Potential risk intelligent perception method and system fusing big data payment data

Abstract

The application provides a potential risk intelligent perception method and system for fusing big data payment data, first, a payment data association graph containing payment account entities, transaction object entities and payment channel entities is constructed, and the entities are connected through association edges containing transaction frequency and continuity attributes, then, payment behavior sequence features containing transaction object, payment channel and payment amount sequence features are generated based on this, then, risk factors are extracted from the payment behavior sequence features, a risk factor set is generated, then, the risk factor transmission network containing the directed connection edges with the influence strength attribute is established according to the co-occurrence and influence degree with the risk factors as the nodes, finally, the risk diffusion index is calculated based on the network node state and the connection edge influence strength, and the risk perception result and disposal instruction of the payment account are generated, so that the potential risk of payment can be comprehensively perceived, and the safety of the payment system is ensured.

Description

Intelligent perception method and system for potential risks by integrating big data payment data Technical Field

[0001] This invention relates to the field of computer technology, and more specifically, to a method and system for intelligently perceiving potential risks by integrating big data payment data. Background Technology

[0002] In today's era of rapid development in digital finance, payment services are experiencing explosive growth, resulting in a massive surge of big data payment data. Existing payment risk perception technologies primarily focus on risk assessment at the level of a single payment transaction, such as making simple judgments based on the amount of a single transaction or whether the transaction time is abnormal. While some technologies consider the historical transaction records of payment accounts, most only perform simple statistical analysis of historical transaction data, such as calculating average transaction amounts and transaction frequency, lacking in-depth mining of the complex relationships between various entities within the payment data.

[0003] Meanwhile, in understanding payment risks, existing technologies often view each transaction in isolation, failing to consider payment accounts, transaction counterparties, and payment channels as an organic whole, and ignoring the impact of their interrelationships and interactions on risk. Furthermore, regarding risk transmission, existing technologies lack effective models to characterize the transmission relationships between risk factors, making it impossible to accurately predict the spread and scope of risk impact. This hinders the implementation of effective risk mitigation measures in advance, posing a potential threat to payment systems and user fund security. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a method for intelligent perception of potential risks that integrates big data payment data, the method comprising:

[0005] A payment data association graph is constructed from big data payment data. The payment data association graph includes payment account entities, transaction object entities, and payment channel entities. The entities in the payment data association graph establish association edges through payment transaction relationships. The association edges include transaction frequency attributes and transaction continuity attributes.

[0006] Based on the payment data association graph, payment behavior sequence features of payment accounts are generated. The payment behavior sequence features are generated by tracking the change sequence of association edges of payment account entities within a preset time window. The payment behavior sequence features include transaction object sequence features, payment channel sequence features, and payment amount sequence features.

[0007] A risk factor extraction operation is performed on the payment behavior sequence features to identify abnormal behavior segments in the payment behavior sequence features that conform to a preset risk pattern, and a risk factor set is generated based on the frequency and duration of the abnormal behavior segments.

[0008] Using the risk factors in the set of risk factors as network nodes, directed connections are established based on the co-occurrence relationship and influence degree between risk factors to construct a risk factor transmission network. The directed connections include an influence strength attribute.

[0009] The risk diffusion index is calculated based on the node states and the influence strength attributes of the directed connections in the risk factor transmission network. Based on the risk diffusion index and the network structure of the risk factor transmission network, the risk perception results and risk handling instructions for the payment account are generated.

[0010] In another aspect, embodiments of the present invention also provide a potential risk intelligent perception system that integrates big data payment data, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to execute the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0011] Based on the above, this invention constructs a payment data association graph of big data payment data, integrating payment account entities, transaction object entities, payment channel entities, and the payment transaction relationships between them. Based on this payment data association graph, payment behavior sequence features are generated, accurately tracking the dynamic changes of payment accounts within a preset time window. This covers multiple key dimensions such as transaction object, payment channel, and payment amount, making the characterization of payment behavior more comprehensive and in-depth. By performing risk factor extraction on the payment behavior sequence features, abnormal behavior fragments conforming to preset risk patterns can be intelligently identified, and a risk factor set can be generated, effectively capturing potential risk signals in payment behavior. A risk factor transmission network is constructed to intuitively present the co-occurrence relationship and influence degree between risk factors. Based on this risk factor transmission network, a risk diffusion index is calculated, and risk perception results and risk handling instructions are generated. This allows for early prediction of the risk diffusion trend and impact range, enabling timely and targeted risk handling measures, greatly improving the security and stability of the payment system and ensuring the safety of user funds. Attached Figure Description

[0012] Figure 1 is a schematic diagram of the execution flow of the intelligent perception method for potential risks that integrates big data payment data provided in an embodiment of the present invention.

[0013] Figure 2 is a schematic diagram of exemplary hardware and software components of the potential risk intelligent perception system that integrates big data payment data provided in an embodiment of the present invention. Detailed Implementation

[0014] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 is a flowchart illustrating a potential risk intelligent perception method that integrates big data payment data according to an embodiment of the present invention. The following is a detailed description of the potential risk intelligent perception method that integrates big data payment data.

[0015] Step S110: Construct a payment data association graph of big data payment data. The payment data association graph includes payment account entities, transaction object entities, and payment channel entities. The entities in the payment data association graph establish association edges through payment transaction relationships. The association edges include transaction frequency attributes and transaction continuity attributes.

[0016] In this embodiment, we take a typical user's payment account as an example. This account is used for various payment scenarios, such as online shopping and offline consumption. To fully understand the potential payment risks of this payment account, it is first necessary to construct its corresponding payment data association graph. Constructing this payment data association graph requires systematically sharing various entities related to the account and the relationships between these entities, and assigning corresponding attributes to these relationships.

[0017] Step S111: Extract payment account information from big data payment data, and create payment account entities based on the payment account information. Each payment account entity has a unique account identifier attribute and account type attribute.

[0018] The system extracts relevant information about the user's payment account from big data payment data. This information includes an encrypted identifier of the account's registered mobile phone number, a summary of the account's real-name authentication information, and the account's issuing institution code. Based on this information, a payment account entity is created. The unique account identifier can be a string composed of the issuing institution code, an encrypted fragment of the mobile phone number, and random characters, ensuring the uniqueness of this identifier throughout the entire payment data system. The account type attribute is set according to the actual function of the account, such as a personal comprehensive payment account, which supports multiple payment channels and transaction scenarios.

