Abnormal behavior recognition method and device, electronic equipment, medium and program product

Abstract

The invention provides an abnormal behavior recognition method and device, electronic equipment, a medium and a program product, relates to application of a large model in the field of financial science and technology, and can be applied to the technical field of big data and the technical field of artificial intelligence. The method comprises the following steps: acquiring multi-source information of a target user, and constructing an input sample based on the multi-source information; encoding the input sample by using an encoder to obtain a hidden representation fusing the multi-source information, the encoder at least comprising a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relationship information; inputting the hidden representation into a decoder for processing to obtain an abnormal risk representation of the target user; and obtaining an abnormal behavior identification result of the target user based on the abnormal risk representation.

Description

Technical Field

[0001] This application relates to the application of large models in the field of financial technology, and more specifically to the fields of big data technology and artificial intelligence technology, and more specifically to an abnormal behavior identification method, device, equipment, medium and program product. Background Technology

[0002] With the development of internet technology and fintech, fraudulent methods are constantly evolving. Offenders often use identity forgery and organized crime to bypass approval processes, posing a risk of asset loss to banks. To ensure business security, banks typically use manual approvals or automated systems to identify potential fraud risks among customers.

[0003] Currently, abnormal behavior identification technologies mainly include three types of methods: first, rule engine systems based on manually defined rules, which rely on preset business logic to make anomaly judgments; second, machine learning models based on statistical methods, which model risk scoring through structured features; and third, deep learning methods, which mine deep patterns in transaction behavior by constructing complex neural network models. Among these, rule engines, although simple to implement, suffer from high false positive rates, slow response times, and high maintenance costs; traditional machine learning methods struggle to model nonlinear relationships, and features rely on manual design; while deep learning models possess powerful modeling capabilities, some methods require massive amounts of training samples, making them difficult for small and medium-sized financial institutions to apply in practice, and they have not yet fully integrated the advantages of various information sources or models, leaving room for improvement in their identification capabilities. Summary of the Invention

[0004] In view of the above problems, this application provides methods, apparatus, devices, media and program products for identifying abnormal behavior.

[0005] According to a first aspect of this application, an abnormal behavior recognition method is provided, the method comprising: acquiring multi-source information of a target user; constructing an input sample based on the multi-source information; encoding the input sample using an encoder to obtain a hidden representation fused with the multi-source information, wherein the encoder includes at least a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information; inputting the hidden representation into a decoder for processing to obtain an abnormal risk representation of the target user; and obtaining an abnormal behavior recognition result of the target user based on the abnormal risk representation.

[0006] According to an embodiment of this application, the step of encoding the input sample using an encoder to obtain a hidden representation that integrates the multi-source information includes: using the large model encoder to perform semantic encoding on the unstructured text information contained in the input sample to generate a semantic feature representation; and using the graph neural network encoder to construct a heterogeneous graph structure based on the semantic feature representation, and performing graph representation learning on the heterogeneous graph structure to obtain the hidden representation.

[0007] According to an embodiment of this application, the heterogeneous graph structure includes multiple nodes and multiple edges. The multiple nodes include at least user nodes and transaction nodes. The user nodes include at least the target user and the target user's associated users, and the transaction nodes include at least the transaction records corresponding to the target user. The multiple edges include at least the edges between user nodes, the edges between transaction nodes, and the edges between user nodes and transaction nodes.

[0008] According to an embodiment of this application, performing graph representation learning on the heterogeneous graph structure to obtain the hidden representation includes: sequentially updating the plurality of nodes based on a preset iteration order, wherein the preset iteration order includes: updating the feature representation of the user node; updating the feature representation of the transaction node in response to the completion of the feature representation update of the user node; updating the feature representation of the target node based on the fund flow relationship between the user node and the transaction node in response to the completion of the feature representation update of the transaction node; and using the updated plurality of nodes as the hidden representation.

[0009] According to an embodiment of this application, updating the feature representation of a target node based on the fund flow relationship between the user node and the transaction node includes: determining the source node and the target node for information propagation based on the fund flow relationship, wherein the source node and the target node belong to different types of nodes among the plurality of nodes; and transmitting the feature representation of the source node to the target node through feature fusion to update the feature representation of the target node.

[0010] According to an embodiment of this application, the step of inputting the hidden representation into a decoder for processing to obtain the abnormal risk representation of the target user includes: performing multi-layer decoding operations on the hidden representation using a large model decoder; fusing the outputs of the multi-layer decoding operations based on attention convergence to generate a decoded feature representation; and inputting the decoded feature representation into a fully connected classification layer to output the abnormal risk representation.

[0011] According to an embodiment of this application, the method further includes: in response to the input sample containing multimodal information, performing semantic encoding processing on different modal information respectively to obtain multimodal encoding results, wherein the semantic encoding processing includes at least semantic representation extraction based on a pre-trained language model and context aggregation processing based on sequence modeling; and fusing the multimodal encoding results to generate a semantic feature representation, wherein the semantic feature representation is used as input to the graph neural network encoder.

[0012] According to embodiments of this application, the training process of the encoder includes self-supervised pre-training and supervised fine-tuning training, specifically including: training the large model encoder using a first self-supervised learning task based on historical descriptive text data to obtain initial text encoding parameters, wherein the first self-supervised learning task includes at least one of masked language modeling, contrastive learning, and sentence relation prediction; training the graph neural network encoder using a second self-supervised learning task based on a heterogeneous graph structure constructed from unlabeled historical data to obtain initial graph encoding parameters, wherein the second self-supervised learning task includes at least one of node masking, local subgraph reconstruction, and cross-view contrast; and using the initial text encoding parameters and the initial graph encoding parameters as initial weights, and performing supervised fine-tuning training on the large model encoder and the graph neural network encoder based on labeled historical data.

[0013] A second aspect of this application provides an abnormal behavior recognition device, the device comprising: an input sample construction module, configured to: acquire multi-source information of a target user and construct an input sample based on the multi-source information; an encoding module, configured to: encode the input sample using an encoder to obtain a hidden representation fused with the multi-source information, wherein the encoder includes at least a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information; a decoding module, configured to: input the hidden representation to a decoder for processing to obtain an abnormal risk representation of the target user; and an abnormal behavior recognition module, configured to: obtain an abnormal behavior recognition result of the target user based on the abnormal risk representation.

[0014] According to embodiments of this application, the encoding module can also be used to semantically encode the unstructured text information contained in the input sample using the large model encoder to generate a semantic feature representation; and to construct a heterogeneous graph structure based on the semantic feature representation using the graph neural network encoder, and to perform graph representation learning on the heterogeneous graph structure to obtain the hidden representation.

