Fraud risk prediction method and system applied to digital financial service

Abstract

The invention provides a fraud risk prediction method and system applied to a digital financial service, and belongs to the technical field of digital financial services, and the method comprises the steps: collecting combined risk signals, including a business operation signal, an equipment environment signal and an account behavior signal, in the digital financial service in real time; constructing a time sequence causal map based on the combined risk signals, and recording a causal triggering relationship and sequence between the risk signals; calling a pre-trained signal coupling verification model to compare the atlas with a risk causal rule base, and generating a coupling verification result; performing traceability analysis on the abnormal causal association, and reasoning a core causal chain of risk conduction; and a fraud risk early warning instruction is generated in combination with the core causal chain and the signal real-time change trend and is sent to the management and control terminal, so that the fraud risk in the digital financial service can be comprehensively and accurately predicted in real time, and the service security is improved.

Description

Technical Field

[0001] This invention relates to the field of digital financial services technology, and more specifically, to a method and system for predicting fraud risks in digital financial services. Background Technology

[0002] With the booming development of digital financial services, the problem of fraud risk is becoming increasingly serious. Most existing fraud risk prediction methods have significant shortcomings. On the one hand, some methods focus only on a single type of risk signal, such as account behavior signals, judging the existence of fraud risk by analyzing simple indicators such as account login frequency and transaction amount. However, fraudulent activities in digital financial services are often complex and covert, and a single signal cannot comprehensively reflect the full picture of fraud risk. For example, some fraudsters use legitimate devices to perform abnormal operations; in such cases, analyzing only account behavior signals is insufficient to accurately identify the risk.

[0003] On the other hand, while some methods consider multiple risk signals, they lack in-depth analysis of the causal relationships between these signals. They simply stack and analyze various signals without establishing temporal causal connections between them, making it impossible to accurately determine how risks arise, are transmitted, and evolve. For example, in business operations, abnormal device operation may precede abnormal account transactions, but existing methods struggle to capture this sequence and causal relationship, thus failing to predict fraud risks in a timely and accurate manner, posing significant security risks to digital financial services. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a fraud risk prediction method applied to digital financial services, the method comprising: Real-time acquisition of combined risk signals in digital financial services, including business operation signals, equipment environment signals and account behavior signals. The business operation signals are operation record data streams generated during the execution of financial business, the equipment environment signals are operating status data streams of equipment associated with business operations, and the account behavior signals are historical operation habit data streams of account holders. Based on the combined risk signals, a time-series causal graph is constructed. The time-series causal graph uses time series as the axis to record the causal triggering relationship and the order of triggering between different risk signals, and includes signal nodes, causal association edges and associated trigger timestamps. The pre-trained signal coupling verification model is invoked to compare the time-series causal graph with a preset risk causal rule base to verify the rationality of the causal association edges in the time-series causal graph and generate coupling verification results. The coupling verification results include a set of reasonable causal associations and a set of abnormal causal associations. Based on the coupling verification results, source tracing analysis is performed on the signal nodes and causal association edges in the abnormal causal association set to deduce the core causal chain of risk transmission. The core causal chain includes the risk initiation signal node, intermediate transmission signal node and final impact signal node. Based on the real-time changing trends of the core causal chain and combined risk signals, a fraud risk warning instruction is generated, which includes the location of the risk origin, the description of the transmission path, and the control nodes. The fraud risk warning instruction is then sent to the digital financial service control terminal.

[0005] In another aspect, embodiments of the present invention also provide a fraud risk prediction system for digital financial services, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0006] Based on the above, this invention constructs a time-series causal graph by real-time collection of combined risk signals including business operation signals, device environment signals, and account behavior signals. Using a time series as the axis, it clearly records the causal triggering relationships and the order of triggering between different risk signals. This allows for in-depth analysis of the intrinsic connections between risk signals, accurately grasping the generation and transmission mechanisms of risks. By calling a pre-trained signal coupling verification model to compare the time-series causal graph with a preset risk causal rule base, the rationality of causal association edges can be effectively verified, quickly distinguishing between reasonable and abnormal causal associations, improving the accuracy of risk identification. Source analysis of abnormal causal associations can deduce the core causal chain of risk transmission, accurately locating the starting source and transmission path of risks, providing a strong basis for taking targeted control measures. Combining the core causal chain and the real-time changing trends of combined risk signals, a fraud risk warning instruction is generated, achieving real-time and dynamic early warning of fraud risks. This greatly improves the security and stability of digital financial services and effectively reduces losses caused by fraud risks. Attached Figure Description

[0007] Figure 1 This is a schematic diagram of the execution flow of the fraud risk prediction method applied to digital financial services provided in an embodiment of the present invention.

[0008] Figure 2 This is a schematic diagram of exemplary hardware and software components of a fraud risk prediction system applied to digital financial services provided in an embodiment of the present invention. Detailed Implementation

[0009] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1This is a flowchart illustrating a fraud risk prediction method for digital financial services provided in an embodiment of the present invention. The following is a detailed description of this fraud risk prediction method for digital financial services.

[0010] Step S110: Collect combined risk signals in digital financial services in real time. The combined risk signals include business operation signals, equipment environment signals and account behavior signals. The business operation signals are operation record data streams generated during the execution of financial business. The equipment environment signals are operating status data streams of equipment associated with business operations. The account behavior signals are historical operation habit data streams of the account holder.

[0011] This example uses an online application scenario for personal consumer loans in digital financial services. In this scenario, users initiate personal consumer loan applications through the official app of financial institutions. Throughout the entire process, from logging into their accounts, filling in application information, uploading supporting documents, to submitting the application, various risk-related signals can be generated. These signals are scattered across different business processes and systems, requiring real-time collection to form a comprehensive risk assessment basis.

[0012] The real-time data collection process needs to cover every key step of the user's operation, ensuring that no information that may reflect the risk situation is missed. Business operation signals reflect the user's specific actions during the application process, device environment signals reflect the security and stability of the operating device, and account behavior signals help to understand the user's historical behavior patterns. Combining these three types of signals can depict the risk situation in the current business scenario from multiple dimensions.

[0013] Step S111: Access the multi-source data acquisition channels of digital financial services, wherein the multi-source data acquisition channels correspond to the business operating system, the device management system and the account management system respectively.

[0014] To obtain combined risk signals, it is first necessary to establish data connections with the core systems of digital financial services. The business operating system is the core platform for processing loan application business logic, storing all user operation records during the application process. Its corresponding data acquisition channel uses a dedicated API interface, supporting real-time retrieval of operation logs based on specified conditions. The device management system monitors the mobile devices used by users when applying for loans, including mobile phones and tablets. Its data acquisition channel is implemented through an SDK embedded in the APP, proactively reporting various status parameters of the devices. The account management system maintains users' basic account information and historical behavior records. Its data acquisition channel is based on an incremental database synchronization mechanism, ensuring timely acquisition of the latest account-related data.

[0015] Strict authentication and data encryption are required when accessing these data collection channels. Each channel is configured with a unique access key, and a connection can only be established after key verification. Data is encrypted using SSL / TLS during transmission to prevent unauthorized theft or tampering. Simultaneously, data collection frequency and thresholds are set to avoid excessive system resource consumption due to frequent collection, which could impact normal business operations.

[0016] Step S112: Obtain the operation record data stream generated during the execution of financial business from the acquisition channel corresponding to the business operating system, extract the data in the order of operation execution time, and form a business operation signal. The business operation signal includes a description of operation type, operation object and operation execution duration.

[0017] When acquiring operation record data streams from the business operating system's acquisition channel, it's first necessary to determine the start and end time ranges of the data. In personal consumer loan application scenarios, the start time is typically defined as the user clicking the "Loan Application" button on the app's homepage, and the end time is defined as the user submitting the loan application form and receiving system feedback. All operation records within this time range will be captured, forming a continuous data stream.

[0018] Each record in these operation log data streams contains rich information, and key elements need to be extracted to form business operation signals. Operation type refers to the specific action performed by the user, such as "entering text," "selecting an option," "uploading a file," or "clicking a button." Operation object refers to the specific business element targeted by the operation, such as "loan amount input box," "loan term drop-down menu," "ID card photo upload area," or "submit application button." Operation execution duration is the time elapsed from when the user begins executing the operation to when it is completed. Organizing and encapsulating these elements according to the chronological order of operation execution forms a business operation signal with temporal characteristics.

[0019] Step S113: Obtain the operating status data stream of the business operation-related devices from the acquisition channel corresponding to the device management system, extract the network connection status, hardware operating parameters and geographical location information of the business operation-related devices, organize them in the order of data generation time, and form the device environment signal.

