stage are used as supernodes to construct a new network, and the modularity optimization process is repeated until the modularity reaches a stable state. Finally, a community identifier is assigned to each node, a community number field is added to the node attributes of the customer relationship graph, and the customer relationship graph with the community partitioning results is output.

[0066] S1.3.4: Perform a loop detection algorithm on the customer relationship graph with community segmentation results, identify the special structure of the critical path, and generate customer relationship marked with critical path;

[0067] Furthermore, a depth-first search is performed on the customer relationship graph with community segmentation results to detect closed-loop funding paths; node betweenness centrality is calculated based on edge weights to identify hub nodes; the shortest path algorithm is applied to locate high-frequency trading paths, and active paths are filtered in combination with time attributes; key path markers containing path length, circulation frequency, and activity are generated; it is verified that all path nodes exist in the community structure, and the customer relationship of the key path markers is output.

[0068] S1.3.5: Obtain the comprehensive relationship strength of customer relationships marked on the critical path, visualize the layout, and generate a customer relationship graph;

[0069] Furthermore, the association strength coefficients of equity, guarantee, and account in the critical path are extracted, and the comprehensive relationship strength is obtained by weighting. Nodes are grouped by community ID and sorted according to comprehensive strength. The force-oriented layout algorithm is applied for rendering: charge repulsion parameters are set, edge weight attraction parameters are defined, and the equilibrium position of nodes is calculated iteratively. The node size is mapped to the comprehensive strength, the edge width is mapped to the association strength, community areas are marked with color blocks, and critical paths are marked with highlighted curves to output the customer relationship graph.

[0070] S1.4: Collect target customer IDs and transaction records to construct a time-series graph of fund flows;

[0071] S1.4.1: Perform data cleaning and transaction direction marking on the target customer ID and transaction flow to generate transaction data;

[0072] Furthermore, target customer IDs and transaction records are collected, simulated transaction records generated by test accounts are filtered, errors in the amount field format are corrected, and missing counterparty account information is supplemented. Transaction directions are standardized and marked, and fund flows are uniformly converted into a one-way outflow relationship based on the loan identifier field, i.e., the arrow pointing from payer to payee. Transaction types are reclassified, and business scenarios such as payroll disbursement and fee deductions are marked as special transaction types. Each cleaned transaction record contains a complete target customer ID, transaction timestamp, transaction amount, counterparty account, and transaction direction marker, serving as transaction data.

[0073] S1.4.2: Match the counterparty information in the transaction data with the nodes in the customer relationship graph, classify the customers, and generate transaction data with customer classification;

[0074] Furthermore, the counterparty accounts in the transaction data are precisely matched with nodes in the customer relationship graph. First, direct matching is performed through accounts. If no match is found, a fuzzy name matching algorithm is used to classify the counterparty into a specific node in the customer relationship graph. Based on the node attributes in the customer relationship graph, customers are classified into corporate customers within the bank and individual customers outside the bank. Customer classification tags are added to each transaction to generate transaction data with customer classification, including transaction time, amount, direction, and counterparty classification.

[0075] S1.4.3: After sorting the transaction data with customer classification according to time sequence, construct and optimize the transaction network to generate a preliminary time-series map of fund flow;

[0076] Furthermore, the transaction data with customer classifications are sorted in ascending order according to transaction timestamps, and a transaction network starting from the target customer is constructed. The payer and payee are used as nodes, and the transaction flow is used as directed edges with timestamps. Continuous transaction edges of the same counterparty are merged, and multiple small transactions within a short period of time are aggregated. Network edge attributes are added, including total transaction amount, transaction frequency, and time interval between the first and last transactions. A preliminary time-series graph of fund flow containing node attributes, edge attributes, and time-series relationships is generated.

[0077] S1.4.4: Perform time-series path analysis on the preliminary time-series fund flow map, screen key paths, and generate a time-series fund flow map with key paths;

[0078] Furthermore, a time-series path analysis algorithm is executed on the preliminary fund flow time series graph. Starting from the starting node, the fund flow path is tracked along the transaction time sequence. The path weight is allocated in combination with the time decay factor, which decreases daily. The path weight threshold is set according to the historical path weight. When the path weight is greater than the path weight threshold, a fund flow time series graph with key path identification is output. The key path attributes include total transaction amount, time span, and path activity index.

[0079] S1.4.5: Identify abnormal patterns in the time series graph of fund flow with critical path, generate a time series graph of fund flow with abnormal patterns, and visualize the layout to generate the time series graph of fund flow.