[0015] According to an embodiment of this application, the encoding module can also be used to update the plurality of nodes sequentially based on a preset iteration order, wherein the preset iteration order includes: updating the feature representation of the user node; updating the feature representation of the transaction node in response to the completion of the feature representation update of the user node; updating the feature representation of the target node based on the fund flow relationship between the user node and the transaction node in response to the completion of the feature representation update of the transaction node; and using the updated plurality of nodes as the hidden representation.

[0016] According to an embodiment of this application, the encoding module can also be used to determine the source node and the target node of information dissemination based on the fund flow relationship, wherein the source node and the target node belong to different types of nodes among the plurality of nodes; and to transmit the feature representation of the source node to the target node through feature fusion to update the feature representation of the target node.

[0017] According to embodiments of this application, the encoding module can also be used to perform semantic encoding processing on different modal information respectively in response to the input sample containing multimodal information to obtain multimodal encoding results, wherein the semantic encoding processing includes at least semantic representation extraction based on a pre-trained language model and context aggregation processing based on sequence modeling; and to fuse the multimodal encoding results to generate semantic feature representations, which are used as inputs to the graph neural network encoder.

[0018] According to embodiments of this application, the decoding module can also be used to perform multi-layer decoding operations on the hidden representation using a large model decoder; fuse the outputs of the multi-layer decoding operations based on attention convergence to generate a decoded feature representation; and input the decoded feature representation into a fully connected classification layer to output the abnormal risk representation.

[0019] According to embodiments of this application, the abnormal behavior recognition device may further include a training module. The training module can be used to train the large model encoder based on historical descriptive text data using a first self-supervised learning task to obtain initial text encoding parameters, wherein the first self-supervised learning task includes at least one of masked language modeling, contrastive learning, and sentence relationship prediction; to train the graph neural network encoder based on a heterogeneous graph structure constructed from unlabeled historical data using a second self-supervised learning task to obtain initial graph encoding parameters, wherein the second self-supervised learning task includes at least one of node masking, local subgraph reconstruction, and cross-view contrast; and to use the initial text encoding parameters and the initial graph encoding parameters as initial weights, and perform supervised fine-tuning training on the large model encoder and the graph neural network encoder based on labeled historical data.

[0020] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0021] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0022] According to embodiments of this application, by constructing multi-source input samples containing unstructured text and structured relational information, the advantages of large models in understanding unstructured text semantics and the modeling capabilities of graph neural networks for structured relational information can be fully utilized. This achieves deep fusion of heterogeneous information, improves the understanding of natural language data such as transaction texts and user application descriptions, and enhances the ability to identify complex behavioral patterns. Thus, while ensuring certain computing resources, the accuracy of recognition per unit time is increased. At the same time, the encoder-decoder structure enables the model to achieve a high accuracy of abnormal behavior recognition with fewer samples, reducing the need for labeled samples in existing deep learning methods. It maintains stability in scenarios with small or medium-sized samples or incomplete information, making it suitable for practical deployment and application in small and medium-sized financial institutions. This improves the overall accuracy, generalization, and usability of abnormal behavior recognition. Attached Figure Description

[0023] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0024] Figure 1 The illustrations depict application scenarios of the abnormal behavior identification method, apparatus, device, medium, and program product according to embodiments of this application.

[0025] Figure 2 A flowchart illustrating an abnormal behavior identification method according to an embodiment of this application is shown schematically.

[0026] Figure 3 This schematically illustrates a flowchart of a method for encoding the input sample using an encoder according to some exemplary embodiments of this application;

[0027] Figure 4 A flowchart illustrating a method for performing graph representation learning according to some exemplary embodiments of this application is shown schematically;

[0028] Figure 5 A schematic diagram illustrating the structure of an abnormal behavior recognition device according to an embodiment of this application is shown; and

[0029] Figure 6A block diagram of an electronic device suitable for implementing an abnormal behavior recognition method according to an embodiment of this application is shown schematically. Detailed Implementation

[0030] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0031] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0032] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0033] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0034] First, the technical terms used in this article are explained and clarified as follows.

[0035] An encoder is a model structure that transforms raw input data (such as text, graph structures, images, or sequences) into an internal representation (i.e., a "hidden representation"), often used to extract high-dimensional semantic features or compress raw information.

[0036] A decoder is a model structure that processes the hidden representations generated by the encoder and transforms them into the output of the target task. Decoders can be used for tasks such as classification, generation, and sequence reconstruction. Typical decoder structures include multi-layer attention mechanisms and feedforward neural networks, and are often combined with encoders to form an "encoder-decoder" framework (such as in translation, prediction, or discrimination tasks).

[0037] Graph Neural Networks (GNNs) are a class of deep learning models specifically designed for processing graph-structured data. Nodes in a graph represent entities, and edges represent relationships between entities. GNNs learn representations of nodes, edges, or the graph as a whole through information propagation between adjacent nodes and feature aggregation.

[0038] A heterogeneous graph is a graph structure that contains multiple types of nodes and / or multiple types of edges, as opposed to a homogeneous graph structure with a single type of node and edge.

[0039] Self-supervised learning is a learning paradigm that does not rely on manually labeled data. It guides the model to learn feature representations autonomously by constructing pseudo-labels or pre-defined tasks from the original data.

[0040] Supervised learning is a learning method that uses manually labeled data to train a model. During the training phase, the model continuously adjusts its parameters to improve prediction accuracy by minimizing the loss function between the predicted result and the true label.

[0041] With the rapid popularization of internet technology, mobile payment methods, and new communication technologies in recent years, financial irregularities and violations have continuously evolved, exhibiting trends such as diversification of methods, organized crime, and more sophisticated process deception. For example, some perpetrators use methods such as stealing identity information, fabricating social relationships, and forging transaction records to submit false applications to obtain loan or credit card limits, thereby gaining approval during the approval process and causing financial institutions to suffer financial losses. To ensure business security, banks typically identify potential customers with irregularities or violations through manual approval or automated systems. However, in practice, if the approval standards are too lenient, high-risk customers are easily approved; if the standards are too strict, legitimate users may be rejected, damaging customer experience and leading to the loss of valuable customers.

[0042] Existing abnormal behavior detection technologies mainly include the following categories:

[0043] The first approach is a rule-based identification system that uses predefined rules or thresholds to determine if a user poses an abnormal risk, such as "more than 5 transactions in a single day" or "cumulative cross-border transaction amount exceeding 100,000 RMB within 24 hours." This method is simple to implement, responds quickly, and is suitable for initial deployments and low-complexity scenarios. However, this method has significant drawbacks: firstly, it has a high false positive rate, easily misclassifying normal users as abnormal or non-compliant users; secondly, it is highly sluggish, unable to adapt to new anomaly identification patterns in a timely manner; and thirdly, it has high maintenance costs, requiring frequent updates to the rule system, relying on manual experience for adjustments, and making continuous expansion difficult.