[0020] The equipment management system's data acquisition channels continuously send operational status data streams of devices associated with business operations to the data processing center. These data streams contain various parameters and status information of the devices during operation, from which key content relevant to risk assessment needs to be extracted. Network connection status information includes the network type currently used by the device (e.g., 4G, 5G, Wi-Fi), IP address, network signal strength, connection duration, etc.; hardware operating parameters include the device's CPU utilization, memory usage, battery level, temperature, sensor data (e.g., accelerometer, gyroscope data), etc.; geographic location information is obtained through the device's GPS module or network positioning, including latitude and longitude coordinates, positioning accuracy, and positioning time.

[0021] After extracting this information, it needs to be organized according to the time sequence of data generation. Using the time the user begins the loan application process as a baseline, the device status data for a certain period before and after this time is sorted by timestamp, and invalid and duplicate data is removed. For certain parameters with high real-time requirements, such as network signal strength and CPU utilization, a higher sampling frequency needs to be maintained to accurately reflect the dynamic changes in device status.

[0022] Step S114: Obtain the historical operation habit data stream of the account subject from the collection channel corresponding to the account management system, filter the account login records, transaction records and permission change records within a set time period, arrange them in chronological order, and form account behavior signals.

[0023] Account management systems store a large amount of user account-related data. When retrieving historical operational habit data streams from their collection channels, a reasonable time frame needs to be set first. In personal consumer loan application scenarios, the past six months are typically chosen as the target time frame because user behavior within this period better reflects current behavioral patterns. Within this time frame, records related to account security and risk assessment are filtered out, primarily including account login records, transaction records, and permission change records.

[0024] Account login records include login time, login location, login device information, login method (such as password login, fingerprint login, SMS verification code login), and login result (success or failure). Transaction records include the time of the transaction, transaction amount, transaction type (such as transfer, consumption, repayment), and counterparty information. Permission change records include the time and content of operations such as account password modification, linked mobile phone number change, security question modification, and transaction limit adjustment. Arranging the above-filtered records in chronological order forms an ordered account behavior signal, which can help analyze whether there are any abnormalities in user behavior habits.

[0025] Step S115: Align the business operation signals, device environment signals, and account behavior signals according to timestamps, remove duplicate signal data, and integrate them to form a combined risk signal set, ensuring that each timestamp in the combined risk signal set corresponds to a unique set of combined risk signals.

[0026] Since operational signals, device environment signals, and account behavior signals are collected from different systems, their timestamps may differ, necessitating alignment. The alignment method involves selecting a uniform time granularity, such as milliseconds, and mapping all signal data to that granularity. For different types of signals at the same timestamp, they are then correlated to form a complete set of signal data.

[0027] During the alignment process, some duplicate signal data may be found. This duplication may be due to system failures, network latency, or excessively high sampling frequency. These duplicates need to be identified and removed, retaining only the most recent or most complete record. After removing duplicates, the three types of signal data are integrated to form a combined risk signal set containing timestamps, business operation information, device environment information, and account behavior information. In this combined risk signal set, each timestamp corresponds to a unique set of combined risk signals, ensuring data accuracy and uniqueness.

[0028] Step S120: Based on the combined risk signals, construct a time-series causal graph. The time-series causal graph uses time series as the axis to record the causal triggering relationship and the order of triggering between different risk signals, and includes signal nodes, causal association edges and associated trigger timestamps.

[0029] After obtaining the set of combined risk signals, further analysis of the relationships between these signals is needed, and constructing a time-series causal graph is an effective method. A time-series causal graph uses time series as the horizontal axis, arranging each risk signal in chronological order of occurrence. By analyzing the intrinsic connections between different signals, it is possible to determine whether a causal triggering relationship exists between them, and the order in which they are triggered.

[0030] Constructing a time-series causal graph requires in-depth analysis of each signal in the combined risk signal set to identify the dependencies between signals. For example, a business operation signal may trigger subsequent changes in equipment environment signals, or an account behavior signal may be the cause of a specific business operation signal. These relationships are represented by nodes and edges in the graph, forming a structured graphical model that can intuitively demonstrate the propagation path and evolution of risk signals.

[0031] Step S121: Perform node-based processing on each risk signal in the combined risk signal set, converting the business operation signal, equipment environment signal, and account behavior signal into independent signal nodes. Each signal node includes signal type, signal content, and signal generation timestamp.

[0032] First, each risk signal in the combined risk signal set is processed into nodes. This process requires converting different types of signals into signal nodes in a unified format. For business operation signals, corresponding business operation signal nodes are generated based on their operation type, operation object, and operation execution duration; device environment signals are converted into device environment signal nodes based on network connection status, hardware operating parameters, and geographical location information; similarly, account behavior signals are converted into account behavior signal nodes based on login records, transaction records, and permission change records.

[0033] Each signal node contains three basic elements: signal type, signal content, and signal generation timestamp. The signal type distinguishes whether the node belongs to a business operation signal, a device environment signal, or an account behavior signal; the signal content describes the specific information of the signal, such as "Enter a value in the loan amount input box" for a business operation signal, or "Network signal strength becomes weak" for a device environment signal; the signal generation timestamp accurately records the time when the signal was generated, ensuring the node's accurate position in the time-series causal graph.

[0034] Step S122: Analyze the temporal relationship between different signal nodes, determine the order in which signals are generated, and mark the first generated signal as the preceding signal node and the last generated signal as the following signal node.

[0035] After completing the signal node conversion, the next step is to analyze the temporal relationship between different signal nodes. Since each signal node has a distinct signal generation timestamp, the order in which the signals were generated can be determined by comparing the magnitudes of these timestamps. Signal nodes with smaller timestamps are marked as preceding signal nodes, and signal nodes with larger timestamps are marked as following signal nodes.

[0036] During the analysis, it's crucial to pay attention to the accuracy of timestamps to ensure the precise distinction between the order in which signals are generated. For signal nodes with very close timestamps, it's necessary to further determine their chronological relationship by considering the business context and signal content. For example, if a user enters a loan amount and then immediately clicks the submit button, these two signals have very close timestamps. However, based on business logic, the entered amount can be identified as the preceding signal node, and clicking submit as the following signal node. This approach lays the foundation for subsequently determining the causal triggering relationship between signal nodes.

[0037] Step S123: Determine the triggering relationship between the preceding signal node and the following signal node. By comparing the correlation of the signal content, identify whether the preceding signal node will trigger the generation of the following signal node. If there is a triggering relationship, then determine that there is a causal triggering relationship between the two.

[0038] After identifying the preceding and following signal nodes, it's necessary to determine if a triggering relationship exists between them. This determination is primarily achieved by comparing the correlation of the signal content. First, extract the signal content of the preceding and following signal nodes and analyze whether there is a correlation in their business logic. For example, if the content of the preceding signal node is "upload ID card photo" and the content of the following signal node is "system verifies ID card information," then it can be considered that the preceding signal node triggered the generation of the following signal node, and a causal triggering relationship exists between them.

[0039] Simultaneously, the indirect triggering relationships between signals also need to be considered. In some cases, a preceding signal node may not directly trigger a subsequent signal node, but rather indirectly through a series of intermediate signal nodes. For example, if the preceding signal node is "enter mobile phone number," the intermediate signal node is "get SMS verification code," and the subsequent signal node is "enter SMS verification code to complete verification," then the preceding signal node "enter mobile phone number" indirectly triggers the subsequent signal node "enter SMS verification code to complete verification" through the intermediate node "get SMS verification code." For the aforementioned indirect triggering relationships, it is also necessary to identify and determine the causal connection between them.

[0040] Step S1231: Extract the signal content of the preceding signal node and the signal content of the following signal node, and decompose them into multiple feature elements. The feature elements include the business objects, operation actions and data parameters involved in the signal.

[0041] To more accurately compare the correlation between the content of preceding and following signal nodes, the signal content needs to be broken down into multiple feature elements. The extraction of feature elements should be based on the specific needs of the business scenario. In a personal consumer loan application scenario, these mainly include the business object, operational action, and data parameters involved in the signal. The business object refers to the specific business entity targeted by the signal, such as a loan application form, ID card photo, or mobile phone number; the operational action refers to the specific behavior performed by the user or system, such as input, upload, verification, or clicking; and the data parameters refer to the specific data related to the operational action, such as the input value, the uploaded file path, or the verification code.

[0042] For example, the signal content of the preceding signal node "Enter a value in the loan amount input box" can be broken down as follows: the business object is "loan amount input box", the operation action is "input", and the data parameter is "the specific loan amount value". Similarly, the signal content of the following signal node "System verifies whether the loan amount meets the requirements" can be broken down as follows: the business object is "loan amount", the operation action is "verify", and the data parameter is "the range threshold of the loan amount". Through the above breakdown, the inherent relationship between the two signal nodes can be analyzed more clearly.

