Transaction risk detection method and device, and storage medium

Abstract

The invention discloses a transaction risk detection method and device and a storage medium, and belongs to the technical field of data processing. The method comprises the steps of obtaining at least two target data items in to-be-detected transaction data, obtaining analysis models corresponding to the target data items in a preset multi-dimensional analysis model group, performing feature analysis on the target data items through the analysis models to obtain target feature information, and fusing the target feature information corresponding to the at least two target data items to obtain the transaction data to be detected. And generating a transaction risk score of the to-be-detected transaction data, and triggering a grading response strategy according to the transaction risk score. According to the method, the associated feature information of the weak signal is extracted and enhanced through different dimensions, and the comprehensive score is generated by fusing the feature information, so that the one-sidedness of single-dimension analysis is avoided, and the recognition capability of a complex abnormal mode is effectively improved.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a method, device and storage medium for risk detection of transactions. Background Technology

[0002] In related technologies, transaction risk detection methods typically rely on a pre-set rule base or risk model to conduct risk assessments on key data items in transaction data, and based on the results of single-point analysis, to arrive at risk identification judgments and trigger corresponding response measures.

[0003] However, because the relevant technologies only focus on a single data item and its independent characteristics, they lack the ability to fuse and analyze the correlated features of multiple dimensions of data in a transaction. In this case, risk identification is not accurate enough in identifying abnormal transaction information using combinations of weak multi-dimensional signals, which can easily lead to missed or false positives.

[0004] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a risk detection method, device and storage medium for transactions, which aims to solve the technical problem that risk identification is not accurate enough for abnormal transaction information using multi-dimensional weak signal combinations, which is prone to missed judgment and misjudgment.

[0006] To achieve the above objectives, this application provides a risk detection method for transactions, the method comprising the following steps:

[0007] Obtain at least two target data items from the transaction data to be detected;

[0008] In a pre-defined multidimensional analysis model group, the analysis model corresponding to the target data item is obtained, and the target data item is subjected to feature analysis through the analysis model to obtain target feature information;

[0009] By integrating target feature information corresponding to at least two of the target data items, a transaction risk score for the transaction data to be detected is generated.

[0010] Based on the transaction risk score, a tiered response strategy is triggered.

[0011] In one embodiment, the step of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information includes:

[0012] Obtain the transfer remarks text from the target data item;

[0013] The transfer note text is segmented using the text analysis model in the multi-dimensional analysis model group to obtain text segmentation.

[0014] Extract the semantic feature vectors of the text segmentation;

[0015] Text risk features are generated based on the mapping position of the feature vector in the preset classification space.

[0016] In one embodiment, the step of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information includes:

[0017] Based on the transfer date, the historical transfer data in the transaction data to be detected is aggregated to generate a transfer time series;

[0018] By using a time series analysis model, the deviation information of the historical transfer data within a preset time window of the transfer time series is calculated to form transfer frequency change information;

[0019] Identify abnormal fluctuation characteristics in the transfer frequency change information, and generate time period confidence based on the abnormal fluctuation characteristics.

[0020] In one embodiment, the step of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information includes:

[0021] Based on the account information, deposit certificate information and device fingerprint information in the target data item, construct account nodes, deposit certificate nodes and device fingerprint nodes;

[0022] Based on the account holding relationships of the transaction data to be detected, a holding edge is established between the account node and the deposit node; and based on the operation device association of the transaction data to be detected, an operation edge is established between the account node and the device fingerprint node, thus forming an account relationship graph.

[0023] The closed-loop paths in the account relationship graph are identified using a graph neural network.

[0024] In one embodiment, the step of performing feature analysis on the target data item using the analysis model to obtain target feature information includes:

[0025] Obtain the historical interest rate data corresponding to the historical transfer data;

[0026] By using a long short-term memory network model, the historical interest rate data is fitted based on the transfer time of the historical transfer data to generate an interest rate curve model;

[0027] Determine the target transaction time corresponding to the transaction data to be detected;

[0028] In the interest rate curve model, the target interest rate corresponding to the target transaction time is obtained, and the interest rate prediction range corresponding to the target interest rate is generated;

[0029] Calculate the deviation between the actual transaction interest rate of the transaction data to be detected and the interest rate prediction range, and generate an interest rate deviation feature based on the deviation.