[0019] Step S112: Extract transaction object information from big data payment data, and create transaction object entities based on the transaction object information. Each transaction object entity has a unique object identifier attribute and object category attribute.

[0020] Information on various transaction objects that have transacted with the payment account is extracted from big data payment data. This information includes the transaction object's merchant code, merchant name abbreviation, and industry classification code. An entity is created for each transaction object, with the object identification attribute using a combination of merchant code and industry classification code to ensure each transaction object entity has a unique identifier. The object category attribute is categorized based on the transaction object's main business. For example, a transaction object primarily engaged in the sale of electronic products is categorized as an electronic retailer; another transaction object primarily providing catering services is categorized as a catering service merchant; and yet another transaction object is a public utility payment unit, categorized as a public service institution.

[0021] Step S113: Extract payment channel information from big data payment data, and create payment channel entities based on the payment channel information. Each payment channel entity has a unique channel identifier attribute and channel type attribute.

[0022] Information about the payment channels used by the payment account is extracted from big data payment data. This information includes the operating entity code of the payment channel, the channel access identifier, and the payment methods supported by the channel. A payment channel entity is created based on this information. The channel identifier attribute is composed of the operating entity code and the channel access identifier, ensuring the uniqueness of each payment channel entity. The channel type attribute is classified according to the payment channel's operating model and technical characteristics. For example, a payment channel operated by a large e-commerce platform, primarily relying on the platform's payment interface to complete transactions, is set as a platform-built-in payment channel; another payment channel is directly operated by a bank, processing transactions through the bank's own online banking system, and its type attribute is set as a bank online banking payment channel; still other payment channels utilize near-field communication (NFC) technology for offline small-amount payments, and their type attribute is set as a near-field quick payment channel.

[0023] Step S114: Identify the payment transaction relationship between the payment account entity and the transaction object entity. When the payment account entity performs a payment operation on the transaction object entity, establish an association edge between the two entities. This association edge is marked as the transaction object association edge.

[0024] The system continuously monitors the transaction records of the payment account entity in the big data payment data. When it detects that the payment account has performed a payment operation to a transaction object entity, i.e., there is a fund transfer record from the payment account to the transaction object, a connection edge is established between the two entities in the payment data association graph and marked as a transaction object connection edge. For example, when the payment account makes a payment to an e-commerce merchant for goods, a transaction object connection edge is established between the payment account entity and the corresponding transaction object entity of the e-commerce merchant; when the payment account pays for a meal to a catering service merchant, a transaction object connection edge is also established between the corresponding entities.

[0025] Step S115: Identify the payment transaction relationship between the payment account entity and the payment channel entity. When the payment account entity performs a payment operation through the payment channel entity, establish an association edge between the two entities. This association edge is marked as the payment channel association edge.

[0026] When it is detected that a payment account entity completes a payment operation through a payment channel entity—that is, when the payment instruction is transmitted through the payment channel and the funds are transferred—a connection edge is established between the payment account entity and the payment channel entity, and marked as a payment channel connection edge. For example, if the payment account completes an online shopping payment through the platform's built-in payment channel, a payment channel connection edge is established between the payment account entity and the platform's built-in payment channel entity; when a transfer payment is completed through a bank's online banking payment channel, a payment channel connection edge is established between the corresponding entities.

[0027] Step S116: Count the number of payment transactions corresponding to the associated edges of the transaction objects within the preset time period as the transaction frequency attribute, count the number of consecutive transaction days as the transaction continuity attribute, and add the transaction frequency attribute and transaction continuity attribute to the associated edges of the corresponding transaction objects.

[0028] Define a preset time period, such as a calendar month. For each transaction-related edge, count the number of times the payment account performs payment transactions with the corresponding transaction entity through this edge within the time period. This number is used as the transaction frequency attribute of the edge. Simultaneously, count the number of consecutive days the payment account makes payments to the transaction entity within the time period—that is, the number of days without interruption from the first transaction. This number of days is used as the transaction continuity attribute. Add these two attributes to the corresponding transaction-related edge. For example, for the transaction-related edge between a payment account and an e-retailer, the number of transactions and the number of consecutive transaction days within a month are used as the transaction frequency and transaction continuity attributes, respectively.

[0029] Step S117: Count the number of payment transactions corresponding to the payment channel associated edge within the preset time period as the transaction frequency attribute, count the number of consecutive days of use as the transaction continuity attribute, and add the transaction frequency attribute and transaction continuity attribute to the corresponding payment channel associated edge.

[0030] Using a calendar month as the preset time period, for each payment channel association edge, the number of times the payment account executes payment transactions through the payment channel entity corresponding to the association edge within that time period is counted, serving as the transaction frequency attribute of that association edge. The number of days the payment account continuously uses that payment channel for payments within that time period—that is, the number of consecutive days of use from the first use of that channel without switching to another channel—is counted, serving as the transaction continuity attribute. These two attributes are added to the corresponding payment channel association edge. For example, for a payment account's association edge with a platform's built-in payment channel, the number of transactions and the number of consecutive days of use within a month are recorded; these data serve as the transaction frequency and transaction continuity attributes of that association edge, respectively.

[0031] Step S120: Generate payment behavior sequence features of payment accounts based on the payment data association graph. The payment behavior sequence features are generated by tracking the change sequence of association edges of payment account entities within a preset time window. The payment behavior sequence features include transaction object sequence features, payment channel sequence features, and payment amount sequence features.

[0032] After constructing the payment data association graph, the payment account entity is used as the analysis object. By setting a preset time window, the changes in the association edges related to the account within the window are tracked, thereby generating sequence features that reflect the characteristics of the account's payment behavior. These sequence features describe the account's payment behavior patterns from different dimensions.

[0033] Step S121: Set a preset time window for the target payment account entity, wherein the preset time window is a continuous time interval to be analyzed.

[0034] Set a preset time window for the payment account entity, such as a continuous time interval from 00:00:00 on the first day of a certain month to 24:59:59 on the last day of that month. This time window covers a complete month and can comprehensively reflect the account's payment behavior within a month, making it easier to detect potential cyclical risk behaviors.

[0035] Step S122: Locate the target payment account entity in the payment data association graph, and extract all transaction object association edges and payment channel association edges associated with the target payment account entity within the preset time window.