[0043] Step S1232: Compare the feature elements of the preceding signal node and the following signal node, identify the feature elements that are common to both and the feature elements that are related, and calculate the correlation degree of the feature elements.

[0044] The feature elements of the decomposed pre-signal nodes and post-signal nodes are compared one by one. First, common feature elements are identified. For example, if both the pre-signal node and the post-signal node involve the business object "loan amount", then "loan amount" is a common feature element. Then, related feature elements are found. For example, if the operation action of the pre-signal node is "input" and the operation action of the post-signal node is "verification", then "input" and "verification" have a sequential relationship in the business process.

[0045] After identifying common and related features, the correlation degree of these features is calculated. The correlation degree can be quantified based on the type and degree of correlation of the features. Common features are assigned a higher correlation weight; related features are assigned appropriate weights based on the tightness of the relationship. The correlation weights of all features are summed to obtain a total correlation value. A higher correlation value indicates a stronger correlation between the preceding and following signal nodes, and a greater likelihood of a causal triggering relationship.

[0046] Step S1233: Referring to the business logic rules in digital financial services, determine whether the operation corresponding to the preceding signal node is a necessary prerequisite for the operation corresponding to the following signal node. If the following operation can only be executed after the preceding operation is completed, then mark it as having a logical dependency relationship.

[0047] In addition to comparing the correlation of feature elements, it is also necessary to refer to the business logic rules in digital financial services to determine the logical dependencies between upstream and downstream signal nodes. These business logic rules are formulated based on the business processes and requirements of loan applications, clearly defining the sequence and dependencies between various operations. For example, in a personal consumer loan application process, basic information must be completed before identity verification can be performed; identity verification must be completed before income verification can be uploaded.

[0048] Based on these business logic rules, it is determined whether the operation corresponding to the preceding signal node is a necessary prerequisite for the operation corresponding to the following signal node. If, according to the business process, the following operation can only be executed after the preceding operation is completed, then these two signal nodes are marked as having a logical dependency. For example, if the operation corresponding to the preceding signal node is "fill in basic personal information," and the operation corresponding to the following signal node is "perform identity verification," according to the business logic rules, identity verification can only be performed after the basic personal information is filled in; therefore, these two signal nodes have a logical dependency.

[0049] Step S1234: Combine the correlation degree of feature elements and logical dependency relationship to construct a trigger relationship judgment index. If the correlation degree reaches the preset correlation threshold and there is a logical dependency relationship, it is determined that the preceding signal node will trigger the generation of the following signal node.

[0050] By considering both the correlation between feature elements and their logical dependencies, a trigger relationship determination index is constructed. First, a preset correlation threshold is set, determined based on historical data and business experience, to judge whether the correlation between feature elements is sufficiently high. If the correlation between the feature elements of the preceding and following signal nodes reaches or exceeds the preset correlation threshold, and a logical dependency exists between them, then it can be determined that the preceding signal node will trigger the generation of the following signal node.

[0051] For example, if the preset correlation threshold is 0.7, and the calculated correlation degree between the feature elements of the preceding and following signal nodes is 0.85, and a logical dependency exists between them according to business logic rules, then it is determined that the preceding signal node triggered the generation of the following signal node. If the correlation degree does not reach the preset threshold, or if there is no logical dependency, then it is determined that there is no triggering relationship between them. This method allows for more accurate identification of causal triggering relationships between signal nodes.

[0052] Step S1235: If the determination result is that the preceding signal node triggers the generation of the following signal node, then record the triggering relationship type between the two. The triggering relationship type includes direct triggering and indirect triggering. Direct triggering means that the preceding signal node directly triggers the following signal node, and indirect triggering means that the preceding signal node indirectly triggers the following signal node through other signal nodes.

[0053] Once it's determined that a preceding signal node triggers the generation of a subsequent signal node, it's necessary to further determine the type of triggering relationship between them. Triggering relationship types are mainly divided into two categories: direct triggering and indirect triggering. Direct triggering means that the preceding signal node directly causes the generation of the subsequent signal node without needing any other signal nodes. For example, when a user clicks the "Get Verification Code" button (the preceding signal node), the system sends a verification code SMS (the subsequent signal node); this is a direct triggering relationship.

[0054] Indirect triggering refers to a preceding signal node indirectly initiating the generation of a subsequent signal node through one or more intermediate signal nodes. For example, after a user enters their mobile phone number (preceding signal node), the system verifies the correctness of the phone number format (intermediate signal node), and only sends a verification code SMS after successful verification (subsequent signal node). Therefore, the relationship between entering the mobile phone number and sending the verification code SMS is an indirect triggering relationship. Recording the types of triggering relationships helps to more clearly depict the causal network between signal nodes.

[0055] Step S1236: Based on the trigger relationship type, determine that there is a causal trigger relationship between the preceding signal node and the following signal node, and record the type description of the causal trigger relationship.

[0056] Based on the determined triggering relationship type, a causal triggering relationship is formally established between the preceding signal node and the following signal node. The description of the triggering relationship type is recorded, such as "the preceding signal node A triggers the following signal node B through a direct triggering method" or "the preceding signal node C triggers the following signal node E through an indirect triggering method (via the intermediate signal node D)," etc.

[0057] The descriptions of the causal triggering relationships recorded in these documents will serve as an important basis for constructing a time-series causal graph. In the subsequent graph construction, causal association edges can be drawn based on these descriptions, and the types of associations can be labeled. In this way, the time-series causal graph can more clearly and accurately reflect the causal relationships between signal nodes.

[0058] Step S124: Establish a causal association edge between the preceding signal node and the following signal node that have a causal triggering relationship, and mark the association triggering timestamp on the causal association edge. The association triggering timestamp is the timestamp generated by the following signal node.

[0059] For a preceding and following signal node whose causal triggering relationship has been established, a causal link needs to be established between them. A causal link is a directed edge that represents the causal relationship between two signal nodes, pointing from the preceding signal node to the following signal node, visually demonstrating the direction of causal triggering.

[0060] The causal relationship edge also needs to be labeled with a trigger timestamp, which is the timestamp generated by the subsequent signal node. This is because the generation timestamp of the subsequent signal node represents the point in time when the causal relationship was completed, accurately reflecting the moment the causal relationship occurred. For example, if the generation timestamp of the preceding signal node A is T1 and the generation timestamp of the subsequent signal node B is T2, then the trigger timestamp labeled on the causal relationship edge established between A and B will be T2.

[0061] Step S125: Arrange all signal nodes and causal relationships along the timeline according to the order of signal generation timestamps, and supplement the trigger logic description corresponding to each causal relationship to form the initial version of the time-series causal graph.

[0062] Arrange all transformed signal nodes on a timeline according to the order of their signal generation timestamps. The timeline scale can be adjusted based on the density of signal generation to ensure a clear display of the signal node distribution. Then, based on the previously established causal relationship edges, connect the signal nodes with causal triggering relationships to form a preliminary network structure.

[0063] To make the temporal causal graph easier to understand and analyze, it is necessary to supplement each causal relationship edge with a corresponding triggering logic description. The triggering logic description is a specific explanation of how the preceding signal node triggers the following signal node. For example, "The preceding signal node (inputting the loan amount) triggers the following signal node (system verifying the loan amount) directly. The triggering logic is that the system automatically executes the verification operation after detecting the loan amount input." By supplementing the triggering logic description, an initial version of the temporal causal graph is formed.

[0064] Step S126: Redundant nodes are removed from the initial version of the temporal causal graph, and signal nodes containing causal triggering relationships and causal association edges are retained to form the final temporal causal graph.

[0065] The initial version of the time-series causal graph may contain some redundant signal nodes. These nodes do not establish any causal relationships with other nodes and are not helpful in analyzing the causal relationships between risk signals. Therefore, redundant nodes need to be removed from the initial version.

[0066] The specific elimination method involves traversing all signal nodes and checking whether each node has causal links between its inputs and outputs. If a signal node neither establishes causal links with other nodes as a preceding signal node nor with other nodes as a following signal node, it is considered a redundant node and eliminated. The remaining signal nodes all contain causal triggering relationships and causal links between them, thus forming the final temporal causal graph.

[0067] Step S130: Call the pre-trained signal coupling verification model, compare the time-series causal graph with the preset risk causal rule base, verify the rationality of the causal association edges in the time-series causal graph, and generate coupling verification results. The coupling verification results include a set of reasonable causal associations and a set of abnormal causal associations.

[0068] After constructing the time-series causal graph, the rationality of causal relationships within the graph needs to be verified. This step is achieved by calling a pre-trained signal coupling verification model. The signal coupling verification model is trained on a large amount of historical risk cases and normal business data, and can identify causal relationships in the time-series causal graph that do not conform to normal business logic and risk rules.