[0044] Secondly, there are statistical machine learning methods, such as logistic regression and gradient boosting decision trees (e.g., extreme gradient boosting trees). These methods can extract and model features from historical anomalous and non-anomaly samples to output risk scores, thereby supporting automated decision-making. Under conditions of moderate data volume and sufficient structured features, these methods have a certain level of recognition capability and interpretability. However, they suffer from the following problems: First, logistic regression models struggle to capture the nonlinear interactions between high-dimensional features; second, while gradient boosting decision trees possess nonlinear modeling capabilities, they heavily rely on feature engineering, requiring extensive preprocessing based on expert knowledge, such as feature construction, missing value imputation, and normalization; third, the model update cycle is long, lacking the ability to quickly adapt to new anomaly recognition patterns.

[0045] The third category is based on deep learning methods, such as convolutional neural networks, recurrent neural networks, attention mechanisms, and transformer architectures. These methods possess powerful feature extraction and pattern recognition capabilities, and can integrate multimodal information such as transaction timelines, text descriptions, and behavioral trajectories to achieve end-to-end anomaly identification and judgment. With the support of large-scale data and computing resources, the recognition accuracy of deep models is significantly better than traditional methods. However, current deep learning methods still have three shortcomings in practical applications: First, the training cost is high, with many models requiring training on hundreds of millions of samples, making deployment difficult for small and medium-sized financial institutions; second, generalization ability is limited, with some models overfitting to target anomaly identification patterns and struggling to cope with the transfer of anomaly identification behavior across time and regions; and third, the model structure is simplistic, with most solutions failing to effectively integrate structured social network information with unstructured text semantic information, making it difficult to uncover potential gang relationships and upstream / downstream anomaly identification chains.

[0046] In addition, existing methods generally lack the ability to model complex relationship structures. In particular, when faced with graph structure information such as fund transfer paths, transfer amount associations, device sharing behavior, and common contacts between users, traditional methods cannot build an effective interaction modeling mechanism, making it difficult to identify abnormal groups or multi-hop concealed behavior.

[0047] Based on this, embodiments of this application provide an abnormal behavior recognition method, comprising: acquiring multi-source information of a target user; constructing an input sample based on the multi-source information; encoding the input sample using an encoder to obtain a hidden representation that fuses the multi-source information, wherein the encoder includes at least a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information; inputting the hidden representation into a decoder for processing to obtain an abnormal risk representation of the target user; and obtaining an abnormal behavior recognition result of the target user based on the abnormal risk representation. According to embodiments of this application, by constructing multi-source input samples containing unstructured text and structured relational information, the advantages of large models in understanding unstructured text semantics and the modeling capabilities of graph neural networks for structured relational information can be fully utilized. This achieves deep fusion of heterogeneous information, improves the understanding of natural language data such as transaction texts and user application descriptions, and enhances the ability to identify complex behavioral patterns. Thus, while ensuring certain computing resources, the accuracy of recognition per unit time is increased. At the same time, the encoder-decoder structure enables the model to achieve a high accuracy of abnormal behavior recognition with fewer samples, reducing the need for labeled samples in existing deep learning methods. It maintains stability in scenarios with small or medium-sized samples or incomplete information, making it suitable for practical deployment and application in small and medium-sized financial institutions. This improves the overall accuracy, generalization, and usability of abnormal behavior recognition.

[0048] It should be noted that the abnormal behavior identification methods, devices, equipment, media, and program products defined in this application relate to the application of large-scale models in fintech scenarios. They can be used in the fields of big data technology and artificial intelligence technology, as well as in the fintech field, and in various other fields besides big data technology, artificial intelligence technology, and fintech. The application fields of the abnormal behavior identification methods, devices, equipment, media, and program products provided in the embodiments of this application are not limited.

[0049] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0050] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0051] Figure 1 The illustration shows an application scenario diagram of the abnormal behavior identification method, apparatus, device, medium, and program product according to embodiments of this application.

[0052] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0053] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0054] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0055] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0056] It should be noted that the abnormal behavior identification method provided in this application embodiment can generally be executed by server 105. Correspondingly, the abnormal behavior identification device provided in this application embodiment can generally be located in server 105. The abnormal behavior identification method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the abnormal behavior identification device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0057] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0058] The following will be based on Figure 1 The described scene, through Figures 2-4 The abnormal behavior identification method of the disclosed embodiments is described in detail.

[0059] Figure 2 A flowchart illustrating an abnormal behavior identification method according to an embodiment of this application is shown.

[0060] like Figure 2 As shown, the abnormal behavior identification method 200 of this embodiment includes operations S210 to S240.

[0061] In operation S210, multi-source information of the target user is obtained, and an input sample is constructed based on the multi-source information.

[0062] In the embodiments of this application, multi-source information can refer to a collection of business data related to the target user that is diverse in origin and type, covering the target user's identity information, behavioral data, transaction data, device information, geographic information and their related relationships. It can include both structured information and unstructured information, and is used to comprehensively depict the target user's operational background and risk characteristics from multiple dimensions.

[0063] Specifically, structured information can include: basic user attributes (such as gender, age, region, account type), account behavior information (such as account duration, account level, account risk level), transaction behavior characteristics (such as single transaction amount, transaction frequency, daily transaction limit usage, transaction channel, transaction time), geographical location (such as transaction location, login location, location), and device characteristics (such as device type, device ID, fingerprint recognition results). In addition, structured information also includes key fields related to the transaction, such as transaction type (transfer, payment, wealth management, etc.), transaction amount, transaction timestamp, transaction frequency, historical transaction preferences, payee / sender type, and whether the transaction failed.

[0064] Structured information can include: transaction description information (such as notes, comments, and usage instructions), user application text (such as account opening instructions and supplementary material instructions), customer service dialogue text, user feedback content, free field input, and raw statements from behavior logs. Natural language text often contains user intent, reasons for behavior, or business scenario background, and is characterized by rich semantics and non-standard formats.

[0065] In addition to the target user's own information, embodiments of this application can also obtain external information that is directly or indirectly related to the target user, in order to construct its behavioral network. For example, information such as the user's transaction partners, users of shared login devices, accounts logged in from the same IP address, social recommendation relationships, mutual contacts, and historical anomaly identification and reporting records can be obtained to identify potential group abnormal risks or account laundering behaviors.

[0066] In the embodiments of this application, the system can first perform preprocessing and sample construction operations for different types of multi-source information, such as field filtering, feature normalization, modality annotation, and structure allocation, to transform the multi-source information into a sample format with a unified input structure. The input samples may include basic feature vectors of user nodes and transaction nodes, relationship labels between users and transactions, and association information between transactions.