[0036] In the constructed payment data association graph, the payment account entity is precisely located using the account identifier attribute. Then, within a preset time window, all transaction object association edges and payment channel association edges associated with this account entity are filtered out. These association edges are those where payment transactions have occurred within the time window, and each association edge carries information such as the corresponding transaction time, transaction object, or payment channel. For example, the extracted transaction object association edges include those associated with e-commerce merchants, catering service merchants, etc., and the payment channel association edges include those associated with platform-built-in payment channels, bank online banking payment channels, etc.

[0037] Step S123: Sort the extracted transaction object association edges according to the time sequence of payment transactions to generate a transaction object association edge sequence. Generate transaction object sequence features based on the changes of transaction object entities in the transaction object association edge sequence. The transaction object sequence features include the order of occurrence and the number of consecutive occurrences of transaction object entities.

[0038] The extracted transaction object association edges are processed to generate sequence features that reflect changes in transaction objects, which helps to analyze the account's behavioral patterns in transaction object selection.

[0039] Step S1231: Extract the timestamp information of the payment transaction from the associated edges of the transaction object, and sort the associated edges of the transaction object in ascending order of the timestamp information to obtain an ordered sequence of associated edges of the transaction object.

[0040] Each edge associated with a transaction contains a timestamp accurate to the millisecond when the payment transaction occurred. The timestamps are extracted from these edges, and then all edges are arranged in ascending order of their timestamps, i.e., in chronological order of the transactions, forming an ordered sequence of edges. For example, an edge with an earlier timestamp is placed earlier in the sequence, another with a later timestamp is placed later, and so on, ensuring the sequence strictly follows the chronological order of the transactions.

[0041] Step S1232: Traverse the sequence of edges associated with the transaction objects, record the position index of each transaction object entity in the sequence, and mark the transaction object entities of adjacent transaction objects as continuous transaction segments when the transaction object entities of the associated edges are the same.

[0042] The sorted sequence of associated edges of transaction objects is traversed, and each position in the sequence is assigned an index value, incrementing sequentially from the first element. Simultaneously, the position index of each transaction object entity within the sequence is recorded. During traversal, the transaction object entities corresponding to adjacent edges are compared. If they are the same, the positions of these two edges are marked as part of a continuous transaction segment. As traversal continues, if subsequent adjacent edges still correspond to the same transaction object entities, they are included in the continuous transaction segment until different transaction object entities appear, at which point the continuous transaction segment ends.

[0043] Step S1233: Count the number of associated edges of the transaction object contained in each continuous transaction segment as the number of consecutive occurrences, and store the number of consecutive occurrences as associated with the transaction object entity corresponding to the continuous transaction segment.

[0044] For each marked consecutive transaction segment, the number of transaction object association edges contained in the segment is counted. This number represents the consecutive occurrences of the transaction object entity in that segment. This consecutive occurrence count is then associated with and stored as a corresponding transaction object entity. For example, if a consecutive transaction segment contains several transaction object association edges, and the corresponding transaction object entity is an e-commerce retailer, then the consecutive occurrence counts are associated with and stored as the e-commerce retailer entity, facilitating rapid retrieval of this information during subsequent feature extraction.

[0045] Step S1234: Extract the transaction object entities according to the order of the transaction object associated edge sequence to form a transaction object entity list, and use the transaction object entity list as the order in which the transaction object entities appear.

[0046] Following the sequential order of the associated edges of the sorted transaction objects, the transaction object entities corresponding to each associated edge are extracted one by one. These entities are then arranged in order to form a list, which represents the order in which the transaction object entities appear. For example, if the transaction object entity corresponding to the first associated edge in the sequence is a food service merchant, the second is an e-commerce merchant, and the third is also an e-commerce merchant, then the resulting list of transaction object entities would be [food service merchant, e-commerce merchant, e-commerce merchant, ...]. This list visually demonstrates the changing order of the transaction object entities over time.

[0047] Step S1235: Combine the order of occurrence of the transaction object entities and the number of consecutive occurrences of each transaction object entity to generate transaction object sequence features.

[0048] The sequence of occurrences of transaction entities is combined with the number of consecutive occurrences of each entity in a continuous transaction segment to form a transaction entity sequence feature. For example, the occurrence sequence list is [food service merchants, e-commerce merchants, e-commerce merchants, public service institutions, ...], where food service merchants appear once consecutively, e-commerce merchants appear twice consecutively, public service institutions appear once consecutively, and so on. Combining this information constitutes a transaction entity sequence feature that comprehensively reflects the changes in transaction entities.

[0049] Step S124: Sort the extracted payment channel association edges according to the time sequence of payment transactions to generate a payment channel association edge sequence. Generate payment channel sequence features based on the changes of payment channel entities in the payment channel association edge sequence. The payment channel sequence features include the order of appearance and switching frequency of payment channel entities.

[0050] The extracted payment channel association edges are processed to generate payment channel sequence features, in order to analyze the behavioral patterns of accounts in payment channel selection and switching.

[0051] Step S1241: Extract the timestamp information of the payment transaction from the payment channel associated edges, and sort the payment channel associated edges in ascending order of timestamp information to obtain an ordered sequence of payment channel associated edges.

[0052] Similar to handling transaction object association edges, timestamp information is extracted from payment channel association edges. These edges are then sorted in ascending order of timestamps to form an ordered sequence. For example, an earlier timestamp for one payment channel association edge is placed at the beginning of the sequence, while a later timestamp is placed at the end, ensuring the sequence is arranged according to the order in which transactions occurred.

[0053] Step S1242: Extract payment channel entities according to the order of the payment channel associated edge sequence to form a payment channel entity list, and use the payment channel entity list as the order in which the payment channel entities appear.

[0054] Based on the sorted sequence of payment channel associated edges, extract the payment channel entity corresponding to each associated edge to form a payment channel entity list. This list represents the order in which the payment channel entities appear. For example, if the payment channel entities in the sequence are, in order, platform-built-in payment channels, online banking payment channels, etc., the resulting list would be [platform-built-in payment channels, platform-built-in payment channels, online banking payment channels, ...].

[0055] Step S1243: Traverse the list of payment channel entities, compare whether adjacent payment channel entities are the same, and mark it as a channel switching event when adjacent payment channel entities are different.