[0030] In one embodiment, the step of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information further includes:

[0031] Textual risk features were extracted from the transfer remarks text using a text analysis model.

[0032] And / or, through time series analysis models, identify abnormal periods in the transfer time series and generate period confidence scores;

[0033] Establish a relationship graph containing device fingerprint nodes, and adjust the graph weights of the relationship graph according to the text risk characteristics and / or the time period confidence level to obtain an account relationship graph;

[0034] The closed-loop transaction characteristics in the account relationship graph are identified using a graph neural network.

[0035] In one embodiment, after the step of establishing a relationship graph including device fingerprint nodes and adjusting the graph weights of the relationship graph according to the text risk features and / or the time period confidence to obtain an account relationship graph, the method further includes:

[0036] Based on the recognition results of the account relationship graph by the graph neural network, an account risk score is obtained;

[0037] Adjust the deviation coefficient based on the account risk score;

[0038] Obtain the interest rate difference between the actual transaction interest rate and the upper limit of the interest rate prediction range, and obtain the interest rate deviation characteristic by multiplying the interest rate difference by the deviation coefficient.

[0039] In one embodiment, the step of fusing target feature information corresponding to at least two of the target data items and scoring the fused target feature information to obtain a transaction risk score includes:

[0040] The target feature information is normalized to obtain the corresponding individual risk score;

[0041] Obtain the preset weight coefficient of the target data item;

[0042] Based on the preset weighting coefficients, the individual risk scores are weighted and summed to obtain the transaction risk score.

[0043] In addition, to achieve the above objectives, this application also provides a transaction risk detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the transaction risk detection method as described above.

[0044] In addition, to achieve the above objectives, this application also provides a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the transaction risk detection method described above.

[0045] One or more technical solutions proposed in this application have at least the following technical effects:

[0046] This application acquires at least two target data items from the transaction data to be detected, obtains the corresponding analysis models for these target data items from a pre-set multi-dimensional analysis model group, and performs feature analysis to obtain target feature information. Then, it fuses the at least two target feature information to generate a transaction risk score, and triggers a tiered response strategy based on this score. This approach extracts and strengthens the correlation feature information of weak signals from different dimensions, and then generates a comprehensive score by fusing these feature information. This avoids the one-sidedness of single-dimensional analysis, thereby effectively improving the ability to identify complex anomaly patterns. Simultaneously, the triggering mechanism of the tiered response strategy ensures the refinement of risk response, further reducing the occurrence of missed and false positives. Attached Figure Description

[0047] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart illustrating the first embodiment of the risk detection method for transactions described in this application.

[0050] Figure 2This is a flowchart illustrating the second embodiment of the risk detection method for transactions in this application.

[0051] Figure 3 This is a flowchart illustrating the third embodiment of the risk detection method for transactions in this application.

[0052] Figure 4 This is a schematic diagram of the structure of a transaction risk detection device in the hardware operating environment involved in the embodiments of this application.

[0053] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0054] It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit this application.

[0055] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0056] The main solution of this application embodiment is: to obtain at least two target data items in the transaction data to be detected; to obtain the analysis model corresponding to the target data item in a preset multidimensional analysis model group, and to perform feature analysis on the target data item through the analysis model to obtain target feature information; to fuse the target feature information corresponding to at least two target data items to generate a transaction risk score for the transaction data to be detected; and to trigger a graded response strategy based on the transaction risk score.

[0057] Existing technologies assess risk based on key data items in transaction data, and derive risk identification judgments and trigger corresponding response measures based on the results of single-point analysis. However, focusing only on a single data item and its independent characteristics lacks the ability to fuse and analyze the correlated characteristics of multiple dimensions of data in a transaction. In this case, risk identification is insufficiently accurate in recognizing abnormal transaction information using combinations of weak signals from multiple dimensions, easily leading to missed detections and false positives.