[0067] In some embodiments, when the target user is a newly registered account or has low transaction activity and some information is missing, input samples can be constructed based on existing unstructured data such as transaction descriptions, registration information, and initial behavior logs. Structured supplementary features can be introduced from associated users or associated transactions through a weak ties propagation mechanism to improve the model's generalization ability and risk perception ability in cold start scenarios.

[0068] It should be noted that all of the above information is obtained with the user's authorization or with full authorization from all parties, and corresponding operation entry points are provided for the user to choose to authorize or refuse.

[0069] In operation S220, the input sample is encoded using an encoder to obtain a hidden representation that integrates the multi-source information. The encoder includes at least a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information.

[0070] In embodiments of this application, the encoder may include a large model encoder for processing unstructured text information. The large model encoder can perform semantic modeling on natural language information such as transaction descriptions and user description texts involved in the input samples, and extract contextual semantic features to express user behavior purposes or transaction description information, etc.

[0071] In embodiments of this application, the encoder may further include a graph neural network encoder for modeling structured relationship information. The graph neural network encoder can construct a graph structure and perform graph-based feature aggregation operations based on social relationships between users, fund flow paths between accounts, and temporal or geographical correlations between transaction behaviors, thereby capturing potential relational risk patterns.

[0072] In some embodiments, the encoder may also include other types of encoders. For example, a sequence modeling encoder is used to model time-series behaviors contained in the input samples, such as continuous user login behavior, continuous transaction paths, or cross-day fund flow trajectories, by modeling based on recurrent neural networks, Transformers, or temporal convolutional networks, thereby capturing anomalous jumps or pattern drifts in the behavioral sequence.

[0073] For example, if the input samples contain multimodal information, the encoder may also include a modal coding module specifically for processing images, audio, or device behavior logs. For instance, a convolutional neural network may be used to extract identity features from ID card photos, or a nested sequence coding network may be used to model behavioral intent from operation logs.

[0074] It should be noted that, regardless of the structure adopted or whether the encoders are connected in series or in parallel, the goal of the encoders in this application embodiment is to enhance the representation of multi-source information carried in the input samples, and to form a unified high-dimensional feature representation through abstract modeling, so as to reflect multiple risk factors such as user identity, transaction semantics, behavioral paths and network relationships.

[0075] In operation S230, the hidden representation is input to the decoder for processing to obtain the abnormal risk representation of the target user.

[0076] In the embodiments of this application, the decoder can provide an intermediate representation of whether a user has potential abnormal risks, namely, an abnormal risk representation, based on the input hidden representation and the target task. The abnormal risk representation can provide a basis for the final judgment module, and can also be used for visualization or manual verification.

[0077] Specifically, the hidden representation can include the fused feature vector of user nodes, the features of transaction nodes directly or indirectly associated with the target user, or the context-aware representation of the user and their transaction behavior generated after iterative updates by the graph neural network. As input, the hidden representation can be further processed by the decoder through features abstraction, context aggregation, and task adaptation, thereby forming a discriminative signal suitable for abnormal behavior recognition tasks.

[0078] For example, the decoder can employ a multi-layer feedforward neural network structure to perform non-linear transformations on the hidden representation of the input, extracting high-order semantic features layer by layer, and generating a vector representing the user's risk level at the output. Alternatively, the decoder can use an attention mechanism to weightedly fuse the representations of multiple related nodes, making the model pay more attention to high-risk behavioral paths or key interaction information between nodes, thereby enhancing its ability to express complex abnormal behaviors.

[0079] In some embodiments, the decoder can also be built on a Transformer architecture, which models the interaction relationships between user history, fund flow sequences, or abnormal transaction events through a multi-head attention mechanism, thereby outputting a risk representation with behavioral path awareness capabilities. This type of structure is suitable for scenarios that require modeling behavioral sequence, time dependence, or potential gang behavior, and can capture more complex risk patterns.

[0080] For example, in scenarios with time-series requirements, the decoder can also introduce recurrent neural networks to sequentially model continuous behavioral representations, thereby outputting intermediate state representations that reflect the trend of risk evolution, and assisting the system in identifying risk escalation signals in advance.

[0081] For example, the decoder can also adopt a multi-task output structure, which, while generating an abnormal risk representation of the target user, jointly predicts the user's risk type, the triggered risk rule number, the suggested risk intervention level, and other information, further enriching the practicality and operability of the model output.

[0082] By inputting the fused hidden representation into a flexible and scalable decoder processing module, the system can further mine deep semantic features and complex relational dependencies, achieve accurate perception of user anomalies and task-specific adaptation, and provide more accurate intermediate judgment basis for subsequent decision-making modules.

[0083] It should be noted that the above-mentioned diverse decoding structures are not mutually exclusive and can be combined or selected according to business scenarios, all of which fall within the protection scope of the embodiments of this application.

[0084] In operation S240, the abnormal behavior identification result of the target user is obtained based on the abnormal risk representation.

[0085] According to embodiments of this application, the identification results can be presented as binary labels, multi-level risk scores, or more complex multi-dimensional output formats to support automated processing, manual assisted review, or subsequent linkage with decision-making systems.

[0086] For example, the system can input an anomaly risk representation into a fully connected classifier, and output the probability distribution of the user belonging to either the "normal" or "suspected anomaly" category through a function. The category with the highest probability is selected as the final identification result. This type of output format has a simple structure and fast response, making it suitable for risk control system deployment scenarios that require real-time processing of large numbers of transactions or operation requests.

[0087] For example, the system can construct a multi-layered risk level system, mapping abnormal risks to a continuous or discrete risk score, such as an anomaly probability value between 0 and 1, or dividing them into multiple levels such as "low risk," "medium risk," "high risk," and "severe risk." Multi-layered risk levels are more suitable for scenarios with more manual intervention, such as manual review systems and customer manager collaboration processes, facilitating the configuration of different risk control strategies and resource response mechanisms according to the level.

[0088] For example, the system can also incorporate external knowledge graphs or risk rule bases to assist in reasoning based on the abnormal risk representation. For instance, when certain dimensions in the risk representation are significantly higher than empirical thresholds, or when there is vector similarity with historically known abnormal users, "rule-matching recognition" can be triggered. When the system has historical feedback data, it can also dynamically adjust the judgment threshold based on past recognition accuracy to achieve an adaptive judgment mechanism based on performance feedback.

[0089] For example, while generating recognition results, the system can also output interpretable information, such as high-risk dimensions, salient features, key behavioral nodes or transaction sequences that affect the judgment, thereby assisting humans in quickly understanding the basis of the model's judgment. This interpretive output can be constructed based on mechanisms such as Shapley additive explanatory values, attention weight analysis, and path scoring, which helps to enhance business personnel's trust in the model's judgment results and improve the efficiency of review.