[0069] During the verification process, the time-series causal graph is input into the signal coupling verification model, which simultaneously loads a pre-defined risk causal rule base. By comparing the causal relationships in the time-series causal graph with the rules in the risk causal rule base, it is determined whether each causal relationship conforms to normal business causal relationships. Based on the comparison results, the causal relationships are categorized into reasonable and abnormal types, and integrated into reasonable and abnormal causal relationship sets respectively, together forming the coupling verification result.

[0070] Step S131: Obtain the preset risk causal rule base, parse the contents of the risk causal rule base, extract the regular causal triggering relationships, prohibited causal triggering relationships and causal triggering time interval range contained therein, and form a rule set.

[0071] First, a pre-defined risk causality rule base is retrieved from the system database. This rule base is developed based on the business characteristics of digital financial services, historical risk event analysis, and expert experience, and contains rules governing various causal relationships. The content of the risk causality rule base is then parsed and converted into a computer-readable and processable format.

[0072] During the analysis process, three key types of information are extracted: regular causal triggering relationships, prohibited causal triggering relationships, and the causal triggering time interval range. Regular causal triggering relationships refer to causal relationships that should exist in normal business processes, such as "filling in the verification code" followed by "submitting verification." Prohibited causal triggering relationships refer to causal relationships that should absolutely not occur in normal business processes, such as "loan disbursement completed without identity verification." The causal triggering time interval range refers to the normal time interval between the preceding and following signal nodes in a regular causal triggering relationship; for example, the time interval between "sending the verification code" and "entering the verification code" is typically between 1 and 5 minutes.

[0073] Step S132: Input the temporal causal graph into the input layer of the pre-trained signal coupling verification model, and use the signal coupling verification model to perform feature transformation on the signal nodes, causal association edges and association trigger timestamps in the temporal causal graph to generate a graph feature vector that can be processed by the signal coupling verification model.

[0074] The constructed temporal causal graph is input into the input layer of the pre-trained signal coupling verification model. The input layer of the signal coupling verification model can receive the data structure of the temporal causal graph and perform preliminary processing on the signal nodes, causal association edges, and association trigger timestamps. The feature transformation module inside the model will extract and transform features from these elements.

[0075] For signal nodes, features such as signal type, signal content, and signal generation timestamp are extracted; for causal relationships, features such as trigger relationship type and trigger logic description are extracted; and for associated trigger timestamps, they are converted into temporal feature vectors. Then, the extracted features are fused and vectorized to generate a graph feature vector that the signal coupling verification model can process. The graph feature vector can convert the structured information of the temporal causal graph into a numerical vector form that the model can understand and compute.

[0076] Step S133: The rule comparison module of the signal coupling verification model is used to match the graph feature vector with the conventional causal triggering relationship in the rule set to identify causal association edges that conform to the conventional causal triggering relationship.

[0077] The rule comparison module of the signal coupling verification model is responsible for matching the generated graph feature vectors with the regular causal triggering relationships in the rule set. The matching process uses a feature vector similarity calculation method, comparing the part of the graph feature vector representing the causal association edge with the feature vector of the regular causal triggering relationship in the rule set, and calculating the similarity between them.

[0078] When the similarity reaches a preset matching threshold, the causal relationship is determined to conform to a conventional causal triggering relationship. For example, in the rule set, there exists a conventional causal triggering relationship of "enter SMS verification code" — "verify SMS verification code", with feature vector V1. In the time-series causal graph, the feature vector of a certain causal relationship edge is V2. The similarity between V1 and V2 is calculated to be 0.92, which exceeds the preset matching threshold of 0.85. Therefore, the causal relationship edge is identified as conforming to a conventional causal triggering relationship.

[0079] Step S134: Check the association trigger timestamps corresponding to the causal association edges that conform to the regular causal triggering relationship, and determine whether they are within the causal triggering time interval range specified by the rule set. If they are within the causal triggering time interval range, they are marked as reasonable causal association edges.

[0080] For causal edges that conform to the usual causal triggering relationship, it is necessary to further check whether their triggering timestamps are within the causal triggering time interval range specified by the rule set. First, obtain the causal triggering time interval range corresponding to the usual causal triggering relationship from the rule set. For example, the time interval range from "enter SMS verification code" to "verify SMS verification code" is 30 seconds to 300 seconds.

[0081] Then, the association trigger timestamps (i.e., the generation timestamps of the subsequent signal nodes) and the generation timestamps of the preceding signal nodes are extracted from the causal association edges, and the difference between the two is calculated to obtain the actual causal trigger time interval. The actual causal trigger time interval is compared with the time interval range specified by the rule set. If the actual time interval is within the specified range, the causal association edge is marked as a reasonable causal association edge.

[0082] Step S1341: Extract the causal triggering time interval range corresponding to the regular causal triggering relationship from the rule set. The time interval range is the allowable range of the difference between the timestamp generated by the preceding signal node and the timestamp generated by the following signal node.

[0083] Within the rule set, each regular causal triggering relationship corresponds to a defined causal triggering time interval range. This time interval range clarifies the allowed range of difference between the timestamps of the preceding and subsequent signal nodes. For example, for the regular causal triggering relationship of "clicking the verification code button" — "receiving a verification code SMS", the specified time interval range is 5 to 30 seconds.

[0084] When extracting these time interval ranges from the rule set, they need to be associated with their corresponding regular causal trigger relationships one by one to ensure accurate matching during subsequent checks. The extracted time interval ranges are stored in the form of numerical intervals, such as [5, 30] seconds.

[0085] Step S1342: For each causal association edge that conforms to the conventional causal triggering relationship, extract the timestamp of the generation of the preceding signal node and the timestamp of the generation of the following signal node, calculate the difference between the two timestamps, and obtain the actual triggering time interval.

[0086] For each causal association edge that has been identified as conforming to a regular causal triggering relationship, it is necessary to obtain the generation timestamps of its corresponding preceding and following signal nodes. The generation timestamp of the preceding signal node is T_previous, and the generation timestamp of the following signal node is T_after. The method to calculate the actual triggering time interval is T_after minus T_previous.

[0087] For example, if the generation timestamp of the preceding signal node is 1620000000 seconds and the generation timestamp of the following signal node is 1620000020 seconds, then the actual triggering time interval is 20 seconds. The calculated actual triggering time interval is accurate to the second to ensure comparability with the time interval range in the rule set.

[0088] Step S1343: Compare the actual trigger time interval with the causal trigger time interval range specified in the rule set to determine whether the actual trigger time interval is within that range.

[0089] The calculated actual triggering time interval is compared with the range of causal triggering time intervals for the corresponding regular causal triggering relationships extracted from the rule set. The comparison method is to determine whether the actual triggering time interval is greater than or equal to the lower limit of the time interval range and less than or equal to the upper limit of the time interval range.

[0090] For example, if the rule set specifies a time interval range of [5, 30] seconds, and the actual trigger time interval is 20 seconds, then 20 seconds is greater than 5 seconds but less than 30 seconds, and therefore the actual trigger time interval is determined to be within this range. If the actual trigger time interval is 35 seconds, which is greater than the upper limit of the time interval range of 30 seconds, then it is determined to be outside the range.

[0091] Step S1344: If the actual triggering time interval is within the range of causal triggering time intervals specified by the rule set, then mark the causal association edge as a reasonable causal association edge and record the deviation value between the actual triggering time interval and the range.

[0092] If the actual triggering time interval falls within the causal triggering time interval range specified by the rule set, then the causal association edge is marked as a reasonable causal association edge. Simultaneously, the deviation between the actual triggering time interval and the time interval range is calculated. The deviation can be represented by the difference between the actual triggering time interval and the midpoint of the time interval range, or by the distance between the actual triggering time interval and the upper or lower limit of the range.

[0093] For example, if the time interval range is [5, 30] seconds, the midpoint is 17.5 seconds, and the actual triggering time interval is 20 seconds, then the deviation value is 20 - 17.5 = 2.5 seconds. Recording the deviation value helps to conduct a more detailed analysis of the rationality of the causal connection edge. The smaller the deviation value, the more the triggering time of the causal connection edge is in line with expectations.

[0094] Step S1345: If the actual triggering time interval exceeds the causal triggering time interval range specified in the rule set, the causal relationship edge is temporarily stored, and it will be determined whether it is an abnormal causal relationship edge after being compared with the prohibited causal triggering relationship.

[0095] If the actual triggering time interval exceeds the causal triggering time interval range specified in the rule set, it is not immediately marked as an abnormal causal association edge, but is temporarily stored. This is because the above situation may be due to time delays caused by some special reasons, and does not necessarily indicate a risk. It is necessary to compare it with prohibited causal triggering relationships later to make a comprehensive judgment on whether it is an abnormal causal association edge.