[0058] This application acquires at least two target data items from the transaction data to be detected, obtains the corresponding analysis models for these target data items from a pre-set multi-dimensional analysis model group, and performs feature analysis to obtain target feature information. Then, it fuses the at least two target feature information to generate a transaction risk score, and triggers a tiered response strategy based on this score. This approach extracts and strengthens the correlation feature information of weak signals from different dimensions, and then generates a comprehensive score by fusing these feature information. This avoids the one-sidedness of single-dimensional analysis, thereby effectively improving the ability to identify complex anomaly patterns. Simultaneously, the triggering mechanism of the tiered response strategy ensures the refinement of risk response, further reducing the occurrence of missed and false positives.

[0059] To better understand the above technical solutions, exemplary embodiments of this application will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of this application are shown in the drawings, it should be understood that this application can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of this application and to fully convey the scope of this application to those skilled in the art.

[0060] It should be noted that the executing entity in this embodiment can be a transaction management system, or a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or transaction risk detection device capable of the above functions. This embodiment does not specifically limit the specific implementation. The following uses a transaction management system as an example to describe this embodiment and the following embodiments.

[0061] Based on this, embodiments of this application provide a method for detecting transaction risks, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the risk detection method for transactions in this application.

[0062] In this embodiment, the risk detection method for the transaction includes steps S10 to S40:

[0063] Step S10: Obtain at least two target data items from the transaction data to be detected;

[0064] In this embodiment, the transaction management system, through its connection with the transaction database, periodically or in real-time extracts transaction records to be detected from the database. Then, based on preset rules and requirements, the transaction management system filters out target data items from the transaction records. The transaction data to be detected refers to transaction records that require risk assessment in large-denomination certificate of deposit transfer scenarios.

[0065] It should be noted that various arbitrage schemes exist in the existing transfer process of large-denomination certificates of deposit (NCDs), making it difficult for financial institutions to detect and take timely measures, resulting in economic losses and credit risks. Therefore, to ensure the accuracy of the identification results, the transaction management system must extract at least two target data items from the transaction data to be detected.

[0066] For example, the transaction management system extracts key information such as deposit certificate number, transaction channel, listed interest rate, actual transaction interest rate, holding days, historical transfer count, seller's device fingerprint, and transfer remarks text from the existing abnormal transfer data and normal transfer data.

[0067] Step S20: In the preset multidimensional analysis model group, obtain the analysis model corresponding to the target data item, and perform feature analysis on the target data item through the analysis model to obtain target feature information;

[0068] In this embodiment, the multidimensional analysis model group refers to a series of pre-set analysis models. Different analysis models perform feature analysis on different types of target data items, including text analysis models, time series analysis models, graph neural network models, and long short-term memory network models. Specifically, the text analysis model is used to analyze transfer note text and extract semantic features; the time series analysis model is used to analyze transfer time series and identify abnormal fluctuation characteristics; the graph neural network (GNN) model is used to construct and analyze the fund-account relationship graph and identify closed-loop transactions; and the long short-term memory network (LSTM) model is used to predict reasonable interest rate ranges and identify abnormal premium transactions. The multidimensional analysis model group can analyze data of different target data items based on one or more of these analysis models.

[0069] Specifically, the trading management system matches the corresponding analytical model based on the type of the target data item. Then, the system inputs the target data item into the corresponding analytical model. Optionally, the trading management system's advanced machine learning and deep learning technologies can perform in-depth analysis of different types of data, extracting feature information that reflects trading risk.

[0070] In a first optional implementation, the transaction management system obtains the transfer remarks text from the target data item, and performs word segmentation on the transfer remarks text using a text analysis model in the multi-dimensional analysis model group. For example, natural language processing techniques such as the Bidirectional Encoder Representation from Transformers (BERT) model are used to segment the text into words or phrases to obtain text word segmentation. The semantic feature vectors of the text word segmentation are extracted, and the words are converted into high-dimensional vector representations through an embedding layer. Based on the mapping position of the feature vectors in the preset classification space, text risk features are generated.