[0080] Furthermore, based on the time-series graph of fund flows with critical paths, two abnormal patterns are detected: a closed-loop fund flow pattern, which identifies transactions where the payer and payee form a loop; and a concentrated nighttime transaction pattern, which statistically analyzes the proportion of transaction volume during the 22:00-06:00 period. Risk level labels are added to the abnormal patterns, including high-risk closed-loop markers and medium-risk nighttime transaction markers. A force-directed layout algorithm is used for visualization rendering, with abnormal paths highlighted in red, node size mapping to total transaction volume, and edge width mapping to the maximum amount of a single transaction, generating a visualized time-series graph of fund flows that includes abnormal pattern markers and risk levels.

[0081] S2: Use graph neural networks to extract local graph features from customer relationship graphs and time series graphs of fund flows, and fuse the local graph features into a global feature vector. Input the vector into the graph prediction model to reconstruct the cross-institutional fund path and output the global fused graph.

[0082] S2.1: Use graph neural networks to extract local graph features from customer relationship graphs and time series graphs of fund flows, and fuse them into a global feature vector;

[0083] S2.1.1: Extract customer relationship embedding vectors from the customer relationship graph using a graph neural network;

[0084] Furthermore, a two-layer graph convolutional network structure is used to construct a graph neural network architecture on the customer relationship graph. The in-row and out-of-row identifiers and customer type codes in the customer basic information table are used as the initial feature vectors of the nodes. The first layer of the graph convolutional network aggregates the feature information of directly adjacent nodes and generates intermediate node representations through weight matrix transformation and activation function processing. The second layer of the graph convolutional network further integrates multi-hop relationship features based on the intermediate node representations and performs feature propagation by combining the differentiated weight coefficients of equity relationship edges and guarantee relationship edges in the adjacency matrix. The output is a customer relationship embedding vector with a fixed dimension. The customer relationship embedding vector corresponds to the low-dimensional feature representation of the unique customer node in the customer relationship graph, preserving the topological structure and relationship strength information between nodes.

[0085] S2.1.2: Extract the fund flow embedding vector from the time series graph of fund flow using a graph neural network;

[0086] Furthermore, a time-series graph neural network architecture is constructed on the time-series graph of fund flows using a gated recurrent unit structure. Transaction data with customer classification is segmented into continuous transaction units according to time windows. Each transaction unit contains a feature vector consisting of a transaction amount and an opponent classification label. Short-term fund flow characteristics are preserved through hidden state storage units, and the latent pattern representation of transaction paths is calculated using a trainable parameter matrix. In the node importance scoring mechanism, feature weights of transaction nodes are calculated based on transaction frequency and amount, generating fixed-dimensional fund flow embedding vectors. Each fund flow embedding vector simultaneously contains the transaction behavior characteristics and path-level flow pattern characteristics of nodes in the time-series graph of fund flows, fully preserving the dynamic evolution characteristics of the time-series transaction network.

[0087] S2.1.3: Use an attention mechanism to weightedly fuse the customer relationship embedding vector and the fund flow embedding vector to generate a global feature vector;

[0088] Furthermore, a dual-channel feature fusion architecture is established to process customer relationship embedding vectors and fund flow embedding vectors. The processed customer relationship embedding vectors and fund flow embedding vectors are uniformly converted into intermediate feature representations through a fully connected transformation layer. An attention scoring matrix is ​​constructed to calculate the degree of interaction between the two features. The hyperbolic tangent activation function is used to process the feature association strength, generate channel-specific weight coefficients, quantify the contribution ratio of static relationship features and dynamic flow features. The static relationship channel weight reflects the stability value of the association network, while the dynamic flow channel weight captures the timeliness value of funds. A weighted summation calculation is then performed to generate a global feature vector.

[0089] S2.2: Input the graph prediction model to reconstruct cross-institutional funding paths and output a global fusion graph;

[0090] S2.2.1: Based on global feature vectors, a graph prediction model with a Node2Vec architecture is used for Monte Carlo sampling to generate a set of potential cross-institutional funding paths;

[0091] Furthermore, the Node2Vec graph prediction model processing flow is initiated based on global feature vectors. The random walk parameters of the Node2Vec architecture are initialized, and return and input / output parameters are set to control the walk directionality. A fixed-step random walk simulation is performed from the initial client node, generating a set of node sequence paths. A Monte Carlo sampling strategy is applied for multiple iterations, with each iteration generating a new node access sequence. All sampled paths are collected to form a set of potential cross-institutional funding paths, with each path recording the node access order and temporal relationship. Invalid short paths and cyclically redundant paths are filtered out, and a candidate path set containing the path node ID sequence, access frequency, and path weight score is output, completing the exploratory discovery of funding paths.

