A big data fraud prevention method based on multi-modal behavior features

Abstract

The application discloses a big data fraud prevention method based on multi-modal behavior characteristics, and particularly relates to the field of fraud prevention; the method comprises the following steps: collecting original behavior data of a target user, and constructing a multi-modal behavior characteristic data set; performing intra-modal stability evaluation and inter-modal consistency evaluation on the multi-modal behavior characteristic data set, and extracting single-modal behavior patterns and inter-modal difference conflict features; modeling a trusted behavior pattern based on the single-modal behavior patterns, and generating trusted feature representations of each type of mode; calculating mode influence weights of potential modal conflict areas based on the inter-modal difference conflict features; performing modal weighted fusion and conflict suppression according to the trusted feature representations and the mode influence weights, and obtaining a multi-modal fusion behavior characteristic vector; and inputting the multi-modal fusion behavior characteristic vector into a fraud prevention risk identification model to determine a fraud risk level of the target user behavior, so that the accuracy and reliability of fraud prevention analysis are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of anti-fraud technology, and more specifically, to a big data anti-fraud method based on multimodal behavioral characteristics. Background Technology

[0002] With the development of internet and information technology, and the popularization of social platforms, mobile payment, and communication services, the scale of users' online behavior data continues to increase.

[0003] Traditional anti-fraud technologies typically analyze user behavior based on data from a single channel or modality, without fully considering the correlations and conflicts between different modalities of data. This can easily lead to misjudgments or omissions in risk identification, reducing the accuracy and reliability of fraud risk assessment. Summary of the Invention

[0004] To overcome the aforementioned deficiencies of the prior art, embodiments of the present invention provide a big data anti-fraud method based on multimodal behavioral characteristics to solve the problems mentioned in the background art.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] A big data-based anti-fraud method based on multimodal behavioral characteristics includes the following steps:

[0007] S1: Obtain the raw behavioral data of the target user at multiple data collection points, and perform temporal alignment and modal label encoding on the raw behavioral data to generate a multimodal behavioral feature dataset in a unified format;

[0008] S2: Evaluate intramodal stability and intermodal consistency of the multimodal behavioral feature dataset, and extract single-modal behavioral patterns and intermodal discrepancy conflict features respectively;

[0009] S3: Model trusted behavior patterns based on single-modal behavior patterns and output trusted feature representations for each modality;

[0010] S4: Based on the intermodal difference conflict characteristics, identify potential modal conflict interference regions and calculate the modal influence weights of potential modal conflict regions;

[0011] S5: Based on the credible feature representation and modal influence weights, perform modal weighted fusion and conflict suppression to generate a conflict-suppressed multimodal fusion behavior feature vector;

[0012] S6: Input the conflict-suppressed multimodal fusion behavioral feature vector into the anti-fraud risk identification model, and output the fraud risk level judgment result of the target user behavior.

[0013] In a preferred embodiment, S1 specifically refers to:

[0014] Collect raw behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals;

[0015] The original behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals are unified with timestamps and synchronized with time bases.

[0016] Modal category label encoding is performed on the original behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals after the timestamps are unified and synchronized with the time base, to generate a multimodal behavioral feature dataset in a unified format.

[0017] In a preferred embodiment, S2 specifically refers to:

[0018] The multimodal behavioral feature dataset is divided into social platform modal feature data, payment terminal modal feature data, and communication terminal modal feature data according to modal category;

[0019] For each type of modal feature data, the statistical mean, variance, and fluctuation coefficient are calculated based on a sliding time window to complete the intramodal stability assessment and output the corresponding single-modal behavior pattern.

[0020] For any two types of modal feature data, calculate the time synchronization cosine similarity and spatial feature difference, compare the synchronization consistency of the multimodal behavioral feature dataset with the spatial difference of the feature vectors, complete the intermodal consistency assessment, and output the intermodal difference conflict features.

[0021] In a preferred embodiment, S3 specifically refers to:

[0022] For single-modal behavior patterns in social platform modal feature data, a historical behavior trajectory clustering method is used to construct a credible behavior pattern feature space for social platform modalities, and output a credible feature representation of social platform modalities.

[0023] For the single-modal behavior pattern of payment terminal modal feature data, the transaction feature frequency statistics method is used to construct the credible behavior pattern feature space of payment terminal modality and output the credible feature representation of payment terminal modality;

[0024] For single-modal behavior patterns of communication terminal modal feature data, a reliable behavior pattern feature space of communication terminal modality is constructed using the communication relationship network feature extraction method, and a reliable feature representation of communication terminal modality is output.

[0025] In a preferred embodiment, S4 specifically refers to:

[0026] Based on the intermodal difference conflict characteristics, the spatial distribution area of ​​the intermodal difference conflict characteristics is identified as the potential modal conflict interference area;

[0027] The feature difference degree based on variance contribution is calculated for the modal feature data of social platforms, payment terminals and communication terminals in the potential modal conflict interference area to obtain the feature difference degree of each modality in the potential modal conflict interference area;

[0028] The feature difference degree of each mode in the potential modal conflict interference region is standardized and converted into modal influence weights;

[0029] Each mode within the potential modal conflict interference region is assigned a corresponding modal influence weight.