[0071] Specifically, the transaction management system can label existing transfer notes text into two categories: normal and abnormal, and divide them into training and validation sets. The pre-trained BERT model can be fine-tuned using the labeled dataset to optimize model parameters and improve its ability to identify abnormal text. Upon receiving transaction data to be tested, the transfer notes text from that data is input into the fine-tuned BERT model to predict whether arbitrage risk exists.

[0072] In the second optional implementation, the transaction management system performs an aggregation operation on the historical transfer data in the transaction data to be detected based on the transfer date, generates a transfer time series, calculates the deviation information of the historical transfer data in the transfer time series within a preset time window through a time series analysis model, forms transfer frequency change information, identifies abnormal fluctuation characteristics in the transfer frequency change information, and generates time period confidence based on the abnormal fluctuation characteristics.

[0073] Specifically, historical data on customer transfer dates is cleaned and preprocessed, and time-aware large language model (Time-LLM) models are used to analyze transfer time series, such as T-BERT (Time-BERT), LSTM, Gated Recurrent Unit (GRU), etc. Special attention is paid to high-frequency transfers in the three days before the end of the quarter and abnormal transactions before the resolution date. Abnormal time periods and transaction frequencies are identified and marked.

[0074] It's worth noting that Time-LLM uses a reprogramming framework to apply a large language model to general time series forecasting while maintaining the integrity of the backbone language model. It reprograms the input time series using text prototypes and then feeds them into a frozen, large language model to align the two patterns.

[0075] In a third optional implementation, the transaction management system constructs account nodes, deposit certificate nodes, and device fingerprint nodes based on account information, deposit certificate information, and device fingerprint information in the target data item. It establishes holding edges between account nodes and deposit certificate nodes based on the account holding relationships of the transaction data to be detected, and establishes operation edges between account nodes and device fingerprint nodes based on the operation device associations of the transaction data to be detected, thus forming an account relationship graph. The transaction management system identifies closed-loop paths in the account relationship graph using a graph neural network (GNN). A closed-loop path is a transaction loop formed by connecting at least three account nodes to the same device node, or a cross-bank transfer transaction exceeding a preset number within a preset time period.

[0076] For example, the transaction management system constructs a graph structure between accounts and transactions based on cleaned data, treating customers as nodes and deposit certificates as another node type. Edges between nodes are defined (e.g., if customer A holds deposit certificate B, an edge can be established from customer A to deposit certificate B). Considering the scenario where a customer operates different accounts through the same device, device fingerprint nodes can be introduced. Based on the device fingerprint associated with a user's deposit certificate buy and sell operations, an edge is established from the customer to the device fingerprint. A graph neural network (GNN) is used to analyze the account relationship graph, identifying closed-loop transactions, particularly transfer transactions where the same device controls ≥3 accounts, and transfer transactions involving ≥5 interbank transfers within 72 hours. Complex relationships between accounts are captured through node embedding and graph convolutional layers.

[0077] It should be noted that during the transaction data detection process, when it is necessary to obtain user-related information, user biometric information, or phone numbers and other private information as the basis for transaction identification, a privacy information acquisition authorization process is also set up. This ensures that users understand, before entering their private information, that the information obtained will be used for transaction risk identification.

[0078] In the fourth optional implementation, the transaction management system obtains historical interest rate data corresponding to historical transfer data, and uses a Long Short-Term Memory (LSTM) network model to fit the historical interest rate data based on the transfer time of the historical transfer data to generate an interest rate curve model. It then determines the target transaction time corresponding to the transaction data to be detected, obtains the target interest rate corresponding to the target transaction time from the interest rate curve model, generates an interest rate prediction interval corresponding to the target interest rate, calculates the deviation between the actual transaction interest rate of the transaction data to be detected and the interest rate prediction interval, and generates an interest rate deviation feature based on the deviation.

[0079] Specifically, interest rate data from historical transfer records is collected, cleaned and standardized, and an LSTM model is constructed to predict a reasonable interest rate range. The model is trained to fit the trend and fluctuation of historical interest rate data, and the actual transaction interest rate of newly emerging transfer transactions is predicted and compared with the predicted reasonable range. Transfer transactions with abnormal premiums are identified and marked as high risk.