[0056] Iterate through the list of payment channel entities, comparing each adjacent entity to the previous one. If two adjacent entities are different, mark it as a channel switching event. For example, in the list [platform-built-in payment channel, platform-built-in payment channel, bank online banking payment channel, near-field quick payment channel, ...], if the second position is a platform-built-in payment channel and the third position is a bank online banking payment channel, they are different, so mark it as a channel switching event; if the third position is a bank online banking payment channel and the fourth position is a near-field quick payment channel, they are different, so mark it as another channel switching event.

[0057] Step S1244: Count the total number of channel switching events in the payment channel entity list as the switching frequency.

[0058] The total number of channel switching events marked during the traversal is the switching frequency of the payment channel. For example, if two channel switching events are marked in the list above, then the switching frequency of this payment channel sequence is 2.

[0059] Step S1245: Combine the appearance order and switching frequency of payment channel entities to generate payment channel sequence features.

[0060] By combining the order of appearance of payment channel entities with their switching frequency, a payment channel sequence feature is formed. For example, if the order of appearance is [platform-built-in payment channel, platform-built-in payment channel, bank online banking payment channel, near-field quick payment channel, ...], and the switching frequency is 2 times, combining these two elements generates a payment channel sequence feature that reflects the selection and switching of payment channels.

[0061] Step S125: Extract the payment amount data corresponding to each payment transaction of the target payment account entity within the preset time window, sort the payment amount data according to the time order of the payment transactions, generate a payment amount sequence, and use the payment amount sequence as the payment amount sequence feature.

[0062] Within a preset time window, payment amount data for each payment transaction of the payment account is extracted. This data has been preprocessed, removing specific units but retaining their relative magnitudes and trends. These payment amount data are then sorted according to the chronological order of each transaction, forming a payment amount sequence. This sequence reflects the changes in payment amounts at different points in time and serves as a characteristic feature of the payment amount sequence. For example, the sequence may exhibit a trend of first increasing, then decreasing, and then stabilizing.

[0063] Step S130: Perform risk factor extraction on the payment behavior sequence features, identify abnormal behavior segments in the payment behavior sequence features that conform to the preset risk pattern, and generate a risk factor set based on the frequency and duration of the abnormal behavior segments.

[0064] By analyzing the characteristics of payment behavior sequences, we can extract factors that may pose risks. These factors serve as an important basis for subsequent risk assessment and management.

[0065] Step S131: Preset abnormal transaction object mode, abnormal payment channel mode, and abnormal payment amount mode. The abnormal transaction object mode is the order in which transaction object entities appear, which does not conform to normal transaction habits. The abnormal payment channel mode is the frequency of payment channel entity switching that exceeds the normal range. The abnormal payment amount mode is the abnormal increase or decrease of payment amount data.

[0066] Several anomaly patterns are preset to match payment behavior sequence characteristics. Anomaly patterns for transaction objects refer to irregular and uncommon sequences of transaction objects compared to the payment account's past transaction habits. For example, an account that typically transacts with e-commerce merchants may transact with food service merchants, but an anomaly pattern might involve transacting with e-commerce merchants followed immediately by transacting with multiple unfamiliar public service institutions. Anomaly patterns for payment channels refer to a significantly higher frequency of channel switching than the account's usual average switching frequency. For example, if the account typically switches channels a few times per month, the anomaly pattern is set to a switching frequency far exceeding this average. Anomaly patterns for payment amounts refer to unusually large increases or decreases in payment amounts within a short period. For example, in several consecutive transactions, the payment amount first increases sharply and then decreases sharply, without any reasonable transaction context to support these changes.

[0067] Step S132: Match the sequence features of the trading object with the abnormal patterns of the trading object, identify the segments in the sequence features of the trading object that match the abnormal patterns of the trading object as abnormal behavior segments of the trading object, and count the frequency of occurrence of abnormal behavior segments of the trading object within a preset time window and the duration of each occurrence.

[0068] Abnormal behavior segments within the sequence features of trading objects are identified by comparing them one by one with abnormal patterns. This process requires the use of pattern matching algorithms to ensure accurate capture of segments that match abnormal patterns, and to perform detailed statistical analysis on their frequency and duration.

[0069] Step S1321: Extract the order of occurrence of transaction object entities from the transaction object sequence features, convert it into a transaction object sequence string, and represent each transaction object entity with a unique identifier.

[0070] The sequence of transaction objects is used to extract a list of their order of appearance. Each entity in the list is then replaced with its corresponding unique identifier. For example, the unique identifier for a food service merchant is CY001, for an e-commerce merchant it's DS002, and for a public service institution it's FW003. These unique identifiers are then arranged in order of appearance to form a continuous string, i.e., the transaction object sequence string. For instance, if the order of appearance is [food service merchant, e-commerce merchant, e-commerce merchant, public service institution, ...], the converted transaction object sequence string would be "CY001DS002DS002FW003...".

[0071] Step S1322: Preset a transaction object abnormality pattern library. The transaction object abnormality pattern library contains a variety of common transaction object abnormality sequence patterns. Each pattern is a specific permutation and combination of transaction object entity identifiers.

[0072] The transaction object anomaly pattern library stores various analyzed and summarized anomaly sequence patterns, derived from a large number of historical risky transaction cases. Each pattern is a string composed of specific transaction object entity identifiers arranged in a certain order. For example, the pattern library may contain a pattern like "DS002FW003FW004FW005", where FW004 and FW005 are identifiers of public service institutions that the payment account has never transacted with; it may also contain a pattern like "CY001DS003CY001DS003", where DS003 is an unfamiliar electronic retailer identifier, and this pattern exhibits an irregular alternation characteristic.

[0073] Step S1323: Use a string matching algorithm to compare the transaction object sequence string with each pattern in the transaction object abnormal pattern library. When there is a substring in the transaction object sequence string that completely matches a certain pattern, mark the position corresponding to the substring as the transaction object abnormal behavior segment.

[0074] A string matching algorithm, such as a state machine-based matching algorithm, is used to compare the transaction object sequence string with each pattern in the transaction object abnormal pattern library one by one. During the comparison process, the algorithm starts from the beginning of the transaction object sequence string and checks each possible substring to see if it completely matches a pattern in the pattern library. When a completely matching substring is found, the start and end positions of the substring in the transaction object sequence string are recorded, and this interval is marked as an abnormal behavior segment of the transaction object. For example, if a substring in the transaction object sequence string completely matches the pattern "DS002FW003FW004FW005", then the position of the substring is marked as an abnormal behavior segment.