[0096] For example, if the actual triggering time interval of a causal relationship edge exceeds the normal range, but it does not belong to a prohibited causal relationship, it may simply be due to slow user operation. In such cases, it is not necessarily considered abnormal. Therefore, these causal relationships edge are temporarily stored for further verification.

[0097] Step S1346: For causal edges marked as reasonable causal edges, add the corresponding regular causal triggering rule number.

[0098] To facilitate traceability and management, causal association edges marked as reasonable causal association edges are further annotated with the corresponding regular causal triggering relationship rule number. The rule number is a unique identifier for each regular causal triggering relationship in the rule set. By annotating the rule number, the specific rule content that the causal association edge conforms to can be quickly found.

[0099] For example, if a causal relationship edge matches the regular causal triggering relationship numbered R001 in the rule set, then the edge is labeled with R001. In this way, during subsequent analysis or auditing, the rule number can be used to easily determine whether the causal relationship edge was deemed reasonable.

[0100] Step S135: Identify causal association edges in the temporal causal graph that are consistent with the prohibited causal triggering relationship in the rule set, as well as causal association edges whose triggering timestamps exceed the specified time interval range, and mark them as abnormal causal association edges.

[0101] First, identify causal links in the temporal causal graph that match the prohibited causal triggering relationships in the rule set. Match the features of the causal links in the temporal causal graph with the features of the prohibited causal triggering relationships in the rule set. If the features of the two are completely identical or highly similar, mark the causal link as an anomalous causal link.

[0102] For example, the prohibited causal triggering relationship in the rule set includes "no facial recognition performed" - "loan approval completed". If such causal relationship edges exist in the temporal causal graph, they are directly marked as abnormal. Secondly, for causal relationship edges whose actual triggering time interval exceeds the specified time interval range, after excluding cases that belong to normal causal triggering relationships and have reasonable explanations, they are marked as abnormal causal relationship edges.

[0103] Step S136: Integrate reasonable causal association edges and their corresponding signal nodes into a reasonable causal association set, and integrate abnormal causal association edges and their corresponding signal nodes into an abnormal causal association set. The reasonable causal association set and the abnormal causal association set together constitute the coupling verification result.

[0104] All causal association edges marked as reasonable causal association edges, along with the signal nodes connected to these edges, are integrated to form a reasonable causal association set. During the integration process, information such as the association trigger timestamp, trigger relationship type, corresponding rule number, and deviation value of each reasonable causal association edge are recorded. At the same time, information such as the signal type, signal content, and generation timestamp of the relevant signal nodes are also recorded.

[0105] Similarly, causal edges marked as anomalous causal relationships and their corresponding signal nodes are integrated into an anomalous causal relationship set. This set records information such as the trigger timestamp, trigger relationship type, and cause of the anomalous relationship (whether it's a prohibited causal trigger relationship or an out-of-range time interval), as well as detailed information about the relevant signal nodes. The reasonable causal relationship set and the anomalous causal relationship set together constitute the coupling verification result.

[0106] Step S140: Based on the coupling verification results, perform source tracing analysis on the signal nodes and causal association edges in the abnormal causal association set, and deduce the core causal chain of risk transmission. The core causal chain includes the risk initiation signal node, intermediate transmission signal node, and final impact signal node.

[0107] After obtaining the coupling verification results, the focus shifts to the set of anomalous causal associations. Signal nodes and causal edges within this set may indicate potential risks, requiring source tracing analysis to deduce the core causal chain of risk transmission. This source tracing analysis involves tracing back along the anomalous causal edges to identify the source of the risk, its transmission path, and its ultimate impact.

[0108] The core causal chain is the key path of risk transmission, including the risk initiation signal node, intermediate transmission signal nodes, and final impact signal node. The risk initiation signal node is the source of the risk, the intermediate transmission signal nodes are the nodes the risk passes through during transmission, and the final impact signal node is the endpoint of risk transmission, which is usually the node that leads to adverse consequences.

[0109] Step S141: Parse the abnormal causal association set in the coupling verification result, extract the abnormal causal association edges and corresponding signal nodes, and record the association trigger timestamp of each abnormal causal association edge.

[0110] First, the set of anomalous causal relationships in the coupling verification results is parsed. This set is a data structure containing anomalous causal relationship edges and their corresponding signal nodes. The goal is to extract all anomalous causal relationship edges and the signal nodes they connect to. Each anomalous causal relationship edge has a unique identifier, as well as identifiers for the preceding and following signal nodes it is associated with.

[0111] Simultaneously, the trigger timestamp for each abnormal causal link is recorded, serving as a crucial time reference for subsequent source tracing analysis. The extracted abnormal causal links, corresponding signal nodes, and trigger timestamps are compiled into a list for easier sorting and analysis later.

[0112] Step S142: Sort the abnormal causal association edges according to the order of their trigger timestamps, determine the signal node corresponding to the earliest generated abnormal causal association edge, and mark it as the initial abnormal signal node group.

[0113] The extracted abnormal causal links are sorted according to their association trigger timestamps. The earlier the association trigger timestamp, the earlier the abnormal causal link was generated. After sorting, the earliest generated abnormal causal link is found, and the preceding and following signal nodes corresponding to this abnormal causal link together form the initial abnormal signal node group.

[0114] The initial anomaly signal node group is the starting point for risk causation because the earliest anomaly is usually the source of the risk or close to it. For example, if the earliest causal link of an anomaly appears in the early stages of the loan application process, then the initial anomaly signal node group will contain the relevant signal nodes from that stage.

[0115] Step S143: Analyze the preceding signal nodes in the initial abnormal signal node group to determine whether there are other related abnormal causal links. If so, trace the subsequent abnormal signal nodes caused by the preceding signal node to form a preliminary signal transmission path.

[0116] Analyze the preceding signal nodes in the initial abnormal signal node group to check if these nodes are still associated with other abnormal causal edges. Specifically, check whether the preceding signal node serves as the preceding signal node for other abnormal causal edges, i.e., whether it has triggered abnormalities in other subsequent signal nodes.

[0117] If the aforementioned abnormal causal relationships exist, then these subsequent signal nodes are traced and added to the signal propagation path. For example, if the preceding signal node A in the initial abnormal signal node group triggers an anomaly in the subsequent signal node B, and node B, in turn, triggers an anomaly in node C, then the signal propagation path is A—B—C. In this way, a preliminary signal propagation path is formed.

[0118] Step S144: For each signal node in the initial signal propagation path, check whether it is still connected to other abnormal causal association edges. If so, integrate the relevant abnormal causal association edges and signal nodes to expand the signal propagation path.

[0119] The initial signal propagation path may not be complete, requiring further examination of each signal node. For each signal node in the path, whether it is an preceding or following node, check whether it is connected to other causal edges related to anomalies. For example, besides being triggered by an anomaly from node B, did node C also trigger an anomaly from node D, or was node C triggered by another node E?

[0120] If other abnormal causal relationships exist, these relationships and signal nodes are integrated into the existing signal propagation path, expanding its length and breadth. This approach allows for a more comprehensive capture of the entire risk propagation process, preventing the omission of important propagation nodes.

[0121] Step S145: Identify the preceding signal node in the extended signal propagation path that triggers the most subsequent abnormal signal nodes, and mark it as the risk initiation signal node.

[0122] In the extended signal propagation path, each preceding signal node may trigger anomalies in multiple subsequent signal nodes. The preceding signal node that triggers the most subsequent anomalies is often the primary source of risk and is marked as the risk initiation signal node.

[0123] For example, in the extended signal propagation path, if node A triggers 3 subsequent abnormal signal nodes and node B triggers 2, then node A triggers the most subsequent abnormal signal nodes and is marked as the risk initiation signal node. If multiple preceding signal nodes trigger the same number of subsequent abnormal signal nodes, further judgment needs to be made in conjunction with other factors.

[0124] Step S1451: For each preceding signal node in the extended signal propagation path, count the number of subsequent abnormal signal nodes directly or indirectly caused by it through causal correlation edges, and form a node influence count table.

[0125] Traverse each preceding signal node in the expanded signal propagation path and count the number of subsequent anomalous signal nodes they directly or indirectly trigger through causal links. Direct triggering means that the preceding signal node directly serves as the preceding node of the anomalous causal link; indirect triggering means that the preceding signal node triggers the subsequent anomalous signal node through an intermediate node.

[0126] For example, if a preceding signal node A directly triggers node B, and node B in turn triggers node C, then node A indirectly triggers node C. Therefore, the number of subsequent abnormal signal nodes triggered by node A is 2 (B and C). Record each preceding signal node and its corresponding number of triggers to form a node influence count table.