[0080] Optionally, when the transaction management system calls the LSTM model and constructs the transfer time series of historical transfer data, it can simultaneously construct the time series information of historical interest rate data based on the mapping relationship between historical transfer data and interest rate data, and generate an interest rate curve model by fitting.

[0081] Optionally, after obtaining the predicted target interest rate, the transaction management system can determine the interest rate prediction range based on a preset value range, or it can determine the prediction range based on interest rate fluctuation information obtained from the current market state information, and then combine this with the target interest rate to generate the interest rate prediction range. This interest rate prediction range can change based on changes in market state information.

[0082] It should be noted that, based on different types of target data items to be analyzed, the trading management system can employ a combination or combination of at least two of the aforementioned analytical models, or other analytical models besides those mentioned above, to perform risk monitoring on the trading data to be detected, thereby improving the accuracy of the detection. For example, the trading management system can simultaneously use text analysis models, time series analysis models, graph neural networks, and interest rate analysis models to perform data processing, obtaining semantic risk characteristics of text information, abnormal fluctuation characteristics of time series information, relationship graphs of entity relationship information, and deviation characteristics of interest rate data.

[0083] Furthermore, the system can be adjusted according to different arbitrage models to adapt to constantly changing market environments and regulatory requirements. The system is highly flexible, capable of adapting to various complex arbitrage models, ensuring good scalability and adaptability. It can handle different types of arbitrage activities, such as buying low and selling high, exploiting rule loopholes, creating false transaction records, and locking in high interest rates. The system dynamically adjusts model parameters to maintain a high recognition rate for different arbitrage models and market environments.

[0084] Step S30: Integrate the target feature information corresponding to at least two of the target data items to generate a transaction risk score for the transaction data to be detected;

[0085] In this embodiment, the transaction management system quantifies the overall risk of the transaction data to be detected through a transaction risk score, which is usually expressed in numerical form. The higher the score, the greater the risk.

[0086] As an optional implementation, the risk management system can use a weighted summation method to calculate the transaction risk score. The risk management system normalizes the target feature information to obtain the corresponding individual risk score, acquires the preset weight coefficients for the target data items, and performs a weighted summation calculation on the individual risk scores based on these preset weight coefficients. The transaction risk score is then obtained from the calculation results.

[0087] Specifically, the risk management system normalizes the target feature information obtained from each analysis model, such as using Min-Max normalization or Z-Score normalization, to ensure that feature values ​​are on the same scale. For example, the text risk feature value of 0.8 and the time period confidence score of 0.7 are normalized to the range of 0-1 to ensure that different feature values ​​are comparable. Further, the system obtains preset weight coefficients and, based on these weight coefficients, performs a weighted summation calculation on the normalized individual risk scores. The weight coefficients are preset by the degree of contribution of each feature information to the risk. Optionally, the system adjusts and optimizes the preliminary risk score by introducing nonlinear transformations or considering the interactions between features to generate the final transaction risk score.

[0088] As another alternative implementation, the risk management system can also map the target feature information of different data items to the same vector space, thereby quantifying different feature information in the same spatial dimension to obtain fused feature information, and calculate the score of the fused feature information in the vector space to obtain a transaction risk score.

[0089] Step S40: Trigger a tiered response strategy based on the transaction risk score.

[0090] In this embodiment, the tiered response strategy refers to taking different levels of response measures based on the magnitude of the transaction risk score. These measures typically include continuous observation for low-risk transactions, further verification for medium-risk transactions, and immediate prevention for high-risk transactions. The transaction risk score is the basis for triggering different response strategies. By setting thresholds for the score, the system can automatically determine the risk level of a transaction and execute corresponding response actions.