[0075] Step S1324: Record the start and end positions of each transaction object's abnormal behavior fragment in the transaction object sequence string, calculate the number of transaction object entities contained in the abnormal behavior fragment based on the start and end positions, and calculate the duration in combination with the transaction time interval.

[0076] For each identified abnormal behavior segment of a transaction object, its start and end indexes within the transaction object sequence string are precisely recorded. The number of transaction object entities contained in the segment can be calculated by subtracting the start index from the end index and adding 1. Simultaneously, based on the timestamp information of the associated edges of the transaction objects corresponding to the segment, the time interval between the first and last transactions in the segment is calculated; this time interval is the duration of the abnormal behavior segment. For example, if an abnormal behavior segment has a start index of 5, an end index of 8, and contains 4 transaction object entities, the interval between the timestamps of the first and last transactions is the duration of the segment.

[0077] Step S1325: Count the total number of abnormal behavior segments of trading objects within the preset time window as the occurrence frequency, and save the occurrence frequency and duration of each abnormal behavior segment of trading objects.

[0078] Within a preset time window, the occurrence frequency is calculated by counting all marked abnormal behavior segments of trading objects. Simultaneously, a separate record is created for each abnormal behavior segment, storing its occurrence frequency (for a single segment, a frequency of 1 is recorded if it occurs once within the time window, and repeated occurrences are accumulated) and duration. For example, if three abnormal behavior segments of trading objects are marked within the preset time window, each with a different duration, the occurrence frequency and corresponding duration of each segment are recorded separately, forming a detailed abnormal segment information table.

[0079] Step S133: Match the payment channel sequence features with the payment channel abnormality pattern, identify the segments in the payment channel sequence features that match the payment channel abnormality pattern as payment channel abnormal behavior segments, and count the frequency of occurrence of payment channel abnormal behavior segments within a preset time window and the duration of each occurrence.

[0080] Referring to the method for identifying abnormal behavior fragments of transaction objects, the sequence features of payment channels are processed. First, the order of appearance of payment channel entities in the sequence features is converted into a string containing a unique identifier. Then, it is compared with the patterns in the payment channel abnormal pattern library to identify abnormal behavior fragments and count their frequency and duration.

[0081] The payment channel anomaly pattern library is based on the frequency and order of payment channel switching. For example, it includes a high-frequency switching pattern such as "ZL001YH002JC003ZL001", where ZL001, YH002, and JC003 are identifiers for different payment channels. This high-frequency switching pattern reflects the anomaly of switching between different payment channels multiple times within a short period of time. After finding substrings that match the pattern using a string matching algorithm, these are marked as payment channel anomaly behavior segments. The number of payment channel entities contained within each segment is calculated, and the duration is obtained by combining this with timestamp information. The frequency of occurrence within a preset time window is also counted.

[0082] Step S134: Match the payment amount sequence features with the payment amount abnormal pattern, identify the segments in the payment amount sequence features that match the payment amount abnormal pattern as payment amount abnormal behavior segments, and count the frequency of occurrence of payment amount abnormal behavior segments within a preset time window and the duration of each occurrence.

[0083] The identification of anomalies in payment amount sequence features follows a similar process. The payment amount anomaly pattern library contains a variety of abnormal amount change patterns, such as a drastic fluctuation pattern of "increase-decrease-increase", or a pattern of sudden large changes after a long period of stability.

[0084] The payment amount sequence is converted into a feature string that reflects its changing trend. For example, specific characters are used to represent the direction and magnitude of the increase or decrease in the amount. Then, it is matched against patterns in a payment amount anomaly pattern library. When a matching segment is found, it is marked as a payment amount anomaly behavior segment. The number of transactions contained in the segment is calculated, the duration is calculated by combining the transaction timestamps, and the frequency of occurrence within a preset time window is counted.

[0085] Step S135: Generate an abnormal correlation factor for the transaction object based on the frequency and duration of abnormal behavior segments of the transaction object, generate an abnormal switching factor for the payment channel based on the frequency and duration of abnormal behavior segments of the payment channel, generate an abnormal fluctuation factor for the payment amount based on the frequency and duration of abnormal behavior segments of the payment amount, and combine the abnormal correlation factor for the transaction object, the abnormal switching factor for the payment channel, and the abnormal fluctuation factor for the payment amount to form a risk factor set.

[0086] The abnormal correlation factor for trading objects is generated by comprehensively considering the frequency and duration of abnormal behavior segments of trading objects. The frequency and duration are weighted, for example, the higher the frequency and the longer the duration, the higher the corresponding factor value. This factor value is used to characterize the degree of risk in terms of the correlation between trading objects.

[0087] The payment channel abnormal switching factor is determined based on the frequency and duration of abnormal behavior segments in the payment channel. It also adopts a weighted method, and the combined effect of frequency and duration determines the magnitude of the factor, reflecting the risk level in payment channel switching.

[0088] The abnormal fluctuation factor of payment amount is generated based on the frequency and duration of abnormal payment amount behavior segments and is obtained through weighted calculation. It is used to measure the risk status of payment amount fluctuation.

[0089] Combining these three factors creates a multi-dimensional risk factor set that comprehensively reflects the potential risk characteristics of a payment account in terms of transaction object, payment channel, and payment amount.

[0090] Step S140: Using the risk factors in the risk factor set as network nodes, establish directed connections based on the co-occurrence relationship and influence degree between risk factors to construct a risk factor transmission network. The directed connections include an influence strength attribute.

[0091] The factors in a risk factor set do not exist in isolation; they may have mutual influences and correlations. By constructing a risk factor transmission network, these relationships can be clearly demonstrated.

[0092] Step S141: Treat each risk factor in the risk factor set as a network node in the risk factor transmission network.

[0093] The abnormal correlation factor of trading objects, the abnormal switching factor of payment channels, and the abnormal fluctuation factor of payment amount in the risk factor set are each treated as an independent network node in the risk factor transmission network. Each node has its own unique identifier; for example, the abnormal correlation factor of trading objects node is identified as F1, the abnormal switching factor of payment channels node is identified as F2, and the abnormal fluctuation factor of payment amount node is identified as F3.