[0092] S2.2.2: After verifying the set of potential cross-institutional funding paths, add cross-institutional edges to generate a global fusion graph;

[0093] Furthermore, a triple verification mechanism is implemented for potential cross-institutional funding paths. First, cross-institutional node entities are matched using their business registration numbers to confirm the existence of the path endpoint institutions. Second, the temporal continuity of the funding path is checked to verify whether the transaction timestamps form a coherent sequence. Finally, the reasonableness of the path amount is checked to confirm that the cumulative transfer amount is consistent with the normal operating scale of the enterprises. Verified paths are added to the global fusion graph, creating new cross-institutional edges connecting nodes of different financial institutions. Cross-institutional edge attributes include fields such as path verification status, cumulative transaction amount, and the time interval between the first and last transactions. The graph index structure is updated, and the node centrality index is recalculated, outputting a global fusion graph containing cross-institutional funding channels.

[0094] S3: Based on the global fusion graph, perform Do-calculus causal verification to calculate the change value of the probability of fund return, dynamically generate counterfactual query scenarios, and after verifying the necessity of the path, generate a high-confidence abnormal path profile.

[0095] S3.1: Based on the global fusion graph, perform Do-calculus causal verification to calculate the change value of the probability of fund return and dynamically generate counterfactual query scenarios;

[0096] S3.1.1: Identify highly correlated funding paths from the global fusion graph and define causal variables;

[0097] Furthermore, based on the correlation strength coefficients in the historical global fusion graph, a coefficient threshold is set, and funding paths with correlation strength coefficients exceeding the threshold are selected as candidate sets of high-correlation funding paths. The betweenness centrality of high-correlation funding paths is calculated, and the funding path with the highest centrality is selected as the official high-correlation funding path. The starting node of the funding path is defined as the intervention variable, and the ending node as the outcome variable. The node type characteristics and transaction frequency characteristics of the funding path are labeled as moderating variables, and the transaction timestamp sequence is used as a time covariate. Special structural features, including funding loop identifiers, cross-border transaction identifiers, and abnormal transaction node identifiers, are recorded to generate a structured high-correlation funding path dataset containing unique path identifiers, starting and ending node numbers, a set of moderating variables, and a time covariate sequence, thus completing the goal of defining causal variables.

[0098] S3.1.2: Calculate the intervention effect based on causal variables, and adjust for confounding factors using the backdoor criterion to generate the change value of the probability of fund return for highly correlated fund paths;

[0099] Furthermore, an intervention simulation was performed on the highly correlated fund path dataset. The set of moderating variables was kept constant, and the change in the starting node state was used to calculate the change in the probability of fund return. The backdoor criterion was applied to identify non-causal paths, and interference from backdoor paths was cut off by blocking intermediate nodes. Propensity score weighting was used to balance the differences in moderating variables, and time series differencing was used to eliminate the persistent influence of historical transactions. A quantitative table was generated by calculating the difference in the probability of fund return before and after the intervention, recording the baseline probability value, the probability value after the intervention, the probability change value, and statistical significance. The change in the probability of fund return for highly correlated fund paths was output.

[0100] S3.1.3: Based on the change in the probability of capital return, fix the non-intervention variables and modify the target path status to generate a natural language query statement.

[0101] The target funding path is identified based on the quantitative results table of changes in the probability of fund return. A fixed set of non-interventional variables is maintained in its initial state, while the trading direction or frequency characteristics of the target funding path are modified to create a state change scenario. The path state change parameters are converted into a natural language description template, generating a query statement including three elements: the changing element, the affected object, and the reference time point. Structured natural language queries are output, such as a query on the trend of the impact of a decrease in the target path's trading frequency on the probability of fund return, or a query on the change in fund return at a specific time point after the target path's trading direction reverses, thus completing the construction of the target natural language query statement.

[0102] S3.1.4: Based on the natural language query statement, obtain the trend of changes in the probability of fund return, and perform sensitivity analysis of key influencing factors to generate counterfactual query scenarios;

[0103] Furthermore, natural language queries are executed to analyze the changing trends in the probability of fund return. Gradient perturbations are applied to key influencing factors, including adjusting transaction time intervals, changing transaction amount ratios, and modifying node type weights. The changes in the probability of fund return under different perturbation intensities are recorded to form a sensitivity matrix. This sensitivity matrix is ​​integrated with path association network features, and a time dimension feature is added to form a counterfactual query scenario data block. The output counterfactual query scenario includes factor perturbation parameters, probability response curves, association network feature groups, and time window identifiers, completing the goal of constructing a multidimensional analysis scenario.