[0090] It should be noted that the usage of the identification results can be flexibly configured according to business needs. For example, in high-risk scenarios such as online lending and payments, the system can use the identification results as a direct basis for whether to grant or deny access, achieving a response time within seconds in conjunction with an automatic blocking mechanism. For low-frequency operations such as registration and authentication, the identification results can be used for subsequent enhanced verification, manual approval, or behavior tracking strategy development. The system can also send the identification results back to the model for continuous updates to the training sample library, enhancing the model's adaptability to different abnormal modes.

[0091] The abnormal behavior identification method of this application will be specifically described below by way of preferred embodiments.

[0092] Figure 3 The flowchart illustrates a method for encoding the input sample using an encoder according to some exemplary embodiments of this application.

[0093] like Figure 3 As shown, the method for encoding the input sample using an encoder includes operations S310 to S320.

[0094] In operation S310, the large model encoder is used to semantically encode the unstructured text information contained in the input sample to generate a semantic feature representation.

[0095] In the embodiments of this application, unstructured text information is widely present in actual business operations. For example, transaction remarks such as "paying tuition fees," "salary transfer," and "family remittance" often imply behavioral intentions, while customer-filled account opening application instructions, registration questionnaire answers, or customer service dialogue content may contain risk assessment criteria such as identity intent and asset source. However, traditional graph modeling methods are difficult to directly process such text information.

[0096] Therefore, by introducing large model encoders, such as some pre-trained language models, we can perform context-aware semantic modeling, which can effectively extract textual representations of transaction or behavior nodes while maintaining grammatical dependencies, syntactic structures, and semantic relevance.

[0097] Preferably, to make fuller use of the multi-dimensional information contained in user behavior, transaction content, and their context, semantic encoding can be performed on each modality of the input sample when it contains multimodal information. A unified semantic feature representation can then be generated through a fusion mechanism to serve as the input features for the subsequent graph neural network encoder. Since multimodal information exhibits strong heterogeneity in data structure, semantic organization, and temporal distribution, targeted encoding strategies are required to achieve semantic alignment and information abstraction.

[0098] Specifically, for unstructured information in natural language (such as transaction notes, usage descriptions, application texts, customer service interaction records, etc.), the system can perform semantic representation extraction operations based on pre-trained language models. For example, the Transformer architecture can be used, which has context-aware capabilities and can extract high-semantic-density vector representations from the original text to characterize potential features such as user behavior purpose, transaction intent, or identity preferences.

[0099] For structured or semi-structured modal information with features such as time sequence and behavioral trajectory (e.g., device login sequences, transaction timestamp sequences, geographic trajectory streams), a context aggregation mechanism based on sequence modeling can be introduced for processing. For example, a recurrent neural network can be built to perform context aggregation and state compression on the input sequence, generating a comprehensive behavioral vector in the time dimension that reflects user operation rhythm, path switching, and temporal anomalies. For instance, in detecting automated script attacks or abnormal transaction jumps, sequence modeling can effectively identify continuous clicks and abrupt changes in behavior.

[0100] The different modal encoding results can be uniformly mapped through feature fusion in subsequent processing to generate semantically consistent fused feature representations. The fusion process can employ methods such as concatenated linear transformation, attention alignment mechanism, tensor fusion, and gating mechanism, and dynamically adjust weights based on modal importance or semantic complementarity to ensure that the final generated semantic feature representation contains both the intent information of natural language expression and retains the operational patterns and geographical distribution characteristics in temporal behavior.

[0101] According to embodiments of this application, the fused semantic feature representation can be used as the initial feature input of the nodes of the graph neural network encoder. It can then be further combined with structured graph relationships for context modeling and cross-node aggregation. This allows the system to complete the abstraction and unification of modal heterogeneous information before entering the graph representation learning stage, reducing the noise dimension in the graph structure, improving the efficiency of multi-source information fusion, and enhancing the semantic stability and structural sensitivity of the model in complex environments.

[0102] In operation S320, the graph neural network encoder is used to construct a heterogeneous graph structure based on the semantic feature representation, and graph representation learning is performed on the heterogeneous graph structure to obtain the hidden representation.

[0103] In embodiments of this application, the graph neural network encoder can construct a heterogeneous graph structure and perform graph representation learning based on the semantic feature representation generated by the large model encoder, thereby introducing a semantically rich initial state into the structural domain.

[0104] According to embodiments of this application, graph representation learning indicates that heterogeneous graph structures can undergo multiple rounds of information propagation and feature aggregation operations in the graph neural network encoder, and different propagation weights or attention weights are assigned according to edge types. Since the initial representation of a node has already incorporated the semantic information output by the large model, the propagation of the graph structure is not merely an expansion of the structural dimension, but also a kind of "semantic-enhanced contextual fusion." That is, in the process of interacting with its neighbors, each node not only learns who has a relationship with whom, but also understands what business context these relationships represent at the linguistic level. For example, if multiple user nodes are strongly connected to nodes whose transaction description is "overseas remittance," it may indicate that there is a "fund transfer" gang behavior in this user circle.

[0105] Therefore, this hierarchical transfer mechanism from semantics to structure can establish a strongly coupled concatenated path between the large model encoder and the graph neural network encoder. Unlike traditional multimodal models that simply connect semantic and structural information in parallel, the strongly coupled concatenated path in this embodiment has a clear dependency structure: the graph building behavior of the graph neural network encoder partially depends on the semantic vectors generated by the large model encoder; even the boundary recognition of node types, similarity construction, and node feature initialization in the graph are driven by the semantic modeling results, thus forming an information evolution path of "language first, graph later". This structure has stronger contextual consistency and cross-modal fusion capabilities, making it suitable for anomaly detection tasks in financial scenarios that require comprehensive judgment of behavioral semantics and behavioral structure.

[0106] For example, a transaction of the same type might be considered legitimate if the text describes it as "living expenses," but if it exhibits joint anomalies with its fund flow path and high-frequency cross-border characteristics, it is highly likely to be a disguised fund transfer. The embodiments of this application capture language disguise features through a large model, capture anomaly propagation paths through a graph model, and achieve deep alignment from semantics to structure to behavior in graph representation learning, thereby improving the ability to identify complex anomaly patterns.

[0107] In the embodiments of this application, the heterogeneous graph structure may include at least two main node types: user nodes and transaction nodes. User nodes include not only the target user but also other users who have business connections, behavioral overlaps, or close proximity in the graph structure with the target user; these are collectively referred to as "related users." The relationship between the target user and related users can be constructed based on historical transaction objects, device sharing, similarity of registration information, geographical proximity, or social graphs. For example, if two user accounts have a history of logging in on the same device or transferring funds to the same recipient within a short period, this can serve as a basis for establishing an edge relationship between user nodes.