[0030] In a preferred embodiment, S5 specifically refers to:

[0031] The credible feature representations of social platform modality, payment terminal modality, and communication terminal modality are respectively subjected to element-wise operations with the corresponding modality influence weights to obtain weighted modal feature representations;

[0032] The weighted modal feature representations are subjected to conflict suppression processing, and vector-level concatenation and merging are performed according to a preset concatenation order to obtain the initial multimodal fusion behavioral feature vector;

[0033] The initial multimodal fusion behavior feature vector is normalized and its feature dimension is compressed to output the conflict-suppressed multimodal fusion behavior feature vector.

[0034] In a preferred embodiment, S6 specifically refers to:

[0035] The multimodal fusion behavioral feature vector is input into the anti-fraud risk identification model, which consists of a feature normalization layer, a fully connected classification layer, and a risk threshold determination layer in sequence.

[0036] The feature normalization layer performs zero-mean normalization and unit variance scaling on the feature vectors of multimodal fusion behavior;

[0037] The fully connected classification layer obtains weight parameters based on historical labeled data, and performs matrix multiplication and bias addition operations on the multimodal fusion behavioral feature vector after the feature normalization layer is processed, and outputs a fraud risk probability vector.

[0038] The risk threshold determination layer compares the fraud risk probability vector with a preset set of risk level thresholds and maps the fraud risk probability vector to the fraud risk level determination result of the target user's behavior.

[0039] The technical effects and advantages of this invention's big data anti-fraud method based on multimodal behavioral characteristics:

[0040] By unifying temporal alignment and modal labeling, seamless fusion of raw behavioral data from social platforms, payment terminals, and communication terminals is achieved, overcoming fusion problems caused by inconsistencies in data formats and time bases. Through intramodal stability assessment and intermodal consistency assessment, single-modal behavioral patterns and intermodal discrepancy conflict features are extracted, enabling refined analysis of each modality's features. Based on single-modal behavioral patterns, credible behavioral pattern modeling is performed, generating reliable feature representations for each modality. Based on intermodal discrepancy conflict features, potential conflict interference regions are identified and modal influence weights are calculated, effectively suppressing intermodal conflicts. Weighted fusion and conflict suppression are performed by combining credible feature representations and modal influence weights to generate a multimodal fusion feature vector. This multimodal fusion feature vector is input into a risk identification model, outputting a fraud risk level determination result for the target user's behavior. This significantly improves the accuracy and stability of fraud risk determination and enhances the accuracy and robustness of fraud behavior identification in a big data environment. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of a big data anti-fraud method based on multimodal behavioral characteristics according to the present invention. Detailed Implementation

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0043] Example

[0044] Figure 1 This invention presents a big data anti-fraud method based on multimodal behavioral features, which includes the following steps:

[0045] S1: Obtain the raw behavioral data of the target user at multiple data collection points, and perform temporal alignment and modal label encoding on the raw behavioral data to generate a multimodal behavioral feature dataset in a unified format;

[0046] S2: Evaluate intramodal stability and intermodal consistency of the multimodal behavioral feature dataset, and extract single-modal behavioral patterns and intermodal discrepancy conflict features respectively;

[0047] S3: Model trusted behavior patterns based on single-modal behavior patterns and output trusted feature representations for each modality;

[0048] S4: Based on the intermodal difference conflict characteristics, identify potential modal conflict interference regions and calculate the modal influence weights of potential modal conflict regions;

[0049] S5: Based on the credible feature representation and modal influence weights, perform modal weighted fusion and conflict suppression to generate a conflict-suppressed multimodal fusion behavior feature vector;

[0050] S6: Input the conflict-suppressed multimodal fusion behavioral feature vector into the anti-fraud risk identification model, and output the fraud risk level judgment result of the target user behavior.

[0051] S1: Acquire the raw behavioral data of the target user at multiple data collection points, and perform temporal alignment and modal label encoding on the raw behavioral data to generate a unified format multimodal behavioral feature dataset, including:

[0052] Collect raw behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals;

[0053] Target users refer to individual users or groups of users who are to be monitored and analyzed, such as registered users on social networking platforms, transaction users on payment platforms, and communication users on communication platforms. In their daily lives, target users perform specific actions through various channels, and these actions leave corresponding data records on different channels; these data records are called raw behavioral data. For example, at social media platform data collection points, the text messages posted by target users, the images or videos they post or forward, the content they like or comment on posted by other users, and the various log records generated by behaviors such as following or unfollowing are all raw behavioral data obtained at social media platform data collection points. At payment terminal data collection points, the transaction records formed by target users' consumption or payment transactions using payment platforms, such as the transaction time, transaction amount, merchant category, transaction location, and payment method, are all raw behavioral data obtained at payment terminal data collection points. At communication terminal data collection points, the communication behaviors between target users and other users, such as call behavior or SMS sending and receiving behavior, including call start time, call duration, call frequency, SMS sending and receiving records, and communication number location information, are all raw behavioral data at communication terminal data collection points.

[0054] The original behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals are unified with timestamps and synchronized with time bases.