[0104] It should be noted that the key influencing factors are derived from the inherent characteristics of the transaction time interval, transaction amount ratio, and node type weight in the time series graph of fund flow. Variables with intervention effects on the probability of fund return are screened through Do-calculus causal verification, and combined with regulatory compliance indicators in the business rule base, the standardized key influencing factors are finally formed.

[0105] S3.2: After verifying the necessity of the path, generate a high-confidence abnormal path;

[0106] S3.2.1: Perform business significance verification, statistical significance verification, and path marking for counterfactual query scenarios to generate a set of high-confidence abnormal paths;

[0107] Furthermore, business rule matching verification is performed on counterfactual query scenarios to check whether the fund path violates the restrictions on fund usage; statistical significance verification is carried out to calculate the p-value index of hypothesis testing and confirm that the probability change value exceeds the decision threshold; three-level risk labels are added to paths that simultaneously meet the business violation and statistical significance indicators: the first-level label marks the type of regulatory rule violation, the second-level label marks the abnormal magnitude of the fund return probability, and the third-level label marks the path structure characteristics; a set of high-confidence abnormal paths containing unique path codes, risk levels, rule violation entries, and statistical significance indicators is generated to complete the cross-validation and classification labeling of abnormal paths.

[0108] S3.2.2: Based on the set of high-confidence anomaly paths, add time dimension features and association network features to generate a high-confidence anomaly path profile;

[0109] Furthermore, based on the high-confidence abnormal path set, time features are extracted to calculate the transaction frequency change rate and capital flow time concentration index of path nodes over the past three months; network features are extracted, including the difference in betweenness centrality of path endpoints, community crossing coefficient, and neighborhood risk contagion index; time features and network features are integrated to generate structured archive fields: path code, time feature vector, network feature vector, and risk label combination; traceable metadata is added, including the data source institution code, last update timestamp, and verification personnel employee number; high-confidence abnormal path archives that conform to financial data archiving standards are output, with each archive containing complete spatiotemporal features and risk labels, achieving the goal of constructing a holographic profile of abnormal behavior.

[0110] All of the above content has been agreed to by the user and used through legal channels.

[0111] This embodiment also provides a fund flow monitoring system based on knowledge graph fusion computing, including: a graph construction module, used to collect customer names and internal / external identifiers, perform preprocessing, and then use a graph database to perform connectivity detection and loop mining to generate a customer relationship graph, and collect target customer IDs and transaction records to construct a fund flow time series graph; a feature fusion module, used to use a graph neural network to extract local graph features from the customer relationship graph and the fund flow time series graph, and fuse the local graph features into a global feature vector, input it into a graph prediction model to reconstruct cross-institutional fund paths, and output a global fused graph; and a fund monitoring module, used to perform Do-calculus causal verification based on the global fused graph to calculate the change value of the fund return probability, dynamically generate counterfactual query scenarios, and after verifying the necessity of the path, generate a high-confidence abnormal path file.

[0112] This embodiment also provides a computer device applicable to the knowledge graph-based fusion computing-based fund flow monitoring method, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the knowledge graph-based fusion computing-based fund flow monitoring method proposed in the above embodiment.

[0113] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0114] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the knowledge graph-based fusion computing-based fund flow monitoring method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0115] In summary, this invention improves the accuracy of cross-institutional fund path identification and model generalization ability by using graph neural networks to extract multi-dimensional features and fuse attention into customer relationship graphs and time-series fund flow graphs. Simultaneously, by combining a Do-calculus causal reasoning mechanism, it achieves causal verification and counterfactual analysis of abnormal fund return paths, enhancing the interpretability and confidence of anomaly detection. This addresses the shortcomings of existing technologies in graph fusion modeling and causal reasoning capabilities, and improves the intelligence level and risk control efficiency of the fund flow monitoring system.