[0094] Step S142: Analyze the occurrence of risk factors in historical payment data, count the number of times any two risk factors appear simultaneously as the co-occurrence count, and consider that there is a co-occurrence relationship between the two risk factors when the co-occurrence count is greater than the preset co-occurrence threshold.

[0095] A large amount of historical payment data is retrieved, containing records of risk factors occurring in different payment accounts. For any two risk factors in the risk factor set, such as F1 and F2, the historical data is traversed to count the number of times F1 and F2 are simultaneously extracted within the same time window, i.e., the co-occurrence count. A preset co-occurrence threshold is established, determined based on the co-occurrence frequency of risk factors under normal transaction conditions in historical data. When the co-occurrence count of two risk factors exceeds the preset threshold, a co-occurrence relationship is determined between the two risk factors. For example, if the co-occurrence count of F1 and F2 is a certain number, and the preset co-occurrence threshold is also a certain number, and the former is greater than the latter, then F1 and F2 are considered to have a co-occurrence relationship.

[0096] Step S143: For two risk factors that have a co-occurrence relationship, determine the direction of influence between the two risk factors. When the probability that the second risk factor appears after the first risk factor appears is greater than the probability that the first risk factor appears after the second risk factor appears, the direction of influence is determined to be from the first risk factor to the second risk factor.

[0097] For two risk factors that co-occur, such as F1 and F2, analyze their chronological order of appearance in historical data. Calculate the proportion of occurrences where F2 appears after F1, out of all co-occurrences; this is the probability that F1 causes F2. Simultaneously, calculate the proportion of occurrences where F1 appears after F2, out of all co-occurrences; this is the probability that F2 causes F1. When the probability that F1 causes F2 is greater than the probability that F2 causes F1, determine the direction of influence between these two risk factors as F1 to F2. For example, if the probability of F2 occurring after F1 is A, and the probability of F1 occurring after F2 is B, then if A > B, the direction of influence is F1 - F2.

[0098] Step S144: Calculate the degree of influence of two risk factors that have a co-occurrence relationship. The degree of influence is determined based on the ratio of the number of co-occurrences to the total number of occurrences of each of the two risk factors. The higher the proportion of co-occurrences, the greater the degree of influence.

[0099] For two risk factors that co-occur and whose direction of influence is known, such as F1 and F2, the direction of influence is F1-F2. Calculate the ratio of the number of co-occurrences of F1 and F2 to the total number of occurrences of F1, denoted as ratio 1; calculate the ratio of the number of co-occurrences to the total number of occurrences of F2, denoted as ratio 2. Averaging these two ratios yields the degree of influence of F1 on F2. For example, if the number of co-occurrences is C, the total number of occurrences of F1 is T1, and the total number of occurrences of F2 is T2, then ratio 1 is C / T1, ratio 2 is C / T2, and the degree of influence is (ratio 1 + ratio 2) / 2. The larger this value, the more significant the influence of F1 on F2.

[0100] Step S145: Establish a directed connection edge between the two risk factor nodes that determine the direction of influence, and use the degree of influence as the influence strength attribute of the directed connection edge. The value range of the influence strength attribute is 0 to 1.

[0101] Based on the determined direction of influence, a directed connection edge is established between the corresponding two risk factor nodes. For example, if the direction of influence is F1-F2, then a directed connection edge is established between nodes F1 and F2, pointing from F1 to F2. The calculated degree of influence is used as the influence strength attribute of this directed connection edge. Since the degree of influence is calculated as a ratio, its value naturally falls between 0 and 1. For example, if the degree of influence of F1 on F2 is 0.6, then the influence strength attribute value of this directed connection edge is 0.6.

[0102] Through the above steps, a complete risk factor transmission network is constructed. The network contains multiple risk factor nodes and directed connections between nodes. Each edge has an influence strength attribute, clearly showing the transmission relationship and degree of influence between risk factors.

[0103] Step S150: Calculate the risk diffusion index based on the node status and the influence strength attribute of the directed connection edge of the risk factor transmission network, and generate the risk perception result and risk handling instruction of the payment account according to the risk diffusion index and the network structure of the risk factor transmission network.

[0104] By utilizing the constructed risk factor transmission network, the diffusion of risk within the network is analyzed, the risk diffusion index is calculated, and the final risk perception result and corresponding handling instructions are generated by combining the network structure characteristics.

[0105] For example, step S151: Set an initial state value for each network node in the risk factor transmission network. When the risk factor is extracted in the current payment behavior sequence features, the initial state value is 1, otherwise it is 0.

[0106] Check whether each risk factor in the current payment behavior sequence features has been extracted. For each network node in the risk factor transmission network, if the corresponding risk factor exists in the currently analyzed payment behavior sequence features, set the initial state value of that node to 1; otherwise, set the initial state value to 0. For example, if the abnormal correlation factor F1 of the transaction object and the abnormal fluctuation factor F3 of the payment amount are extracted from the current payment behavior sequence features, then the initial state values ​​of nodes F1 and F3 are 1, and the initial state value of node F2 is 0.

[0107] Step S152: Starting from the network node with an initial state value of 1, calculate the spread of risk in the network according to the direction of the directed connection edges. The spread value of each network node is equal to the sum of the products of the spread values ​​of the starting nodes of all directed connection edges pointing to that network node and the influence strength attribute of the corresponding directed connection edges.

[0108] Starting with a network node whose initial state value is 1, the risk diffusion in the network is calculated step by step according to the direction of the directed edges. For each node in the network, the diffusion value is calculated as the product of the diffusion values ​​of the starting nodes of all directed edges pointing to that node and the influence strength attribute of the corresponding edge.

[0109] For example, suppose there are nodes F1, F2, and F3 in the network, with initial state values ​​F1 = 1 and F3 = 1. There are directed edges F1-F2 (influence strength 0.6), F3-F2 (influence strength 0.5), and F1-F3 (influence strength 0.3).

[0110] First, calculate the first round of diffusion: the diffusion value of F1 is the initial state value 1; the diffusion value of F3 is the initial state value 1; the diffusion value of F2 is the diffusion value of F1 (1) multiplied by the influence intensity of F1-F2 (0.6) plus the diffusion value of F3 (1) multiplied by the influence intensity of F3-F2 (0.5), that is, 1×0.6+1×0.5=1.1.