[0055] Because the raw behavioral data of target users at social media platform data collection points, payment terminal data collection points, and communication terminal data collection points belong to separate independent platforms, and each platform has different clock systems and data recording formats for the raw behavioral data collection process, the timestamps of the raw behavioral data are usually asynchronous or inconsistent. To ensure temporal consistency of the raw behavioral data recorded across different platforms and facilitate correlation analysis between different modalities, it is necessary to unify the timestamps of all raw behavioral data. A unified standard clock, such as Coordinated Universal Time (UTC) or Beijing Time, is set as the time reference. The timestamps of the raw behavioral data from social media platform data collection points, payment terminal data collection points, and communication terminal data collection points are then calibrated. Specifically, the time difference between the original timestamps of the raw behavioral data from each data collection point and the unified standard clock is first obtained. The time difference is then subtracted from or added to the original timestamp of each piece of raw behavioral data, thus unifying the timestamps of all data under the unified standard clock. For example, if there is a time error between the timestamp of a target user's posting behavior recorded on the social media platform and the standard clock, the original timestamp of the recorded posting behavior is corrected to the timestamp under the standard clock after calculating the time difference. After the above processing, the raw behavioral data from different data collection points will be adjusted to a unified time scale, and all behavioral data will have a unified time reference.

[0056] Modal category label encoding is performed on the original behavioral data of target users at social platform data collection points, payment terminal data collection points, and communication terminal data collection points after the timestamp is unified and synchronized with the time base, to generate a multimodal behavioral feature dataset in a unified format;

[0057] After processing, the raw behavioral data collected from social media platforms, payment terminals, and communication terminals possesses a unified timestamp and standard clock. However, the modal source attributes are not specified for data collected from different modalities. Therefore, to differentiate and effectively integrate the data from various modalities, all raw behavioral data needs to undergo modal category labeling. This involves labeling each piece of data with its corresponding modal category. Specifically, a dedicated category label is established for each modal data category. For example, a social media platform modal label is used for social media data, a payment terminal modal label for payment terminal data, and a communication terminal modal label for communication terminal data. Each piece of data processed with a unified timestamp is then tagged and assigned a modal category label corresponding to its modality. For instance, a record representing a user's "like" action on a social media platform would be assigned a social media platform modal label. After labeling, each piece of data receives a modal category identifier. After completing the modality category label encoding process, all raw behavioral data that have been time-bound and labeled with modality tags are stored in a unified data format, such as a structured table, to form a unified multimodal behavioral feature dataset.

[0058] S2: Perform intramodal stability assessment and intermodal consistency assessment on the multimodal behavioral feature dataset, and extract single-modal behavioral patterns and intermodal discrepancy conflict features, including:

[0059] The multimodal behavioral feature dataset is divided into social platform modal feature data, payment terminal modal feature data, and communication terminal modal feature data according to modal category;

[0060] The multimodal behavioral feature dataset is divided according to modal category labels. Data containing all data collected from social media platforms and labeled with social media modal labels is classified as social media modal feature data; data containing all data collected from payment terminals and labeled with payment terminal modal labels is classified as payment terminal modal feature data; and data containing all data collected from communication terminals and labeled with communication terminal modal labels is classified as communication terminal modal feature data. For example, if a set of data in the multimodal behavioral feature dataset comes from user comments, likes, etc., on social media platforms, and all of these data have social media modal labels, then this data is classified as social media modal feature data. Similarly, user payment record data will be classified as payment terminal modal feature data, while call and SMS records will be classified as communication terminal modal feature data.

[0061] For each type of modal feature data, the statistical mean, variance, and fluctuation coefficient are calculated based on a sliding time window to complete the intramodal stability assessment and output the corresponding single-modal behavior pattern.

[0062] A single-modal behavioral pattern refers to the representation of typical characteristic patterns or behavioral trends exhibited by each modal feature data. To extract typical characteristic patterns for each type of modal data, a sliding time window approach is used for statistical analysis of each type of modal feature data. A sliding time window divides the modal feature data into several overlapping time windows to facilitate statistical calculations within local time intervals. For example, assuming the selected sliding window length is one day with an hourly interval, the continuous modal feature data is divided into multiple data windows that slide forward one hour at a time, each with a length of one day. For the modal feature data within each sliding time window, comparisons are performed. The absolute value of the difference between the mean of each sliding window's output and the overall mean of the means of all sliding windows is calculated. The absolute value of the difference between the variance of each sliding window's output and the overall mean of the variances of all sliding windows is also calculated, as is the absolute value of the difference between the fluctuation coefficient of each sliding window's output and the overall mean of the fluctuation coefficients of all sliding windows. The absolute values ​​of the differences corresponding to each sliding window are summed to obtain the total stability difference value for each sliding window. Then, the total stability difference values ​​of each sliding window are sorted by size, and several windows with total stability difference values ​​lower than a predetermined stability difference threshold are selected. The feature combination consisting of the mean, variance, and volatility coefficient corresponding to the above windows is defined as the typical statistical feature combination. Finally, the typical statistical feature combination is determined as the single-modal behavior pattern, thereby realizing the intramodal stability assessment.

[0063] For any two types of modal feature data, calculate the time synchronization cosine similarity and spatial feature difference, compare the synchronization consistency of the multimodal behavioral feature dataset with the spatial difference of the feature vectors, complete the intermodal consistency assessment, and output the intermodal difference conflict features.