[0127] Step S1452: Sort the preceding signal nodes in descending order of the counts in the node influence count table, and select the preceding signal node with the largest count.

[0128] Based on the counts in the node influence count table, the preceding signal nodes are sorted from largest to smallest count, so that the preceding signal node with the largest count is placed at the top. Then, the preceding signal nodes with the largest counts are selected as candidate risk initiation signal nodes.

[0129] For example, in the node influence count table, node A has a count of 5, node B has a count of 5, and node C has a count of 3. Then, we can filter out nodes A and B, which have the largest counts.

[0130] Step S1453: Check if there are multiple preceding signal nodes with the largest count. If there are multiple preceding signal nodes with the same and largest count, further analyze the generation timestamp of the preceding signal node.

[0131] If there is only one preceding signal node with the largest count, then it is directly used as the candidate risk initiation signal node. If there are multiple preceding signal nodes with the same and largest counts, then the generation timestamps of these nodes need to be further analyzed. The node with the earliest generation timestamp is more likely to be the initiation node of the risk, because risks usually start to propagate from earlier nodes.

[0132] For example, if both node A and node B have a count of 5, and node A's generation timestamp is T1 while node B's generation timestamp is T2, then node A is more likely to be the risk initiation signal node.

[0133] Step S1454: Determine the node with the earliest generated timestamp and the largest count as the candidate risk starting signal node.

[0134] If there are multiple preceding signal nodes with the largest counts, their generation timestamps are compared, and the node with the earliest generation timestamp is determined as the candidate risk initiation signal node. If there is only one preceding signal node with the largest count, then that node is the candidate risk initiation signal node.

[0135] The candidate risk initiation signal node is a preliminary identification of the risk initiation signal node, and further verification is required.

[0136] Step S1455: Analyze the signal content of the candidate risk initiation signal node and determine whether it belongs to the initiation signal type corresponding to the prohibitive causal triggering relationship in the rule set. If it does, mark it directly as a risk initiation signal node.

[0137] Analyze the signal content of candidate risk initiation signal nodes to see if the signal content belongs to the initiation signal type corresponding to the prohibited causal triggering relationship in the rule set. The initiation signal type of the prohibited causal triggering relationship is clearly defined, such as "unauthorized device login" or "false identity information entry".

[0138] If the signal content of a candidate risk initiation signal node belongs to these initiation signal types, then it can be directly marked as a risk initiation signal node. This is because the initiation signal of a prohibitive causal triggering relationship itself represents the source of the risk.

[0139] Step S1456: If the candidate risk initiation signal node does not belong to the prohibited initiation signal type, then based on the severity description of the subsequent abnormal signal nodes it causes, if there is a subsequent node with a high severity, then mark it as a risk initiation signal node.

[0140] If the candidate risk initiation signal node does not belong to the prohibited initiation signal type, then it is necessary to judge its severity based on the severity of the subsequent abnormal signal nodes it triggers. The severity of the subsequent abnormal signal nodes is classified according to business rules and risk levels. For example, the severity of an abnormal node that leads to loan approval is higher than that of a node that leads to CAPTCHA verification failure.

[0141] If a candidate risk initiation signal node triggers a subsequent abnormal signal node with a high degree of severity, then that candidate node is marked as a risk initiation signal node. For example, if a candidate node triggers a subsequent node that leads to the erroneous disbursement of loan funds, which is of high severity, then the candidate node is marked as a risk initiation signal node.

[0142] Step S1457: For the preceding node marked as the risk initiation signal node, record the list of subsequent abnormal signal nodes it triggers and the corresponding causal relationship edge information to form a risk initiation node details table.

[0143] Once the initial risk signal node is identified, a list of all subsequent abnormal signal nodes triggered by that node, along with the corresponding causal relationship information between these nodes, is recorded. The list of subsequent abnormal signal nodes includes the node's identifier, signal type, signal content, and generation timestamp; the causal relationship information includes the edge's identifier, trigger relationship type, associated trigger timestamp, and cause of the anomaly.

[0144] The above information is compiled into a risk initiation node details table, which records in detail the risk initiation signal node and the subsequent abnormal situations it causes.

[0145] Step S146: Determine the intermediate signal node between the risk initiation signal node and the final abnormal signal node, and mark it as the intermediate transmission signal node. Mark the final abnormal signal node as the final impact signal node.

[0146] After identifying the initial risk signal node, the final anomalous signal node is found along the risk propagation path. This anomalous signal node is the final impact signal node. The final impact signal node is usually the endpoint of risk propagation and the direct point leading to adverse consequences.

[0147] The signal node between the initial risk signal node and the final impact signal node is called the intermediate transmission signal node. The intermediate transmission signal node acts as a bridge for risk transmission from the initial node to the final impact node, recording the risk transmission process. For example, if the initial risk signal node is A, the intermediate transmission signal nodes are B and C, and the final impact signal node is D, then the risk transmission path is A—B—C—D.

[0148] Step S147: Construct the core causal chain of risk transmission by following the order of risk initiation signal node, intermediate transmission signal node, and final impact signal node, combined with the corresponding abnormal causal relationship edges.

[0149] Arrange the risk transmission signal nodes, intermediate transmission signal nodes, and final impact signal nodes in the order they appear in the risk transmission path. Then, connect these nodes with corresponding abnormal causal links to form a directed chain, which is the core causal chain of risk transmission.

[0150] The core causal chain clearly illustrates the process of risk propagation from the starting node through intermediate nodes to the final affected node. Each node is connected by anomaly causal association edges, and the trigger timestamps and causes of the anomalies are labeled. Through the core causal chain, the transmission path and key nodes of risk can be intuitively understood.

[0151] Step S150: Combining the real-time changing trends of the core causal chain and combined risk signals, generate a fraud risk warning instruction that includes the location of the risk origin, the description of the transmission path, and the control node, and send the fraud risk warning instruction to the digital financial service control terminal.

[0152] After deducing the core causal chain of risk transmission, it is necessary to combine the real-time changing trends of combined risk signals to generate fraud risk warning instructions. The real-time changing trends of combined risk signals can reflect the current state and development direction of the risk. Combining them with the core causal chain can more accurately assess the severity and scope of the risk.

[0153] Fraud risk warning instructions need to include key information such as the location of the risk's origin, a description of the transmission path, and control nodes. This information can guide the digital financial service control terminal to take effective risk control measures. Finally, the generated warning instruction is sent to the control terminal to ensure that control measures can be implemented in a timely manner.

[0154] Step S151: Extract the risk initiation signal node from the core causal chain, determine the signal type, signal content and generation timestamp corresponding to the risk initiation signal node, and generate risk initiation source location information by combining the signal source system information.

[0155] First, extract the risk initiation signal node from the core causal chain. The risk initiation signal node is the starting point of the core causal chain and contains key information about the source of the risk. Determine the signal type corresponding to this node, such as a business operation signal, device environment signal, or account behavior signal; the signal content is the specific information of this node, such as "login to an account on an unauthorized device"; the generation timestamp is the time when this node was generated.

[0156] Simultaneously, the system information of the signal source node is obtained, indicating which system the signal was collected from, such as the business operating system, device management system, or account management system. Integrating this information generates risk origin source location information, which accurately pinpoints the source location and related details of the risk.

[0157] Step S152: Traverse the risk initiation signal node, intermediate transmission signal node, and final impact signal node in the core causal chain, describe the connection relationship between each signal node in the order of causal triggering, and form a transmission path description.

[0158] Starting from the risk initiation signal node, the process traverses the core causal chain sequentially, visiting intermediate transmission signal nodes and ultimately influencing signal nodes. During this traversal, the connections between signal nodes are described according to the causal triggering order. For example, "Risk initiation signal node A triggers intermediate transmission signal node B via abnormal causal association edge E1; intermediate transmission signal node B triggers intermediate transmission signal node C via abnormal causal association edge E2; and intermediate transmission signal node C triggers ultimately influencing signal node D via abnormal causal association edge E3."

[0159] The description of the transmission path needs to detail the triggering relationship and the cause of the anomaly between each node, so that the reader can clearly understand how the risk is transmitted step by step.

[0160] Step S153: Identify the abnormal causal relationship edge corresponding to the intermediate transmission signal node in the core causal chain, determine the signal intervention node that can interrupt the abnormal causal relationship edge, and mark it as a control node. The control node includes the signal type and intervention direction that need to be intervened.

[0161] In the core causal chain, the abnormal causal links corresponding to intermediate signal transmission nodes are key links in risk transmission; interrupting these links can prevent further risk transmission. Therefore, it is necessary to identify these abnormal causal links and determine the signal intervention nodes that can interrupt them. Signal intervention nodes refer to business nodes or system functions that can intervene in abnormal causal links.