[0091] Optionally, the risk management system can map transaction risk scores to corresponding target risk levels according to preset scoring-risk level mapping rules. Specifically, if the target risk level is a first risk level (low risk), continuous monitoring is performed on the transaction data to be monitored; if the target risk level is a second risk level (medium risk), a detailed verification report for the transaction data to be monitored is generated and sent to a preset review terminal; if the target risk level is a third risk level (high risk), a blocking command is sent to the transaction system to prevent the completion of the transaction data to be monitored.

[0092] This application embodiment acquires at least two target data items from the transaction data to be detected, obtains the corresponding analysis models for these target data items from a preset multidimensional analysis model group, and performs feature analysis to obtain target feature information. Then, it fuses the at least two target feature information to generate a transaction risk score, and triggers a tiered response strategy based on this score. This approach extracts and strengthens the correlation feature information of weak signals from different dimensions, and then generates a comprehensive score by fusing these feature information. This avoids the one-sidedness of single-dimensional analysis, thereby effectively improving the ability to identify complex abnormal patterns. Simultaneously, the triggering mechanism of the tiered response strategy ensures the refinement of risk response, further reducing the occurrence of missed and false positives.

[0093] Based on the same inventive concept, this application also provides a second embodiment, referring to... Figure 2 , Figure 2 This is a flowchart illustrating the second embodiment of the risk detection method for transactions in this application.

[0094] In this embodiment, as described in step S20, obtaining the analysis model corresponding to the target data item from the preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information, further includes steps S21 to S24:

[0095] Step S21: Extract textual risk features from the transfer remarks text using a text analysis model;

[0096] Step S22: and / or, through time series analysis model, identify abnormal periods in the transfer time series and generate period confidence scores;

[0097] Step S23: Establish a relationship graph containing device fingerprint nodes, and adjust the graph weights of the relationship graph according to the text risk characteristics and / or the time period confidence level to obtain an account relationship graph.

[0098] In this embodiment, after the transaction management system constructs a preliminary relationship graph based on the device fingerprint nodes, deposit node, account node, and the edge relationships between them, it further adjusts the graph weights of the relationship graph by combining text risk features and / or the time period confidence level to improve the accuracy of the account relationship graph. For example, if the text risk feature value is high or the time period confidence level is low, the system will correspondingly reduce the weight of the relevant edges to obtain the final account relationship graph.

[0099] Optionally, the transaction management system can also use the text risk characteristics and time period confidence as node attributes, and output closed-loop transaction path characteristics and account risk scores through a relationship analysis model.

[0100] For example, the transaction management system adjusts the edge weights in the relationship graph based on text risk characteristics and adds the time period confidence level as a node attribute to the account relationship graph.

[0101] Step S24: Identify closed-loop transaction features in the account relationship graph using a graph neural network.

[0102] In this embodiment, the system inputs the account relationship graph into a graph neural network. The graph neural network embeds nodes through graph convolutional layers, capturing neighborhood information and relationship features between nodes. Then, through the aggregation and update mechanism of the graph neural network, node information is gradually propagated to identify closed-loop paths in the graph.

[0103] This application embodiment uses multi-dimensional data analysis and feature fusion, combined with various technologies such as text analysis, time series analysis, and graph neural networks, to accurately identify and assess transaction risks, and takes corresponding response measures according to the risk level, thereby improving the accuracy and comprehensiveness of risk identification.

[0104] Since the system described in Embodiment 2 of this application is a system used to implement the method of Embodiment 1 of this application, those skilled in the art can understand the specific structure and variations of the system based on the method described in Embodiment 1 of this application, and therefore will not be described again here. All systems used in the method of Embodiment 1 of this application fall within the scope of protection of this application.

[0105] Based on the same inventive concept, this application also provides a third embodiment, referring to... Figure 3 , Figure 3 This is a flowchart illustrating the third embodiment of the risk detection method for transactions in this application.

[0106] In this embodiment, after identifying the closed-loop transaction features in the account relationship graph using a graph neural network as described in step S24, the method further includes steps S25 to S27:

[0107] Step S25: Based on the recognition result of the account relationship graph by the graph neural network, obtain the account risk score;

[0108] Step S26: Adjust the deviation coefficient based on the account risk score;

[0109] Step S27: Obtain the interest rate difference between the actual transaction interest rate and the upper limit of the interest rate prediction range, and obtain the interest rate deviation characteristic by multiplying the interest rate difference by the deviation coefficient.