[0064] Intermodal discrepancy conflict features refer to the differences or conflicts that exist between feature data from different modalities, increasing the difficulty of modality fusion. To effectively discover and extract intermodal conflict features, it is necessary to analyze the feature data of any two modalities: for any two modal feature data, such as social platform modal feature data and payment terminal modal feature data, time synchronization cosine similarity calculation is performed separately. The time synchronization cosine similarity calculation method is as follows: the data at corresponding time points of the two modal feature data are formed into two time series, the products of the feature data at each corresponding time point are summed, and then divided by the product of the square roots of the sums of the products of the two time series themselves, resulting in a value between zero and one. The closer to one, the more synchronized and consistent the behavioral characteristics of the two modalities are within the time period. The spatial feature difference calculation method is as follows: within the same time window, the sum of the absolute values ​​of the differences between the feature vectors of the modal data is calculated, and then divided by the number of elements in all feature vectors. The larger the value, the greater the degree of difference between the feature vectors of the two modalities. Finally, the cosine similarity result and spatial feature difference result calculated in each time period are compared with the pre-set threshold. If the cosine similarity in the time period is less than the cosine similarity threshold and the spatial feature difference in the same time period is greater than the spatial feature difference threshold, it is determined that there is a difference conflict between the two types of modal feature data in the time period, and the modal feature data in the time period is marked as inter-modal difference conflict feature.

[0065] S3: Based on unimodal behavioral patterns, perform trustworthy behavioral pattern modeling, and output trustworthy feature representations for each modality, including:

[0066] For single-modal behavior patterns in social platform modal feature data, a historical behavior trajectory clustering method is used to construct a credible behavior pattern feature space for social platform modalities, and output a credible feature representation of social platform modalities.

[0067] The typical statistical feature combination obtained from the single-modal behavioral patterns of social platform modal feature data through sliding time window statistical analysis includes combinations of mean, variance, and volatility coefficients within multiple continuous time windows, reflecting the behavioral patterns and trends exhibited by target users at the data collection points on the social platform. The historical behavior trajectory clustering method is as follows: The single-modal behavioral patterns of the social platform modal feature data are arranged in a uniform chronological order, and each behavioral pattern is considered a feature data point, with each feature data point including mean, variance, and volatility coefficient. Spatial distance is calculated between all feature data points, for example, by summing the squares of the differences in mean, variance, and volatility coefficients between feature data points and then taking the square root as the spatial distance, representing the similarity between feature data points. Initial clustering is performed based on the spatial distance between all feature data points. For example, a distance threshold is set; when the spatial distance between two feature data points is less than the threshold, they are grouped into the same category; otherwise, they are grouped separately. The process involves: classifying the data points in each initial category; analyzing the feature data points within each initial category; calculating the sum of spatial distances among all feature data points within the initial category; and then determining the category with the smallest sum of spatial distances as the trusted behavior pattern category. The data set formed by all feature data points within the trusted behavior pattern category is then defined as the trusted behavior pattern feature space of the social platform modality. For example, if a target user frequently likes or follows specific types of accounts on a social platform, the distances between the data feature points corresponding to these behavior patterns are relatively small, and they can be clustered into the same trusted pattern category. Finally, a weighted average is calculated based on the feature values ​​of the feature data points in the trusted behavior pattern category, and the trusted feature representation of the social platform modality is output in the form of cluster centers.

[0068] For the single-modal behavior pattern of payment terminal modal feature data, the transaction feature frequency statistics method is used to construct the credible behavior pattern feature space of payment terminal modality and output the credible feature representation of payment terminal modality;

[0069] The single-modal behavior pattern of payment terminal modal feature data is a combination of typical statistical features obtained through sliding time window statistical analysis, which includes the combination of mean, variance and fluctuation coefficient within multiple sliding windows, reflecting the payment behavior pattern of the target user on the payment terminal. The transaction feature frequency statistics method is as follows: Feature data involved in the single-modal behavior pattern of payment terminal modality feature data are categorized according to different characteristics of payment behavior. Payment behavior features include, for example, transaction amount range, transaction time interval, merchant type, and transaction location. The frequency of each transaction feature in all feature data points within the single-modal behavior pattern is statistically calculated, and the calculated frequency is divided by the sum of all transaction frequencies to obtain the frequency of occurrence of the transaction feature. All transaction feature frequencies are arranged in ascending order, and several transaction features with frequencies exceeding a pre-set frequency threshold are selected to form the credible behavior pattern feature space of the payment terminal modality. For example, if a target user makes more high-amount transactions at a specific type of merchant than at other merchant types, this feature is included in the credible behavior pattern feature space. Finally, the frequencies of each transaction feature within the credible behavior pattern feature space of the payment terminal modality are weighted and combined to obtain a weighted combination vector of the overall features, outputting the credible feature representation of the payment terminal modality.