[0108] Transaction nodes can represent specific transaction events or actions, such as the target user's recent historical transaction records. These can cover different types, including bank card transfers, quick payments, QR code payments, and domestic / international remittances. The system can select historical transaction records based on business rules or time windows and establish connections between them and the initiator (user node). Each transaction node can further carry its own structured attribute information, such as amount, timestamp, transaction channel, and transaction type, or it can combine the textual semantic representation generated by the large model encoder as initial features.

[0109] In terms of edge construction, based on business logic and risk characteristics, at least three types of edge relationships can be included to reflect the interaction structure between different types of entities: First, edges between user nodes, used to model direct or indirect relationships between accounts, such as fund transfers, device sharing, and registration with the same contact person; second, edges between transaction nodes, used to represent the sequential, similar, or pattern matching relationships between behaviors, such as continuous transactions, gradient changes in amount, and similar operation times; and third, edges between user nodes and transaction nodes, used to reflect the behavioral connection of "a user initiates a transaction" or "a transaction involves an account," which is the core edge type for constructing fund flow paths.

[0110] In some embodiments, other types of nodes and edges can be introduced to enrich the expressive power of the graph structure. For example, a "device node" can be introduced to represent the login device, or a "geographic location node" can be introduced to represent the operation location, thereby supporting the construction of multi-hop semantic paths between users and devices, transactions and locations; "risk label nodes" or "rule hit nodes" can also be constructed based on the model output, which can be used as supervision or feedback information to propagate back in the graph, further enhancing the graph's adaptive learning capabilities.

[0111] Through the aforementioned node and edge configuration, the heterogeneous graph structure of this application embodiment possesses highly flexible semantic extensibility and relational modeling capabilities. It not only preserves the local features of the original behavior but also reveals potential user cooperation patterns, abnormal distributions in transaction paths, and aggregation behaviors in time or space dimensions. In practical deployment, this heterogeneous graph structure supports online incremental updates of the graph, node attribute completion, and dynamic edge management, thus exhibiting strong engineering operability and compatibility with risk control strategies.

[0112] Figure 4 The flowchart illustrating a method for performing graph representation learning according to some exemplary embodiments of this application is shown schematically.

[0113] like Figure 4 As shown in the diagram, the learning method includes operations S410 to S420.

[0114] In operation S410, the plurality of nodes are updated sequentially based on a preset iteration order, wherein the preset iteration order includes: updating the feature representation of the user node; updating the feature representation of the transaction node in response to the completion of the feature representation update of the user node; and updating the feature representation of the target node based on the fund flow relationship between the user node and the transaction node in response to the completion of the feature representation update of the transaction node.

[0115] In the embodiments of this application, in order to fully utilize the semantic complementarity and information propagation paths between different types of nodes in the graph structure, a node iterative update mechanism based on a preset order can be introduced during the graph representation learning process on the heterogeneous graph structure to gradually promote information fusion and feature enhancement. The node iterative update based on the preset order can be designed according to the node type and its information flow path in business semantics, following a progressive propagation order from user nodes to transaction nodes and then to user-transaction relationships, ensuring that the diffusion patterns and local dependencies of risks in the graph can be effectively captured.

[0116] Specifically, in the first phase, the system prioritizes updating the feature representations of user nodes. This phase focuses on the graph embedding of the target user and its associated users, achieving initial-level risk perception and representation correction by aggregating the semantic feature representations of its neighboring nodes.

[0117] After the user nodes complete their updates, the second phase begins, where update operations are performed on the transaction nodes. In this phase, the feature updates for transaction nodes can rely not only on their own attributes (such as amount, time, and transaction type) but also on the updated representations of their associated user nodes. For example, by feeding back user risk profile information to transaction behavior, "user behavior-driven feature enhancement" can be created in the transaction nodes, thereby identifying transactions that may be initiated by high-risk users or occur within high-risk behavioral paths.

[0118] Subsequently, based on the fund flow relationship between user nodes and transaction nodes, feature interaction updates across node types can be performed, which is a targeted propagation update based on edge semantic information. At this stage, the system no longer treats user nodes and transaction nodes as independent modeling units, but establishes a fund path-oriented update process through edge information.

[0119] Specifically, based on the edge relationships between existing user nodes and transaction nodes in the heterogeneous graph structure, the starting and ending points of fund flows can be identified, thereby clarifying the directionality of information dissemination. In actual business operations, this fund flow can be reflected as a behavioral path of "user initiating a transaction" or "transaction involving users." The system can determine the source and target nodes of information dissemination based on the direction of the edges, the timestamp order, or business markers, where the source and target nodes belong to different types of nodes, such as user nodes and transaction nodes, or transaction nodes and user nodes.

[0120] After determining the propagation direction, the currently updated feature representation of the source node can be extracted. This representation may include information such as semantic vectors, structural embeddings, behavioral preferences, and historical risk labels. Next, a feature fusion mechanism can be used to pass the source node's representation to the target node and update the latter's feature state. The fusion mechanism can be implemented using methods such as weighted summation, gated fusion, residual injection, or attention mechanisms to ensure that the structural and semantic features of the target node are preserved while information is transmitted, avoiding information overwriting or overfitting.

[0121] For example, when detecting whether a user has a risk of being part of a group, the system can extract behavioral semantics and risk trends from the transaction nodes initiated by the user, and inject these features into the user node along the fund path, thereby revealing whether the user frequently participates in high-risk transaction activities. As another example, when assessing whether a transaction is suspicious, the system can extract the characteristics of identified high-risk users from its associated user nodes, inject them into the transaction node, thereby indicating that the transaction behavior may be a disguised operation or account borrowing.

[0122] According to embodiments of this application, the cross-type feature propagation process enables risk signal diffusion and behavioral correlation modeling at the graph structure level. By using fund flow as a path constraint, the system can guide risk information to propagate along a reasonable path in the structure, avoiding aimless diffusion across the entire graph and improving the targeting and efficiency of graph representation learning. Simultaneously, it enhances the model's ability to identify complex behavioral patterns such as chain anomalies, account jumpers, and path spoofing, thereby improving the sensitivity and coverage of the overall abnormal behavior system.

[0123] In operation S420, the updated multiple nodes are used as the hidden representation.

[0124] After the aforementioned multiple iterations and type switching update process, the feature representations from the updated nodes can be uniformly summarized as a hidden representation. This hidden representation not only integrates information from both structural and semantic dimensions but also maintains path dependency and directional consistency during the information update process, enabling it to provide subsequent decoders with high-order feature representations that are time-aware, behavioral contextualized, and reflect risk propagation relationships.