[0110] In this embodiment, the transaction management system generates an account risk score based on the identified closed-loop path and other relationship characteristics. Simultaneously, by fitting historical interest rate data using a Long Short-Term Memory (LSTM) network model to capture the long-term dependencies and dynamic trends of interest rate data, and obtaining the corresponding target interest rate and prediction range, the transaction management system can adjust the deviation coefficient based on the account risk score, thereby achieving dynamic risk assessment for different account interest rates. For example, the deviation coefficient = k × account risk score / benchmark score, where k is a preset constant, and the benchmark score is calibrated using historical data.

[0111] Specifically, the transaction management system obtains the actual transaction interest rate and calculates the interest rate difference between the actual transaction interest rate and the upper limit of the interest rate prediction range. The interest rate deviation characteristic is obtained by multiplying this interest rate difference by the deviation coefficient.

[0112] This application embodiment is based on the account relationship graph obtained from the device fingerprint nodes by the graph neural network to determine the account risk score, and adjust the deviation coefficient through the risk score to realize a dual threshold decision mechanism of different account deviation coefficients and interest rate prediction range, so as to focus on accounts with risks and improve the reliability of risk detection.

[0113] Since the system described in Embodiment 3 of this application is a system used to implement the method of Embodiment 1 of this application, those skilled in the art can understand the specific structure and variations of the system based on the method described in Embodiment 1 of this application, and therefore will not be described again here. All systems used in the method of Embodiment 1 of this application fall within the scope of protection of this application.

[0114] This application provides a transaction risk detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, which are executed by the at least one processor to enable the at least one processor to perform the transaction risk detection method in Embodiment 1 above.

[0115] The following is for reference. Figure 4 The diagram illustrates a structural schematic of a risk detection device suitable for implementing transactions according to embodiments of this application. The risk detection device for transactions in embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 4 The risk detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0116] like Figure 4 As shown, the transaction risk detection device may include a processing unit 1001 (e.g., a core processor, graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1002 or a program loaded from storage device 1003 into random access memory (RAM) 1004. The random access memory 1004 also stores various programs and data required for the operation of the transaction risk detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the transaction risk detection device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows a transaction risk detection device with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems can be implemented alternatively.

[0117] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0118] The transaction risk detection device provided in this application, employing the transaction risk detection method described in the above embodiments, can solve the technical problem that risk identification is insufficient in recognizing abnormal transaction information using multi-dimensional weak signal combinations, easily leading to missed detections and false detections. Compared with the prior art, the beneficial effects of the transaction risk detection device provided in this application are the same as those of the transaction risk detection method provided in the above embodiments, and other technical features in this transaction risk detection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0119] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0120] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0121] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the transaction risk detection method in the above embodiments.

[0122] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, radio frequency (RF), etc., or any suitable combination thereof.

[0123] The aforementioned computer-readable storage medium may be included in the risk detection device for the transaction; or it may exist independently and not be assembled into the risk detection device for the transaction.

[0124] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a transaction risk detection device, the transaction risk detection device causes the device to: acquire at least two target data items from the transaction data to be detected; acquire the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and perform feature analysis on the target data item using the analysis model to obtain target feature information; fuse the target feature information corresponding to at least two target data items to generate a transaction risk score for the transaction data to be detected; and trigger a tiered response strategy based on the transaction risk score.

[0125] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0126] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0127] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0128] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the risk detection method for the aforementioned transactions. This addresses the technical problem of insufficient accuracy in identifying abnormal transaction information using combinations of multi-dimensional weak signals, which easily leads to missed or false positives. Compared to the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the transaction risk detection method provided in the above embodiments, and will not be elaborated upon here.