[0070] For the single-modal behavior pattern of communication terminal modal feature data, the communication relationship network feature extraction method is used to construct the reliable behavior pattern feature space of communication terminal modality and output the reliable feature representation of communication terminal modality;

[0071] The single-modal behavior pattern of communication terminal modal feature data is a combination of typical statistical features obtained through sliding time window statistical analysis, including typical communication behavior statistical features such as communication frequency, communication duration, and call interval. The communication relationship network feature extraction method is as follows: Based on the single-modal behavior pattern of the communication terminal modal feature data, a communication relationship network is constructed. Each node in the communication relationship network represents a communication object of the target user, and the connections between nodes represent the mutual communication relationships between communication objects. Network features in the communication relationship network are statistically analyzed, such as the degree centrality of nodes. The degree centrality of a node is the number of other nodes a node connects to divided by the total number of nodes in the communication relationship network, indicating the importance of the communication object in the network. Simultaneously, the node clustering coefficient in the communication relationship network is calculated. The node clustering coefficient is calculated by dividing the actual number of connections between adjacent nodes by the theoretical maximum number of connections, indicating the density of the communication object group. Finally, the path length between nodes is calculated. The path length is the minimum number of connections required between nodes; a shorter path length indicates a higher degree of clustering. The closer the communication relationship between nodes, the more accurate the calculation of network features. The degree centrality, node clustering coefficient, and path length between nodes of all nodes in the communication relationship network are statistically analyzed. The average value of each network feature across all nodes in the communication relationship network, as well as the variance of each network feature across all nodes, are calculated. The average value of each network feature is compared with a predetermined average value threshold, and network features exceeding the average value threshold are identified. The variance of network features exceeding the average value threshold is then compared with a predetermined variance threshold, and network features with variances below the variance threshold are selected. The network features obtained through these two selections are combined to form a reliable behavior pattern feature space for the communication terminal modality. Finally, the network feature values ​​in the reliable behavior pattern feature space are normalized and output as feature vectors to form a reliable feature representation of the communication terminal modality.

[0072] S4: Based on the intermodal difference conflict characteristics, identify potential modal conflict interference regions and calculate the modal influence weights of potential modal conflict regions, including:

[0073] Based on the intermodal difference conflict characteristics, the spatial distribution area of ​​the intermodal difference conflict characteristics is identified as the potential modal conflict interference area;

[0074] Intermodal discrepancy conflict features are a type of feature data that cannot be fully integrated within the same time period due to their performance. Spatial distribution region refers to the feature dimension range and feature value interval of intermodal discrepancy conflict features in the entire multimodal behavioral feature dataset. To determine potential modal conflict interference regions, data marked as intermodal discrepancy conflict features in social platform modal feature data, payment terminal modal feature data, and communication terminal modal feature data are divided into feature dimensions. For example, feature dimensions selected in social platform modal feature data include the number of comments, the number of likes, and the number of followed account types; feature dimensions selected in payment terminal modal feature data include payment frequency, payment amount range, and payment location distribution; and feature dimensions selected in communication terminal modal feature data include call frequency, call duration, and number of SMS messages sent. Feature data that are simultaneously labeled as intermodal conflict features within different modal feature dimensions are analyzed for feature value distribution. The spatial distribution range is calculated by determining the interval between the maximum and minimum values ​​occupied by the intermodal conflict features in each feature dimension. Finally, the spatial distribution ranges of all feature dimensions are combined to form a spatial distribution region, which is defined as the potential modal conflict interference region. For example, when the number of comments of a target user in the social platform feature dimension, the payment frequency in the payment terminal feature dimension, and the call frequency in the communication terminal feature dimension all have conflict features, the spatial region formed by the ranges of the conflict features in these three dimensions is regarded as the potential modal conflict interference region.

[0075] The feature difference degree based on variance contribution is calculated for the modal feature data of social platforms, payment terminals and communication terminals in the potential modal conflict interference area to obtain the feature difference degree of each modality in the potential modal conflict interference area;

[0076] To accurately measure the degree of difference among modal feature data within a potential modal conflict interference region, a variance contribution-based method is used to calculate feature difference. The variance of each modal feature data within the potential modal conflict interference region is calculated for each feature dimension. The variance of each modality's feature dimension is compared with the sum of the variances of all modalities in their respective feature dimensions to calculate the variance contribution. This is achieved by dividing the variance of a single modal feature data point in its feature dimension by the sum of the variances of all modal feature data in their respective feature dimensions, yielding the variance contribution ratio of that modal feature data in its feature dimension. The variance contribution ratios for all feature dimensions of each modality are then summed, and the summation result is defined as the feature difference degree of each modality within the potential modal conflict interference region. Through this calculation process, a feature difference degree is obtained for social platform modal feature data, payment terminal modal feature data, and communication terminal modal feature data to measure the difference performance of each modal feature data within the potential modal conflict interference region.

[0077] The feature difference degree of each mode in the potential modal conflict interference region is standardized and converted into modal influence weights;

[0078] Since the calculated feature dissimilarity scores of different modalities within the potential modal conflict interference region may differ by orders of magnitude, standardization is required to eliminate the scaling effect between feature dissimilarity scores. The standardization method is as follows: Determine the maximum and minimum values ​​of feature dissimilarity scores for all modalities. Then, perform linear scaling on the feature dissimilarity score of each modality. This involves subtracting the minimum value from the feature dissimilarity score of each modality, and then dividing by the difference between the maximum and minimum values. The resulting standardized value is between zero and one, reflecting the degree of feature dissimilarity of each modality relative to other modalities. The standardized values ​​are then converted into modal influence weights. This conversion is done by dividing the standardized value of each modality by the sum of the standardized values ​​of all modalities. The modal influence weight represents the importance of each modal feature data within the potential modal conflict interference region; a larger modal influence weight indicates a greater impact of the modal feature data on the overall modal dissimilarity conflict.