[0162] For example, the abnormal causal link E2 between intermediate signal nodes B and C is a key link in risk transmission. The business operation corresponding to this abnormal causal link is "submitting false income verification." Therefore, the signal intervention node that can interrupt this abnormal causal link could be the "manually review income verification" node. The signal type to be intervened is a business operation signal, and the intervention direction is to suspend the automatic processing flow of this operation and switch to manual review. Record the above information and mark it as a control node.

[0163] Step S154: Retrieve the identification information of the digital financial service management terminal and determine the list of receiving terminals for the warning instruction. The list of receiving terminals includes the terminal name and communication address.

[0164] Retrieve the identification information of the digital financial service management terminal from the system configuration. The management terminal is the terminal device responsible for receiving and processing risk warning instructions, and may include workstations of the risk control department, mobile terminals of management personnel, etc. The identification information includes the terminal name and communication address, which can be an IP address, MAC address, or other network identifier.

[0165] Based on the level and type of the warning instructions, identify the control terminals that need to receive them, and compile a list of receiving terminals with their terminal names and communication addresses. Ensure that the terminals in the receiving terminal list can properly receive and process the warning instructions.

[0166] Step S155: Integrate the risk origin source location information, transmission path description, control node and receiving terminal list, and generate a fraud risk warning instruction according to the preset instruction format. The fraud risk warning instruction includes the specific location details of the risk origin source, the step-by-step description of the transmission path and the intervention guidance of the control node.

[0167] This integrates information such as the location of the risk origin, the description of the transmission path, and a list of control nodes and receiving terminals. This information is then organized and formatted according to a preset instruction format, which typically includes an instruction header, instruction body, and instruction footer. The instruction header contains information such as the instruction number, generation time, and priority; the instruction body contains core content such as details of the risk origin location, a step-by-step description of the transmission path, and intervention guidelines for control nodes; and the instruction footer contains sender information and a checksum.

[0168] The specific location details of the risk origin should be detailed down to the attributes of each signal node; the step-by-step description of the transmission path should explain the risk transmission process in chronological order; and the intervention guidelines for control nodes should clearly specify the intervention nodes, signal types, and specific intervention measures. Through these methods, a complete fraud risk warning instruction can be generated.

[0169] Step S156: Send the fraud risk warning instruction to the digital financial service management terminal in the receiving terminal list.

[0170] Finally, the generated fraud risk warning instruction is sent via the network to the digital financial service management terminals listed in the receiving terminal list. During the transmission process, it is necessary to ensure the integrity and security of the fraud risk warning instruction. Encrypted transmission methods can be used to encrypt the instruction content to prevent tampering or theft during transmission.

[0171] Simultaneously, the transmission process is monitored to ensure that fraud risk warning commands are successfully sent to all receiving terminals. Upon receiving the fraud risk warning command, the control terminal can take corresponding risk control measures based on the content of the command to promptly prevent further escalation of the risk.

[0172] Figure 2The illustration shows exemplary hardware and software components of a fraud risk prediction system 100 for digital financial services, which can implement the ideas of this application, according to some embodiments of this application. For example, processor 120 can be used in the fraud risk prediction system 100 for digital financial services and to perform the functions in this application.

[0173] The fraud risk prediction system 100 applied to digital financial services can be a general-purpose server or a special-purpose server; both can be used to implement the fraud risk prediction method for digital financial services described in this application. Although only one server is shown in this application, for convenience, the functions described in this application can be implemented in a distributed manner on multiple similar platforms to balance the load.

[0174] For example, a fraud risk prediction system 100 for digital financial services may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the fraud risk prediction system 100 for digital financial services may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The methods of this application can be implemented according to the program instructions. The fraud risk prediction system 100 for digital financial services also includes an I / O interface 150 between the computer and other input / output devices.

[0175] For ease of explanation, only one processor is described in the fraud risk prediction system 100 applied to digital financial services. However, it should be noted that the fraud risk prediction system 100 applied to digital financial services in this application may also include multiple processors, and therefore the steps performed by one processor described in this application may also be performed jointly or individually by multiple processors. For example, if the processor of the fraud risk prediction system 100 applied to digital financial services performs steps A and B, it should be understood that steps A and B may also be performed jointly by two different processors or individually by one processor. For example, the first processor performs step A, the second processor performs step B, or the first processor and the second processor jointly perform steps A and B.

[0176] Furthermore, embodiments of the present invention also provide a readable storage medium having computer-executable instructions pre-set therein. When a processor executes the computer-executable instructions, the fraud risk prediction method applied to digital financial services described above is implemented.

[0177] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A fraud risk prediction method applied to digital financial services, characterized in that, The method includes: Real-time acquisition of combined risk signals in digital financial services, including business operation signals, equipment environment signals and account behavior signals. The business operation signals are operation record data streams generated during the execution of financial business, the equipment environment signals are operating status data streams of equipment associated with business operations, and the account behavior signals are historical operation habit data streams of account holders. Based on the combined risk signals, a time-series causal graph is constructed. The time-series causal graph uses time series as the axis to record the causal triggering relationship and the order of triggering between different risk signals, and includes signal nodes, causal association edges and associated trigger timestamps. The pre-trained signal coupling verification model is invoked to compare the time-series causal graph with a preset risk causal rule base to verify the rationality of the causal association edges in the time-series causal graph and generate coupling verification results. The coupling verification results include a set of reasonable causal associations and a set of abnormal causal associations. Based on the coupling verification results, source tracing analysis is performed on the signal nodes and causal association edges in the abnormal causal association set to deduce the core causal chain of risk transmission. The core causal chain includes the risk initiation signal node, intermediate transmission signal node and final impact signal node. Based on the real-time changing trends of the core causal chain and combined risk signals, a fraud risk warning instruction is generated, which includes the location of the risk origin, the description of the transmission path, and the control nodes. The fraud risk warning instruction is then sent to the digital financial service control terminal.

2. The fraud risk prediction method applied to digital financial services according to claim 1, characterized in that, The real-time acquisition of combined risk signals in digital financial services includes: A multi-source data acquisition channel for accessing digital financial services, wherein the multi-source data acquisition channel corresponds to the business operating system, the device management system and the account management system respectively; From the acquisition channel corresponding to the business operating system, the operation record data stream generated during the execution of financial business is obtained, and the data is extracted in the order of operation execution time to form a business operation signal. The business operation signal includes a description of operation type, operation object and operation execution duration. From the acquisition channel corresponding to the equipment management system, obtain the operating status data stream of the business operation related equipment, extract the network connection status, hardware operating parameters and geographical location information of the business operation related equipment, organize them in the order of data generation time, and form equipment environment signals; From the data collection channel corresponding to the account management system, obtain the historical operation habit data stream of the account subject, filter the account login records, transaction records and permission change records within a set time period, arrange them in chronological order, and form account behavior signals; The business operation signals, equipment environment signals, and account behavior signals are aligned by timestamps, duplicate signal data is removed, and they are integrated to form a combined risk signal set, ensuring that each timestamp in the combined risk signal set corresponds to a unique set of combined risk signals.

3. The fraud risk prediction method applied to digital financial services according to claim 1, characterized in that, The construction of a time-series causal graph based on the combined risk signals includes: Each risk signal in the combined risk signal set is processed into nodes, and the business operation signal, equipment environment signal and account behavior signal are converted into independent signal nodes. Each signal node includes signal type, signal content and signal generation timestamp. Analyze the temporal relationship between different signal nodes to determine the order in which signals are generated, and mark the signals generated earlier as the preceding signal nodes and the signals generated later as the following signal nodes; Determine the triggering relationship between the preceding and following signal nodes. By comparing the correlation of signal content, identify whether the preceding signal node will trigger the generation of the following signal node. If a triggering relationship exists, then determine that there is a causal triggering relationship between the two. A causal association edge is established between a preceding signal node and a following signal node that have a causal triggering relationship. The association triggering timestamp is marked on the causal association edge, and the association triggering timestamp is the timestamp generated by the following signal node. Arrange all signal nodes and causal relationships along the timeline according to the order of signal generation timestamps, and supplement the trigger logic description corresponding to each causal relationship to form the initial version of the time-series causal graph. Redundant nodes are removed from the initial version of the temporal causal graph, and signal nodes containing causal triggering relationships and causal association edges are retained to form the final temporal causal graph.