[0111] Then the second round of diffusion is carried out: the diffusion value of F1 is still 1 (no other nodes point to it); the diffusion value of F3 is the diffusion value of F1 (1) multiplied by the influence strength of F1-F3 (0.3), that is, 1×0.3=0.3, plus its own initial state value of 1, at this time the diffusion value of F3 is 1+0.3=1.3; the diffusion value of F2 is the diffusion value of F1 (1)×0.6+F3's new diffusion value (1.3)×0.5=0.6+0.65=1.25.

[0112] Multiple rounds of diffusion calculations are performed until the diffusion values ​​at each node stabilize and no longer change significantly.

[0113] Step S153: Add up the diffusion values of all network nodes to obtain the risk diffusion index. The larger the risk diffusion index, the wider the scope and deeper the degree of risk diffusion in the risk factor conduction network.

[0114] When the diffusion values of each node in the network are stable, sum up the diffusion values of all network nodes, and the obtained sum is the risk diffusion index. For example, after multiple rounds of calculation, the diffusion value of F1 is 1, the diffusion value of F2 is 1.25, and the diffusion value of F3 is 1.3. The risk diffusion index is 1 + 1.25 + 1.3 = 3.55. This risk diffusion index comprehensively reflects the diffusion scope and depth of risk in the entire network. The larger the index, the more extensive and in-depth the impact of the risk.

[0115] Step S154: Determine the risk level characteristics according to the size of the risk diffusion index. Preset multiple risk level thresholds, and different risk levels correspond to different threshold intervals when the risk diffusion index is in different intervals.

[0116] Preset multiple risk level thresholds, which are determined based on the handling experience of historical risk events and the risk tolerance. For example, the preset threshold intervals are [0, A), [A, B), [B, C), [C, +∞), corresponding to the four risk levels of low risk, medium-low risk, medium-high risk, and high risk respectively. Compare the calculated risk diffusion index with these thresholds to determine the interval it belongs to, so as to obtain the corresponding risk level characteristics. For example, the risk diffusion index is 3.55. If B < 3.55 < C, the corresponding risk level characteristic is medium-high risk.

[0117] Step S155: Trace the network nodes with an initial state value of 1 in the risk factor conduction network, take the risk factors corresponding to the network nodes as risk sources, and extract the type, occurrence frequency, and duration of the risk sources as the risk factor traceability characteristics.

[0118] In the risk factor conduction network, search for network nodes with an initial state value of 1. The risk factors corresponding to these nodes are the starting points of risk diffusion, that is, risk sources. For each risk source, extract its type (such as abnormal association factor of trading objects, abnormal switching factor of payment channels, etc.), occurrence frequency in the current payment behavior sequence characteristics (i.e., the frequency counted in Step S1325, etc.), and duration (i.e., the duration calculated in Step S1325, etc.). Combine this information to form the risk factor traceability characteristics. For example, the risk source is F1 (abnormal association factor of trading objects), its occurrence frequency within the preset time window is several times, and the duration of each occurrence is several time periods. After integrating this information, it constitutes the risk factor traceability characteristics corresponding to this risk source.

[0119] Step S156: Generate risk disposal instructions based on risk level characteristics and risk factor source traceability characteristics. Different risk level characteristics correspond to different risk control measures. Combine the risk level characteristics, risk factor source traceability characteristics and risk control measures to generate the final risk perception result and risk disposal instructions.

[0120] Based on the risk level characteristics, a pre-defined risk control system is matched. For example, when the risk level characteristics correspond to low risk, the corresponding risk control measures could be to increase the frequency of transaction monitoring for the payment account and track changes in subsequent payment behavior in real time; when the risk level characteristics correspond to medium risk, the risk control measures could be to temporarily restrict some high-risk payment functions of the account, such as large-amount transfers and cross-border payments, and send risk warning information to the contact information linked to the account; when the risk level characteristics correspond to high risk, the risk control measures could be to suspend all payment transaction operations of the account and notify the financial institution to which the account belongs for manual verification.

[0121] The risk level characteristics, risk factor tracing characteristics, and corresponding risk control measures are integrated to form the final risk perception result and risk handling instructions. The risk perception result clearly presents key information such as the current risk level of the payment account, the main types of risk sources, the frequency of occurrence of risk sources, and the duration of duration. The risk handling instructions clearly specify the specific risk control operations to be taken, including the target, method, and execution time limit. For example, the final risk perception result may show that the account is at a medium risk level, the risk source is the abnormal switching factor of payment channels, the frequency of occurrence is several times, and the cumulative duration is several time periods; the corresponding risk handling instructions may be to suspend the cross-border payment function of the account, monitor the account transactions once an hour, and send risk warning information to the encrypted contact information linked to the account, prompting the user to verify the recent payment channel usage.

[0122] Figure 2 illustrates a schematic diagram of exemplary hardware and software components of a potential risk intelligent perception system 100 that integrates big data payment data to implement the ideas of this application, according to some embodiments of this application. For example, processor 120 can be used in the potential risk intelligent perception system 100 that integrates big data payment data and to perform the functions in this application.

[0123] The potential risk intelligent perception system 100, which integrates big data payment data, can be a general-purpose server or a special-purpose server; both can be used to implement the potential risk intelligent perception method integrating big data payment data of this application. Although only one server is shown in this application, for convenience, the functions described in this application can be implemented in a distributed manner on multiple similar platforms to balance the processing load.

[0124] For example, the potential risk intelligent sensing system 100 integrating big data payment data may include a network port 110 connected to a network, one or more processors 120 for executing program instructions, a communication bus 130, and various forms of storage media 140, such as a disk, ROM, or RAM, or any combination thereof. Exemplarily, the potential risk intelligent sensing system 100 integrating big data payment data may also include program instructions stored in ROM, RAM, or other types of non-transitory storage media, or any combination thereof. The methods of this application can be implemented according to these program instructions. The potential risk intelligent sensing system 100 integrating big data payment data also includes an I / O interface 150 between the computer and other input / output devices.

[0125] For ease of explanation, only one processor is described in the potential risk intelligent perception system 100 that integrates big data payment data. However, it should be noted that the potential risk intelligent perception system 100 that integrates big data payment data in this application may also include multiple processors. Therefore, the steps performed by one processor as described in this application may also be performed jointly by multiple processors or individually. For example, if the processor of the potential risk intelligent perception system 100 that integrates big data payment data performs steps A and B, it should be understood that steps A and B may also be performed jointly by two different processors or individually by one processor. For example, the first processor performs step A, the second processor performs step B, or the first processor and the second processor jointly perform steps A and B.