[0079] Each mode within the potential modal conflict interference region is assigned a corresponding modal influence weight;

[0080] After completing the above calculations, each modality has a modal influence weight. The data set of each modality within the potential modal conflict interference region is then assigned the corresponding calculated modal influence weight. For example, if the modal influence weight calculated for social platform modal feature data is higher, the analysis weight or processing priority of social platform modal feature data will be increased accordingly; if the modal influence weight for communication terminal modal feature data is lower, the analysis weight or processing priority of communication terminal modal feature data will be decreased accordingly. Through these steps, the weight of each modal feature data within the potential modal conflict interference region is determined.

[0081] S5: Based on the reliable feature representation and modal influence weights, perform modal weighted fusion and conflict suppression to generate a conflict-suppressed multimodal fusion behavioral feature vector, including:

[0082] The credible feature representations of social platform modality, payment terminal modality, and communication terminal modality are respectively subjected to element-wise operations with the corresponding modality influence weights to obtain weighted modal feature representations;

[0083] The credible feature representations of social platform modalities, payment terminal modalities, and communication terminal modalities are presented as feature vectors, each representing a typical credible behavior pattern of the data from a different modality. Modal influence weights represent the importance of each modal feature data within a potential modal conflict interference region. To obtain a weighted modal feature representation, each feature dimension of the credible feature representation of the social platform modal is multiplied by its modal influence weight, resulting in a weighted credible feature representation for the social platform modal. Similarly, each feature dimension of the credible feature representation of the payment terminal modal is multiplied by its modal influence weight, resulting in a weighted credible feature representation for the payment terminal modal. The same process of multiplying each feature dimension individually is called element-wise multiplication, which involves one-to-one multiplication along corresponding dimensions. For example, the credible feature representation of a social media platform modality includes three dimensions: the number of likes, the number of comments, and the number of followers. Each dimension's feature is multiplied by the modality influence weight of the social media platform modality to obtain a weighted credible feature representation of the social media platform modality. Through the above method, each modality feature representation is transformed into a new feature vector after element-wise operations. This new feature vector is the weighted modality feature representation, used to represent the feature performance of each modality feature data after weight adjustment.

[0084] The weighted modal feature representations are subjected to conflict suppression processing, and vector-level concatenation and merging are performed according to a preset concatenation order to obtain the initial multimodal fusion behavioral feature vector;

[0085] To reduce the impact of intermodal conflicts on the fusion results, conflict suppression processing is required. This processing involves: performing intermodal comparisons on the weighted features of each modality's feature dimensions; calculating the absolute value of the difference between the weighted features of each modality on the same feature dimension; and then comparing this absolute value with a pre-set conflict threshold. If the calculated absolute value of the difference between the intermodal feature dimensions exceeds the pre-set conflict threshold, the conflicting dimensions are reduced, for example, by subtracting the absolute value of the intermodal difference from the corresponding feature, thereby reducing the impact of dimensional differences on the fusion results and achieving conflict suppression. For instance, if the absolute value of the difference between the number of likes and the payment frequency dimension in the social platform modality and the payment terminal modality exceeds the pre-set conflict threshold, the corresponding difference in the corresponding dimension in the social platform modality and the payment terminal modality is subtracted to reduce the degree of intermodal conflict. After conflict suppression processing, feature representations with low conflict levels for each modality are obtained. The conflict-suppressed weighted feature representations of the social platform modality, payment terminal modality, and communication terminal modality are then sequentially concatenated and merged at the vector level according to a preset concatenation order. The vector-level concatenation and merging method involves arranging all feature dimensions from the weighted feature representation of the social platform modality at the beginning, then arranging all feature dimensions from the weighted feature representation of the payment terminal modality, and finally arranging all feature dimension values ​​from the weighted feature representation of the communication terminal modality at the end. These three modality feature representations are arranged sequentially to form a single long vector, which is called the initial multimodal fusion behavioral feature vector.

[0086] The initial multimodal fusion behavior feature vector is normalized and its feature dimension is compressed to output the conflict-suppressed multimodal fusion behavior feature vector.

[0087] In the initial multimodal fusion behavior feature vector, the ranges of each feature dimension may differ, thus requiring normalization. Normalization involves subtracting the minimum value of the corresponding feature dimension from each feature dimension in the initial multimodal fusion behavior feature vector, then dividing by the difference between the maximum and minimum values ​​of the feature dimension, and performing linear scaling to unify the range of all feature dimensions to the interval between zero and one, eliminating scale differences. For example, the value of the "likes" dimension, after normalization, will be uniformly within the range of zero to one. After normalization, the initial multimodal fusion behavior feature vector has a large number of dimensions, and there may be redundancy and correlation between dimensions. Therefore, feature dimension compression is needed to improve the efficiency of data analysis. The feature dimension compression method is as follows: The correlation coefficient between each feature dimension is calculated. The covariance between any two feature dimensions is calculated and then divided by the product of their standard deviations to obtain the correlation coefficient. A correlation coefficient threshold is then set, and feature dimensions with correlation coefficients higher than the threshold are merged, for example, by taking the mean of two dimensions and merging them into a single dimension. Through this process, the number of feature dimensions is reduced, and redundancy between them is decreased, resulting in a multimodal fusion behavior feature vector with a moderate number of dimensions and high independence of each dimension. The feature vector after normalization and feature dimension compression is called the conflict-suppressed multimodal fusion behavior feature vector.