4. The fraud risk prediction method applied to digital financial services according to claim 3, characterized in that, The determination of the triggering relationship between the preceding and following signal nodes involves comparing the correlation of signal content to identify whether the preceding signal node will trigger the generation of the following signal node. If a triggering relationship exists, then a causal triggering relationship is determined between the two, including: The signal content of the preceding signal node and the signal content of the following signal node are extracted and decomposed into multiple feature elements. The feature elements include the business objects, operation actions and data parameters involved in the signal. Compare the feature elements of the preceding and following signal nodes, identify the feature elements that are common to both and the feature elements that are related, and calculate the correlation degree of the feature elements. Referring to the business logic rules in digital financial services, determine whether the operation corresponding to the preceding signal node is a necessary prerequisite for the operation corresponding to the following signal node. If the following operation can only be executed after the preceding operation is completed, then mark it as having a logical dependency relationship. By combining the correlation degree and logical dependency relationship of feature elements, a trigger relationship determination index is constructed. If the correlation degree reaches the preset correlation threshold and there is a logical dependency relationship, it is determined that the preceding signal node will trigger the generation of the subsequent signal node. If the determination result is that the preceding signal node triggers the generation of the following signal node, then the triggering relationship type between the two is recorded. The triggering relationship type includes direct triggering and indirect triggering. Direct triggering means that the preceding signal node directly triggers the following signal node, and indirect triggering means that the preceding signal node indirectly triggers the following signal node through other signal nodes. Based on the trigger relationship type, determine whether there is a causal trigger relationship between the preceding signal node and the following signal node, and record the type description of the causal trigger relationship.

5. The fraud risk prediction method applied to digital financial services according to claim 1, characterized in that, The process involves calling a pre-trained signal coupling verification model, comparing the time-series causal graph with a preset risk causal rule base, verifying the rationality of causal association edges in the time-series causal graph, and generating coupling verification results, including: Obtain a pre-defined risk causality rule base, parse the contents of the risk causality rule base, extract the regular causal triggering relationships, prohibited causal triggering relationships and causal triggering time intervals contained therein, and form a rule set; The temporal causal graph is input into the input layer of a pre-trained signal coupling verification model. The signal coupling verification model is used to perform feature transformation on the signal nodes, causal association edges, and association trigger timestamps in the temporal causal graph to generate a graph feature vector that can be processed by the signal coupling verification model. The rule comparison module of the signal coupling verification model matches the graph feature vector with the conventional causal triggering relationship in the rule set to identify causal association edges that conform to the conventional causal triggering relationship. Check the association trigger timestamps corresponding to causal association edges that conform to the regular causal triggering relationship, and determine whether they are within the causal triggering time interval range specified by the rule set. If they are within the causal triggering time interval range, they are marked as reasonable causal association edges. Identify causal association edges in the temporal causal graph that are consistent with the prohibited causal triggering relationship in the rule set, as well as causal association edges whose triggering timestamps exceed the specified time interval range, and mark them as abnormal causal association edges; Reasonable causal relationships and their corresponding signal nodes are integrated into a reasonable causal relationship set, and abnormal causal relationships and their corresponding signal nodes are integrated into an abnormal causal relationship set. The reasonable causal relationship set and the abnormal causal relationship set together constitute the coupled verification result.

6. The fraud risk prediction method applied to digital financial services according to claim 5, characterized in that, The process involves checking the timestamps of causal association edges that conform to conventional causal triggering relationships, determining whether they fall within the causal triggering time interval range specified by the rule set, and marking them as reasonable causal association edges if they do. Extract the causal triggering time interval range corresponding to the regular causal triggering relationship from the rule set. The time interval range is the allowable range of the difference between the timestamp generated by the preceding signal node and the timestamp generated by the following signal node. For each causal association edge that conforms to the conventional causal triggering relationship, extract the generation timestamp of the preceding signal node and the generation timestamp of the following signal node, calculate the difference between the two timestamps, and obtain the actual triggering time interval. The actual triggering time interval is compared with the causal triggering time interval range specified by the rule set to determine whether the actual triggering time interval is within that range. If the actual triggering time interval is within the range of causal triggering time intervals specified by the rule set, then the causal association edge is marked as a reasonable causal association edge, and the deviation value between the actual triggering time interval and the range is recorded; If the actual triggering time interval exceeds the causal triggering time interval range specified by the rule set, the causal association edge is temporarily stored, and it will be determined whether it is an abnormal causal association edge after being compared with the prohibited causal triggering relationship. For causal edges marked as reasonable causal edges, supplement the label with the corresponding regular causal triggering rule number.

7. The fraud risk prediction method applied to digital financial services according to claim 1, characterized in that, Based on the coupling verification results, the signal nodes and causal edges in the abnormal causal association set are analyzed for tracing the source, and the core causal chain of risk transmission is deduced, including: The abnormal causal association set in the coupling verification result is parsed, the abnormal causal association edges and corresponding signal nodes are extracted, and the association trigger timestamp of each abnormal causal association edge is recorded. The abnormal causal association edges are sorted according to the order of their trigger timestamps. The signal node corresponding to the earliest abnormal causal association edge is determined and marked as the initial abnormal signal node group. Analyze the preceding signal nodes in the initial abnormal signal node group to determine whether there are other related abnormal causal links. If so, trace the subsequent abnormal signal nodes caused by the preceding signal node to form a preliminary signal transmission path. For each signal node in the initial signal propagation path, check whether it is still connected to other abnormal causal association edges. If so, integrate the relevant abnormal causal association edges and signal nodes to expand the signal propagation path. In the expanded signal propagation path, identify the preceding signal node that triggers the most subsequent abnormal signal nodes and mark it as the risk initiation signal node; Identify the intermediate signal nodes between the risk initiation signal node and the final abnormal signal node, and mark them as intermediate propagation signal nodes. Mark the final abnormal signal node as the final impact signal node. By constructing the core causal chain of risk transmission in the order of risk initiation signal node, intermediate transmission signal node, and final impact signal node, and combining the corresponding abnormal causal relationship edges, a risk transmission core causal chain is constructed.

8. The fraud risk prediction method applied to digital financial services according to claim 7, characterized in that, In the expanded signal propagation path, the preceding signal node that triggers the most subsequent abnormal signal nodes is marked as the risk initiation signal node, including: For each preceding signal node in the extended signal propagation path, count the number of subsequent abnormal signal nodes directly or indirectly caused by it through causal association edges, and form a node influence count table. Sort the preceding signal nodes in descending order of their counts in the node influence count table, and select the preceding signal node with the largest count. Check if there are multiple preceding signal nodes with the largest count. If there are multiple preceding signal nodes with the same and largest count, further analyze the generation timestamp of the preceding signal node. The node with the earliest generated timestamp and the largest count preceding signal node is determined as the candidate risk initiation signal node. Analyze the signal content of candidate risk initiation signal nodes to determine whether they belong to the initiation signal type corresponding to the prohibited causal triggering relationship in the rule set. If they do, mark them directly as risk initiation signal nodes. If the candidate risk initiation signal node does not belong to the prohibited initiation signal type, then based on the severity description of the subsequent abnormal signal nodes it causes, if there are subsequent nodes with higher severity, then mark them as risk initiation signal nodes. For each preceding node marked as a risk initiation signal node, record the list of subsequent abnormal signal nodes it triggers and the corresponding causal relationship edge information to form a risk initiation node details table.

9. The fraud risk prediction method applied to digital financial services according to claim 1, characterized in that, The process involves combining the core causal chain and the real-time changing trends of combined risk signals to generate a fraud risk warning instruction that includes the location of the risk origin, a description of the transmission path, and control nodes. This fraud risk warning instruction is then sent to the digital financial service control terminal, including: Extract the risk initiation signal node from the core causal chain, determine the signal type, signal content and generation timestamp corresponding to the risk initiation signal node, and generate risk initiation source location information by combining the signal source system information; The risk initiation signal node, intermediate transmission signal node and final impact signal node in the core causal chain are described in the order of causal triggering, forming a transmission path description. Identify the abnormal causal association edge corresponding to the intermediate transmission signal node in the core causal chain, determine the signal intervention node that can interrupt the abnormal causal association edge, and mark it as a control node. The control node includes the signal type and intervention direction that need to be intervened. Retrieve the identification information of the digital financial service management terminal to determine the list of terminals receiving the warning instruction, wherein the list of terminals receiving the warning instruction includes the terminal name and communication address; The risk origin source location information, transmission path description, control node and receiving terminal list are integrated and a fraud risk warning instruction is generated according to a preset instruction format. The fraud risk warning instruction includes the specific location details of the risk origin source, the step-by-step description of the transmission path and the intervention guidance of the control node. The fraud risk warning instruction is sent to the digital financial service management terminal in the list of receiving terminals.

10. A fraud risk prediction system applied to digital financial services, characterized in that, The device includes a processor and a memory, the memory being connected to the processor. The memory is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the memory to implement the fraud risk prediction method for digital financial services as described in any one of claims 1-9.

Images