[0125] In the embodiments of this application, to improve the model's generalization ability and task adaptability in the process of modeling multi-source heterogeneous data, the encoder training process can adopt a phased strategy, namely, including a self-supervised pre-training stage and a supervised fine-tuning training stage. Through the phased training process, the system can construct a pre-training task using a large amount of unlabeled historical information, obtain initial model parameters with general representation capabilities, and then perform task-oriented fine-tuning optimization using a small number of labeled samples, thereby improving the overall recognition performance.

[0126] Specifically, during the pre-training phase, the large model encoder and the graph neural network encoder can each perform self-supervised learning tasks, independently modeling semantic information and structural relationships. For the large model encoder, based on historical descriptive text data, it is trained using a first self-supervised learning task to obtain initial text encoding parameters to enhance its ability to understand natural language inputs.

[0127] The first self-supervised learning task can include: masked language modeling, which involves randomly masking parts of the input text, training the model to predict the masked words, and learning contextual dependencies; contrastive learning, which involves constructing semantically similar and semantically unrelated text pairs, maximizing the similarity of positive sample pairs and minimizing the similarity of negative sample pairs, thereby improving semantic discrimination ability; and sentence relationship prediction, which involves determining whether a pair of input sentences has a natural sequential relationship, used to enhance the model's ability to perceive paragraph-level logic.

[0128] After training through the above tasks, initial text encoding parameters with strong semantic representation capabilities can be obtained.

[0129] The pre-training process of the graph neural network encoder is based on the constructed heterogeneous graph structure. It uses unlabeled structured data to perform a second self-supervised learning task to enhance the ability to model the node attributes and topological patterns in the graph.

[0130] The second self-supervised learning task can include: node masking, randomly masking the attribute information of some nodes and recovering node features through inference from neighboring nodes and graph structure; local subgraph reconstruction, randomly sampling local subgraphs in the graph and perturbing them, training the model to judge the correspondence between the perturbed graph and the original graph, and improving the model's local sensitivity to graph structure; and cross-view comparison, constructing multiple views from the original graph (e.g., based on different sampling strategies and different edge types), training the model to learn a consistent representation of the same node in different views, thereby enhancing robustness to structural changes.

[0131] Through the above pre-training tasks, initial graph encoding parameters with structural generalization ability can be obtained.

[0132] After completing the self-supervised phase, the supervised fine-tuning training phase can begin. In this phase, the text encoding parameters and graph encoding parameters obtained in the self-supervised phase can be used as the initial weights for the large model encoder and the graph neural network encoder, respectively, and jointly trained and optimized based on historical sample data containing anomaly labels. During supervised fine-tuning, the model inputs the encoded hidden representation into the decoder for risk assessment. Based on the difference between the output and the true labels, the error is backpropagated to update the model parameters, making them more closely aligned with the specific anomaly behavior task objective.

[0133] According to the embodiments of this application, on the one hand, the self-supervised approach makes full use of large-scale unlabeled data, significantly alleviating the labeling dependency and improving the initial convergence quality of the model; on the other hand, through supervised fine-tuning on downstream tasks, the model can learn in a targeted manner for typical behavioral features in abnormal behavior scenarios, so that it still has good adaptability and judgment ability in practical applications with incomplete data and diverse patterns.

[0134] In the embodiments of this application, in order to further improve the model's ability to discriminate fused features, after obtaining the hidden representation, the system can input it into a large model decoder for multi-layer decoding operations to construct an abnormal risk representation of the target user.

[0135] Specifically, the large model decoder can consist of multiple stacked sub-decoding layers. Each layer can include structures such as multi-head self-attention mechanisms, feedforward transformation modules, normalization, and residual connections to perform nonlinear reconstruction and multi-scale feature enhancement of local structures, contextual semantics, and cross-node interaction patterns in the hidden representation. Through multi-layer stacking, the model can progressively capture high-order behavioral interaction patterns and enhance its ability to express risk-related signals.

[0136] To further enhance the aggregation effect of decoding results, the system can introduce an attention convergence mechanism into the outputs of all sub-decoding layers to perform weight evaluation and aggregation processing on the outputs of each layer. Specifically, the system can identify the most representative feature dimensions for risk judgment in different layers based on learnable attention weights, adaptive gating units, or preset layer importance functions, and then fuse the multi-layer decoding results accordingly to generate the final decoded feature representation. Attention convergence not only improves the model's efficiency in utilizing information at different depths but also has a certain degree of interpretability, which can help locate the representation paths of "key behavioral nodes" or "key risk patterns" in the model.

[0137] After obtaining the fused decoded feature representation, it can be input into a fully connected classification layer to perform the final risk discrimination operation.

[0138] In some embodiments, the decoder may also introduce a cross-modal fusion module to deeply align the graph structure encoder output with the semantic vector of the large model, or use a residual path to introduce the output of the historical model as prior information to achieve comparative generation of the judgment logic of the new and old models, thereby more accurately capturing the judgment offset or new abnormal modes in the model iteration process.

[0139] Corresponding to the above-described abnormal behavior identification method, embodiments of this application also provide an abnormal behavior identification device.

[0140] Figure 5 A schematic block diagram of an abnormal behavior recognition device according to an embodiment of this application is shown.

[0141] like Figure 5 As shown, the abnormal behavior recognition device 500 of this embodiment includes an input sample construction module 510, an encoding module 520, a decoding module 530, and an abnormal behavior recognition module 540.

[0142] The input sample construction module 510 can be used to acquire multi-source information of the target user and construct input samples based on the multi-source information. In one embodiment, the input sample construction module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0143] The encoding module 520 can be used to encode the input samples using an encoder to obtain a hidden representation that fuses the multi-source information. The encoder includes at least a large-model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information. In one embodiment, the encoding module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0144] The decoding module 530 can be used to input the hidden representation into the decoder for processing to obtain the abnormal risk representation of the target user. In one embodiment, the decoding module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0145] The abnormal behavior identification module 540 can be used to obtain the abnormal behavior identification result of the target user based on the abnormal risk representation. In one embodiment, the abnormal behavior identification module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0146] According to an embodiment of this application, the encoding module 520 can also be used to semantically encode the unstructured text information contained in the input sample using the large model encoder to generate a semantic feature representation; and to construct a heterogeneous graph structure based on the semantic feature representation using the graph neural network encoder, and to perform graph representation learning on the heterogeneous graph structure to obtain the hidden representation.

[0147] According to an embodiment of this application, the encoding module 520 can also be used to update the plurality of nodes sequentially based on a preset iteration order, wherein the preset iteration order includes: updating the feature representation of the user node; updating the feature representation of the transaction node in response to the completion of the feature representation update of the user node; updating the feature representation of the target node based on the fund flow relationship between the user node and the transaction node in response to the completion of the feature representation update of the transaction node; and using the updated plurality of nodes as the hidden representation.