[0088] S6: Input the conflict-suppressed multimodal fused behavioral feature vector into the anti-fraud risk identification model, and output the fraud risk level judgment result of the target user behavior, including:

[0089] The multimodal fusion behavioral feature vector is input into the anti-fraud risk identification model, which consists of a feature normalization layer, a fully connected classification layer, and a risk threshold determination layer in sequence.

[0090] The multimodal fusion behavioral feature vector is obtained by modal weighted fusion and conflict suppression of three modal feature representations: social platform modality, payment terminal modality, and communication terminal modality. The anti-fraud risk identification model is an intelligent classification model with a specific hierarchical structure, consisting of three structural layers: feature normalization layer, fully connected classification layer, and risk threshold determination layer. The multimodal fusion behavioral feature vector is passed forward layer by layer in the order of feature normalization layer, fully connected classification layer, and risk threshold determination layer.

[0091] The feature normalization layer performs zero-mean normalization and unit variance scaling on the feature vectors of multimodal fusion behavior;

[0092] The function of the feature normalization layer is to normalize the various feature dimensions in the input multimodal fusion behavioral feature vector, thereby eliminating the influence of different scales between features and improving the stability of classification. Zero-mean normalization refers to the calculation of each feature dimension. First, the average of all sample data in the feature dimension is calculated to obtain a new feature dimension with zero as the mean. Then, unit variance scaling is performed. The variance of each feature dimension is calculated by subtracting the mean from the average, and the square root of the variance is taken to obtain the standard deviation. Each feature dimension is then divided by the standard deviation to obtain the feature value with unit variance. For example, for a feature dimension such as the transaction amount of a payment terminal, the average of all transaction amount data is calculated, and then the average is subtracted from all transaction amount data. The variance and standard deviation of the data after subtracting the average are then calculated. Each transaction amount data is divided by the standard deviation to obtain the transaction amount data with zero mean and unit variance scaling. Through the above calculations, the multimodal fusion behavioral feature vector completes the processing of the feature normalization layer. The scale of the feature data is unified to a standardized form with zero as the mean and unit variance as the benchmark, ensuring that the scale is consistent when the features are input to the next classification layer and avoiding the impact of scale inconsistency on the classification results.

[0093] The fully connected classification layer obtains weight parameters based on historical labeled data, and performs matrix multiplication and bias addition operations on the multimodal fusion behavioral feature vector after the feature normalization layer is processed, and outputs a fraud risk probability vector.

[0094] The fully connected classification layer is a machine learning-based feature classification layer trained using historical labeled data. This historical labeled data refers to pre-collected multimodal fusion behavioral feature vectors of target users with known fraud risk levels. The historical labeled data records the feature vectors and their corresponding determined risk levels. The classification layer learns stable weight parameters based on this historical labeled data through a backpropagation algorithm. The training method is as follows: First, the feature vectors from the historical labeled data are input into the fully connected classification layer. A preliminary fraud risk probability is calculated using matrix multiplication and bias addition. The error between the preliminary fraud risk probability and the actual risk level corresponding to the historical labeled data is calculated; the error is the difference between the preliminary fraud risk probability and the actual risk level. The weight parameters in the matrix are adjusted using backpropagation to minimize the error, and this adjustment is continued until the error reaches a set range. After training of the fully connected classification layer, stable weight parameters are obtained. The multimodal fusion behavior feature vector processed by the feature normalization layer is input into the fully connected classification layer for matrix multiplication and bias addition. The matrix multiplication method is to multiply each feature dimension in the multimodal fusion behavior feature vector with each row of the weight matrix of the fully connected classification layer, and then sum the results of each multiplication to obtain the initial probability. Then, a preset bias value is added to each initial probability to complete the bias addition operation. For example, for a certain feature dimension, the feature value of the multimodal fusion behavior feature vector is multiplied with the classification layer weight parameters, and then the bias parameter is added to obtain the fraud risk probability corresponding to the feature dimension. The above calculation is performed on all feature dimensions to finally form a fraud risk probability vector, which reflects the probability of the target user corresponding to each fraud risk level.

[0095] The risk threshold determination layer compares the fraud risk probability vector with a preset set of risk level thresholds and maps the fraud risk probability vector to the fraud risk level determination result of the target user's behavior.

[0096] The risk threshold determination layer, as the final layer of the anti-fraud risk identification model, transforms the fraud risk probability vector output by the fully connected classification layer into a risk level determination result. The fraud risk probability vector contains probabilities corresponding to multiple risk levels, each probability representing the likelihood that a target user's behavior belongs to a specific risk level. The preset risk level threshold set is a series of risk level determination criteria pre-defined based on historical data and expert experience, with each risk level corresponding to a specific probability threshold. The risk threshold determination layer compares each probability of the fraud risk probability vector with the preset risk level threshold set to determine whether the probability exceeds the threshold standard for the corresponding risk level. If the probability is higher than the probability threshold, then... The target user's behavior is determined by a corresponding risk level. For example, if the probability of a high-risk level in the fraud risk probability vector exceeds a preset high-risk threshold, the target user's behavior is determined to be high-risk, indicating that the user has a high risk of being scammed. If the probability of a medium-risk level exceeds the medium-risk threshold and the probability of a high-risk level does not exceed the high-risk threshold, the target user's behavior is determined to be medium-risk. If the probabilities of all risk levels do not exceed their respective probability thresholds, the target user's behavior is determined to be low-risk. Through the above comparisons and mappings, the risk threshold determination layer transforms the fraud risk probability vector into a fraud risk level determination result, and finally outputs the determined risk level so that targeted preventive measures can be taken.