[0129] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for detecting the risk of a transaction, characterized in that, The method includes the following steps: Obtain at least two target data items from the transaction data to be detected; In a pre-defined multidimensional analysis model group, the analysis model corresponding to the target data item is obtained, and the target data item is subjected to feature analysis through the analysis model to obtain target feature information; By integrating target feature information corresponding to at least two of the target data items, a transaction risk score for the transaction data to be detected is generated. Based on the transaction risk score, a tiered response strategy is triggered.

2. The method as described in claim 1, characterized in that, The steps of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information include: Obtain the transfer remarks text from the target data item; The transfer note text is segmented using the text analysis model in the multi-dimensional analysis model group to obtain text segmentation. Extract the semantic feature vectors of the text segmentation; Text risk features are generated based on the mapping position of the feature vector in the preset classification space.

3. The method as described in claim 1, characterized in that, The steps of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information include: Based on the transfer date, the historical transfer data in the transaction data to be detected is aggregated to generate a transfer time series; By using a time series analysis model, the deviation information of the historical transfer data within a preset time window of the transfer time series is calculated to form transfer frequency change information; Identify abnormal fluctuation characteristics in the transfer frequency change information, and generate time period confidence based on the abnormal fluctuation characteristics.

4. The method as described in claim 1, characterized in that, The steps of obtaining the analysis model corresponding to the target data item from a preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information include: Based on the account information, deposit certificate information and device fingerprint information in the target data item, construct account nodes, deposit certificate nodes and device fingerprint nodes; Based on the account holding relationships of the transaction data to be detected, a holding edge is established between the account node and the deposit node; and based on the operation device association of the transaction data to be detected, an operation edge is established between the account node and the device fingerprint node, thus forming an account relationship graph. The closed-loop paths in the account relationship graph are identified using a graph neural network.

5. The method as described in claim 1, characterized in that, The step of performing feature analysis on the target data item using the analysis model to obtain target feature information includes: Obtain the historical interest rate data corresponding to the historical transfer data; By using a long short-term memory network model, the historical interest rate data is fitted based on the transfer time of the historical transfer data to generate an interest rate curve model; Determine the target transaction time corresponding to the transaction data to be detected; In the interest rate curve model, the target interest rate corresponding to the target transaction time is obtained, and the interest rate prediction range corresponding to the target interest rate is generated; Calculate the deviation between the actual transaction interest rate of the transaction data to be detected and the interest rate prediction range, and generate an interest rate deviation feature based on the deviation.

6. The method according to any one of claims 1-5, characterized in that, The step of obtaining the analysis model corresponding to the target data item from the preset multidimensional analysis model group, and performing feature analysis on the target data item through the analysis model to obtain target feature information further includes: Textual risk features were extracted from the transfer remarks text using a text analysis model. And / or, through time series analysis models, identify abnormal periods in the transfer time series and generate period confidence scores; Establish a relationship graph containing device fingerprint nodes, and adjust the graph weights of the relationship graph according to the text risk characteristics and / or the time period confidence level to obtain an account relationship graph; The closed-loop transaction characteristics in the account relationship graph are identified using a graph neural network.

7. The method as described in claim 6, characterized in that, After the steps of establishing a relationship graph containing device fingerprint nodes and adjusting the graph weights of the relationship graph according to the text risk features and / or the time period confidence level to obtain the account relationship graph, the method further includes: Based on the recognition results of the account relationship graph by the graph neural network, an account risk score is obtained; Adjust the deviation coefficient based on the account risk score; Obtain the interest rate difference between the actual transaction interest rate and the upper limit of the interest rate prediction range, and obtain the interest rate deviation characteristic by multiplying the interest rate difference by the deviation coefficient.

8. The method as described in claim 1, characterized in that, The steps of fusing target feature information corresponding to at least two of the target data items and scoring the fused target feature information to obtain a transaction risk score include: The target feature information is normalized to obtain the corresponding individual risk score; Obtain the preset weight coefficient of the target data item; Based on the preset weighting coefficients, the individual risk scores are weighted and summed to obtain the transaction risk score.

9. A risk detection device for transactions, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the risk detection method for a transaction as described in any one of claims 1 to 8.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the risk detection method for transactions as described in any one of claims 1 to 8.

Images