[0148] According to an embodiment of this application, the encoding module 520 can also be used to determine the source node and the target node of information dissemination based on the fund flow relationship, wherein the source node and the target node belong to different types of nodes among the plurality of nodes; and to transmit the feature representation of the source node to the target node through feature fusion to update the feature representation of the target node.

[0149] According to an embodiment of this application, the encoding module 520 can also be used to perform semantic encoding processing on different modal information respectively in response to the input sample containing multimodal information to obtain multimodal encoding results, wherein the semantic encoding processing includes at least semantic representation extraction based on a pre-trained language model and context aggregation processing based on sequence modeling; and to fuse the multimodal encoding results to generate semantic feature representations, wherein the semantic feature representations are used as inputs to the graph neural network encoder.

[0150] According to an embodiment of this application, the decoding module 530 can also be used to perform multi-layer decoding operations on the hidden representation using a large model decoder; fuse the output of the multi-layer decoding operations based on attention convergence to generate a decoded feature representation; and input the decoded feature representation into a fully connected classification layer to output the abnormal risk representation.

[0151] According to embodiments of this application, the abnormal behavior recognition device 500 may further include a training module. The training module can be used to train the large model encoder based on historical descriptive text data using a first self-supervised learning task to obtain initial text encoding parameters, wherein the first self-supervised learning task includes at least one of masked language modeling, contrastive learning, and sentence relationship prediction; to train the graph neural network encoder based on a heterogeneous graph structure constructed from unlabeled historical data using a second self-supervised learning task to obtain initial graph encoding parameters, wherein the second self-supervised learning task includes at least one of node masking, local subgraph reconstruction, and cross-view contrast; and to use the initial text encoding parameters and the initial graph encoding parameters as initial weights, and perform supervised fine-tuning training on the large model encoder and the graph neural network encoder based on labeled historical data.

[0152] According to embodiments of this application, any multiple modules among the input sample construction module 510, encoding module 520, decoding module 530, and abnormal behavior recognition module 540 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the input sample construction module 510, encoding module 520, decoding module 530, and abnormal behavior recognition module 540 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or implemented in hardware or firmware by any other reasonable means of integrating or packaging the circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the input sample construction module 510, encoding module 520, decoding module 530, and abnormal behavior recognition module 540 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0153] Figure 6 A block diagram of an electronic device suitable for implementing an abnormal behavior recognition method according to an embodiment of this application is shown schematically.

[0154] like Figure 6 As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0155] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0156] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0157] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0158] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0159] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the abnormal behavior recognition method provided in the embodiments of this application.

[0160] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0161] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0162] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0163] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0164] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0165] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0166] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A method for identifying abnormal behavior, characterized in that, The method includes: Obtain multi-source information about the target user, and construct input samples based on the multi-source information; The input samples are encoded using an encoder to obtain a hidden representation that integrates the multi-source information. The encoder includes at least a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information. The hidden representation is input into the decoder for processing to obtain the abnormal risk representation of the target user; and The abnormal behavior identification result of the target user is obtained based on the abnormal risk representation.

2. The method according to claim 1, characterized in that, The step of encoding the input sample using an encoder to obtain a hidden representation that fuses the multi-source information includes: The large model encoder is used to semantically encode the unstructured text information contained in the input samples, generating semantic feature representations; and The graph neural network encoder is used to construct a heterogeneous graph structure based on the semantic feature representation, and graph representation learning is performed on the heterogeneous graph structure to obtain the hidden representation.

3. The method according to claim 2, characterized in that, The heterogeneous graph structure includes multiple nodes and multiple edges. The multiple nodes include at least user nodes and transaction nodes. The user nodes include at least the target user and the target user's associated users. The transaction nodes include at least the transaction records corresponding to the target user. The multiple edges include at least the edges between user nodes, the edges between transaction nodes, and the edges between user nodes and transaction nodes.

4. The method according to claim 3, characterized in that, The step of performing graph representation learning on the heterogeneous graph structure to obtain the hidden representation includes: The plurality of nodes are updated sequentially according to a preset iteration order, wherein the preset iteration order includes: updating the feature representation of the user node; updating the feature representation of the transaction node in response to the completion of the update of the feature representation of the user node; updating the feature representation of the target node based on the fund flow relationship between the user node and the transaction node in response to the completion of the update of the feature representation of the transaction node; and The updated nodes are used as the hidden representation.

5. The method according to claim 4, characterized in that, The updating of the target node's feature representation based on the fund flow relationship between the user node and the transaction node includes: Based on the aforementioned fund flow relationship, the source node and the target node for information dissemination are determined, wherein the source node and the target node belong to different types of nodes among the plurality of nodes; and The feature representation of the source node is passed to the target node through feature fusion to update the feature representation of the target node.

6. The method according to claim 1, characterized in that, The step of inputting the hidden representation into the decoder for processing to obtain the abnormal risk representation of the target user includes: The hidden representation is subjected to multi-layer decoding operations using a large model decoder; The outputs of multi-layer decoding operations are fused based on attention convergence to generate decoded feature representations; and The decoded feature representation is input into a fully connected classification layer, and the abnormal risk representation is output.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: In response to the input sample containing multimodal information, semantic encoding processing is performed on different modalities to obtain multimodal encoding results. The semantic encoding processing includes at least semantic representation extraction based on a pre-trained language model and context aggregation processing based on sequence modeling. The multimodal encoding results are fused to generate a semantic feature representation, which is used as the input to the graph neural network encoder.

8. The method according to any one of claims 1 to 6, characterized in that, The encoder training process includes self-supervised pre-training and supervised fine-tuning training, specifically including: Based on historical descriptive text data, the large model encoder is trained using a first self-supervised learning task to obtain initial text encoding parameters, wherein the first self-supervised learning task includes at least one of masked language modeling, contrastive learning, and sentence relation prediction. Based on a heterogeneous graph structure constructed from unlabeled historical data, the graph neural network encoder is trained using a second self-supervised learning task to obtain initial graph encoding parameters. The second self-supervised learning task includes at least one of node masking, local subgraph reconstruction, and cross-view comparison. The initial text encoding parameters and the initial graph encoding parameters are used as initial weights, and supervised fine-tuning training is performed on the large model encoder and the graph neural network encoder based on labeled historical data.

9. An abnormal behavior recognition device, characterized in that, The device includes: The input sample construction module is used to: acquire multi-source information of the target user and construct input samples based on the multi-source information; The encoding module is used to: encode the input sample using an encoder to obtain a hidden representation that integrates the multi-source information, wherein the encoder includes at least a large model encoder for modeling unstructured text information and a graph neural network encoder for modeling structured relational information; The decoding module is configured to: input the hidden representation into the decoder for processing to obtain the abnormal risk representation of the target user; and An abnormal behavior identification module is used to: obtain the abnormal behavior identification result of the target user based on the abnormal risk representation.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images