[0097] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0098] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0099] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0100] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0101] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0102] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0103] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0104] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0105] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A big data anti-fraud method based on multimodal behavioral characteristics, characterized in that, Includes the following steps: S1: Obtain the raw behavioral data of the target user at multiple data collection points, and perform temporal alignment and modal label encoding on the raw behavioral data to generate a multimodal behavioral feature dataset in a unified format; S2: Evaluate intramodal stability and intermodal consistency of the multimodal behavioral feature dataset, and extract single-modal behavioral patterns and intermodal discrepancy conflict features respectively; S3: Model trusted behavior patterns based on single-modal behavior patterns and output trusted feature representations for each modality; S4: Based on the intermodal difference conflict characteristics, identify potential modal conflict interference regions and calculate the modal influence weights of potential modal conflict regions, specifically: Based on the intermodal difference conflict characteristics, the spatial distribution area of ​​the intermodal difference conflict characteristics is identified as the potential modal conflict interference area; The feature difference degree based on variance contribution is calculated for the modal feature data of social platforms, payment terminals and communication terminals in the potential modal conflict interference area to obtain the feature difference degree of each modality in the potential modal conflict interference area; The feature difference degree of each mode in the potential modal conflict interference region is standardized and converted into modal influence weights; Each mode within the potential modal conflict interference region is assigned a corresponding modal influence weight; S5: Based on the credible feature representation and modal influence weights, perform modal weighted fusion and conflict suppression to generate a conflict-suppressed multimodal fusion behavior feature vector; S6: Input the conflict-suppressed multimodal fusion behavioral feature vector into the anti-fraud risk identification model, and output the fraud risk level judgment result of the target user behavior.

2. The big data anti-fraud method based on multimodal behavioral characteristics according to claim 1, characterized in that, S1, specifically: Collect raw behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals; The original behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals are unified with timestamps and synchronized with time bases. Modal category label encoding is performed on the original behavioral data of target users at data collection points on social platforms, payment terminals, and communication terminals after the timestamps are unified and synchronized with the time base, to generate a multimodal behavioral feature dataset in a unified format.

3. The big data anti-fraud method based on multimodal behavioral characteristics according to claim 2, characterized in that, S2, specifically: The multimodal behavioral feature dataset is divided into social platform modal feature data, payment terminal modal feature data, and communication terminal modal feature data according to modal category; For each type of modal feature data, the statistical mean, variance, and fluctuation coefficient are calculated based on a sliding time window to complete the intramodal stability assessment and output the corresponding single-modal behavior pattern. For any two types of modal feature data, calculate the time synchronization cosine similarity and spatial feature difference, compare the synchronization consistency of the multimodal behavioral feature dataset with the spatial difference of the feature vectors, complete the intermodal consistency assessment, and output the intermodal difference conflict features.

4. The big data anti-fraud method based on multimodal behavioral characteristics according to claim 3, characterized in that, S3, specifically: For single-modal behavior patterns in social platform modal feature data, a historical behavior trajectory clustering method is used to construct a credible behavior pattern feature space for social platform modalities, and output a credible feature representation of social platform modalities. For the single-modal behavior pattern of payment terminal modal feature data, the transaction feature frequency statistics method is used to construct the credible behavior pattern feature space of payment terminal modality and output the credible feature representation of payment terminal modality; For single-modal behavior patterns of communication terminal modal feature data, a reliable behavior pattern feature space of communication terminal modality is constructed using the communication relationship network feature extraction method, and a reliable feature representation of communication terminal modality is output.

5. The big data anti-fraud method based on multimodal behavioral characteristics according to claim 4, characterized in that, S5, specifically: The credible feature representations of social platform modality, payment terminal modality, and communication terminal modality are respectively subjected to element-wise operations with the corresponding modality influence weights to obtain weighted modal feature representations; The weighted modal feature representations are subjected to conflict suppression processing, and vector-level concatenation and merging are performed according to a preset concatenation order to obtain the initial multimodal fusion behavioral feature vector; The initial multimodal fusion behavior feature vector is normalized and its feature dimension is compressed to output the conflict-suppressed multimodal fusion behavior feature vector.

6. The big data anti-fraud method based on multimodal behavioral characteristics according to claim 5, characterized in that, S6, specifically: The multimodal fusion behavioral feature vector is input into the anti-fraud risk identification model, which consists of a feature normalization layer, a fully connected classification layer, and a risk threshold determination layer in sequence. The feature normalization layer performs zero-mean normalization and unit variance scaling on the feature vectors of multimodal fusion behavior; The fully connected classification layer obtains weight parameters based on historical labeled data, and performs matrix multiplication and bias addition operations on the multimodal fusion behavioral feature vector after the feature normalization layer is processed, and outputs a fraud risk probability vector. The risk threshold determination layer compares the fraud risk probability vector with a preset set of risk level thresholds and maps the fraud risk probability vector to the fraud risk level determination result of the target user's behavior.

Images