[0116] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A fund flow monitoring method based on knowledge graph fusion computing, characterized in that: Comprise, Collect customer name and internal and external identification, after preprocessing, conduct connectivity detection and loop mining through the graph database, generate customer association relationship graph, and collect target customer ID and transaction flow, construct fund flow time sequence graph; Use graph neural network to extract local graph features from customer association relationship graph and fund flow time sequence graph, and fuse local graph features into global feature vector, input graph prediction model to restore cross-institution fund path, output global fusion graph, the specific steps are as follows, Based on the global feature vector, the graph prediction model with Node2Vec architecture is used for Monte Carlo sampling to generate a set of potential cross-institution fund paths; After verifying the set of potential cross-institution fund paths, add cross-institution edges to generate a global fusion graph; Based on the global fusion graph, calculate the fund reflux probability change value by Do-calculus causal verification, the specific steps are as follows, Identify high correlation fund paths from the global fusion graph, and define causal variables; Calculate the intervention effect according to the causal variables, and adjust the confounding through the backdoor rule to generate the fund reflux probability change value of the high correlation fund path; Generate counterfactual query scenarios dynamically, and generate high-confidence abnormal path archives after path necessity verification. 2.The knowledge graph fusion computing-based fund flow monitoring method of claim 1, wherein: The preprocessing includes standardization, missing value filling and abnormal data filtering to generate a customer basic information table. 3.The knowledge graph fusion computing-based fund flow monitoring method of claim 2, wherein: The connectivity detection and loop mining through the graph database to generate the customer association relationship graph, the specific steps are as follows, Extract customer association relationship from the customer basic information table, and establish a graph database; Based on the graph database, establish a graph index to generate a preliminary customer association relationship graph; Conduct connectivity detection and community discovery on the preliminary customer association relationship graph to generate a customer association relationship graph with community division results; Execute loop detection algorithm on the customer association relationship graph with community division results, and identify the special structure of the key path to generate a key path marked customer association relationship; Get the comprehensive relationship strength of the key path marked customer association relationship, and generate a customer association relationship graph through visual layout. 4.The method of claim 3, wherein: The specific steps of collecting target customer ID and transaction flow to construct fund flow time sequence graph are as follows, Data cleaning and transaction direction marking are performed on the target customer ID and transaction flow to generate transaction data; Match the transaction counterparty information in the transaction data with the nodes in the customer association relationship graph, and generate transaction data with customer classification; Sort the transaction data with customer classification in time sequence, construct a transaction network and optimize it to generate a preliminary fund flow time sequence graph; Perform time sequence path analysis on the preliminary fund flow time sequence graph, and filter the key path to generate a fund flow time sequence graph with key path; Identify abnormal patterns in the fund flow time sequence graph with key path, and generate a fund flow time sequence graph through visual layout. 5.The knowledge graph fusion computing-based fund flow monitoring method of claim 4, wherein: The specific steps of using graph neural network to extract local graph features from customer association relationship graph and fund flow time sequence graph, and fusing local graph features into global feature vector are as follows, extracting a customer association relationship embedding vector from a customer association relationship graph; extracting a fund flow direction embedding vector from a fund flow direction time series graph; using an attention mechanism to weight and fuse the customer association relationship embedding vector and the fund flow direction embedding vector to generate a global feature vector. 6.The knowledge graph fusion computing based fund flow monitoring method of claim 1, wherein: The dynamically generated counterfactual query scenario has the following specific steps, Based on the fund flow probability change value, fix the non-intervention variable and modify the target path state to generate a natural language query sentence; According to the natural language query sentence, the fund flow probability change trend is obtained, and the key influence factor sensitivity analysis is carried out to generate a counterfactual query scenario.

7. The knowledge graph fusion computing-based fund flow monitoring method of claim 6, wherein: After the path necessity verification, a high-confidence abnormal path archive is generated, and the specific steps are as follows, Business significance verification, statistical significance verification and path marking are performed on the counterfactual query scenario to generate a high-confidence abnormal path set; Based on the high-confidence abnormal path set, time dimension features and association network features are added to generate a high-confidence abnormal path archive. 8.A fund flow monitoring system based on knowledge graph fusion computing, based on the fund flow monitoring method based on knowledge graph fusion computing of any one of claims 1-7, characterized in that: It includes, The graph construction module is used to collect customer names and internal and external identifiers, and after preprocessing, it is connected to the detection and loop mining through the graph database to generate a customer association relationship graph, and to collect target customer ID and transaction flow to construct a fund flow direction time series graph; The feature fusion module is used to extract local graph features from the customer association relationship graph and the fund flow direction time series graph using a graph neural network, and to fuse the local graph features into a global feature vector, input the graph prediction model to restore the cross-institution fund path, and output the global fusion graph; The fund monitoring module is used to calculate the fund flow probability change value based on the global fusion graph, dynamically generate a counterfactual query scenario, and generate a high-confidence abnormal path archive after path necessity verification.

Images