[0126] Furthermore, this embodiment of the invention also provides a readable storage medium, wherein computer-executable instructions are preset in the readable storage medium, and when the processor executes the computer-executable instructions, the above-mentioned method for intelligent perception of potential risks by integrating big data payment data is realized.

[0127] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A method for intelligently perceiving potential risks by integrating big data payment data, characterized in that, The method includes: constructing a payment data association graph of big data payment data, wherein the payment data association graph includes payment account entities, transaction object entities, and payment channel entities, and the entities in the payment data association graph establish association edges through payment transaction relationships, wherein the association edges include transaction frequency attributes and transaction continuity attributes; generating payment behavior sequence features of payment accounts based on the payment data association graph, wherein the payment behavior sequence features are generated by tracking the change sequence of association edges of payment account entities within a preset time window, and the payment behavior sequence features include transaction object sequence features, payment channel sequence features, and payment amount sequence features; performing a risk factor extraction operation on the payment behavior sequence features, identifying abnormal behavior segments in the payment behavior sequence features that conform to a preset risk pattern, and determining the frequency of occurrence of abnormal behavior segments. A risk factor set is generated based on the duration of the risk factor set. Using the risk factors in the set as network nodes, directed connections are established based on the co-occurrence relationships and influence levels between the risk factors to construct a risk factor transmission network. Each directed connection contains an influence strength attribute. A risk diffusion index is calculated based on the node states of the risk factor transmission network and the influence strength attributes of the directed connections. Based on the risk diffusion index and the network structure of the risk factor transmission network, a risk perception result and risk handling instructions for the payment account are generated. The risk diffusion index is calculated starting from a network node with an initial state value of 1, and the diffusion of risk in the network is calculated according to the direction of the directed connections. The diffusion value of each network node is equal to the sum of the products of the diffusion values ​​of the starting nodes of all directed connections pointing to that network node and the influence strength attribute of the corresponding directed connection.

2. The method for intelligent perception of potential risks by integrating big data payment data according to claim 1, characterized in that, The construction of a payment data association graph of big data payment data includes: extracting payment account information from the big data payment data; creating payment account entities based on the payment account information, with each payment account entity having a unique account identifier attribute and account type attribute; extracting transaction object information from the big data payment data; creating transaction object entities based on the transaction object information, with each transaction object entity having a unique object identifier attribute and object category attribute; extracting payment channel information from the big data payment data; creating payment channel entities based on the payment channel information, with each payment channel entity having a unique channel identifier attribute and channel type attribute; identifying the payment transaction relationship between payment account entities and transaction object entities; and when a payment account entity performs a payment operation on a transaction object entity, the transaction relationship between the two entities is identified. Establish association edges between entities, and mark these association edges as transaction object association edges; identify the payment transaction relationship between payment account entities and payment channel entities. When a payment account entity performs a payment operation through a payment channel entity, establish an association edge between the two entities, and mark this association edge as a payment channel association edge; count the number of payment transactions corresponding to the transaction object association edge within a preset time period as a transaction frequency attribute, and count the number of consecutive transaction days as a transaction continuity attribute, adding the transaction frequency attribute and transaction continuity attribute to the corresponding transaction object association edge; count the number of payment transactions corresponding to the payment channel association edge within a preset time period as a transaction frequency attribute, and count the number of consecutive usage days as a transaction continuity attribute, adding the transaction frequency attribute and transaction continuity attribute to the corresponding payment channel association edge.

3. The method for intelligently perceiving potential risks by integrating big data payment data according to claim 1, characterized in that, The step of generating payment behavior sequence features of a payment account based on the payment data association graph includes: setting a preset time window for the target payment account entity, wherein the preset time window is a continuous time interval to be analyzed; locating the target payment account entity in the payment data association graph, and extracting all transaction object association edges and payment channel association edges associated with the target payment account entity within the preset time window; sorting the extracted transaction object association edges according to the time order of payment transactions to generate a transaction object association edge sequence, and generating transaction object sequence features based on the changes in transaction object entities in the transaction object association edge sequence, wherein the transaction object sequence features include the order of occurrence and the number of consecutive occurrences of transaction object entities; sorting the extracted payment channel association edges according to the time order of payment transactions to generate a payment channel association edge sequence, and generating payment channel sequence features based on the changes in payment channel entities in the payment channel association edge sequence, wherein the payment channel sequence features include the order of occurrence and the switching frequency of payment channel entities; extracting payment amount data corresponding to each payment transaction of the target payment account entity within the preset time window, sorting the payment amount data according to the time order of payment transactions to generate a payment amount sequence, and using the payment amount sequence as the payment amount sequence feature.

4. The method for intelligently perceiving potential risks by integrating big data payment data according to claim 3, characterized in that, The step of sorting the extracted transaction object association edges according to the time sequence of payment transactions to generate a transaction object association edge sequence, and generating transaction object sequence features based on the changes in transaction object entities in the transaction object association edge sequence, includes: extracting the timestamp information of payment transactions from the transaction object association edges; sorting the transaction object association edges in ascending order of timestamp information to obtain an ordered transaction object association edge sequence; traversing the transaction object association edge sequence, recording the position index of each transaction object entity in the sequence, and marking consecutive transaction segments when the transaction object entities of adjacent transaction object association edges are the same; counting the number of transaction object association edges contained in each consecutive transaction segment as the consecutive occurrence count, and associating the consecutive occurrence count with the transaction object entity corresponding to the consecutive transaction segment; extracting transaction object entities according to the order of the transaction object association edge sequence to form a transaction object entity list, and using the transaction object entity list as the occurrence order of the transaction object entities; and combining the occurrence order of the transaction object entities and the consecutive occurrence count corresponding to each transaction object entity to generate transaction object sequence features.

5. The method for intelligently perceiving potential risks by integrating big data payment data according to claim 3, characterized in that, The process of sorting the extracted payment channel association edges according to the time sequence of payment transactions to generate a payment channel association edge sequence, and generating payment channel sequence features based on the changes in payment channel entities in the payment channel association edge sequence, includes: extracting the timestamp information of payment transactions from the payment channel association edges; sorting the payment channel association edges according to the ascending order of the timestamp information to obtain an ordered payment channel association edge sequence; extracting payment channel entities according to the order of the payment channel association edge sequence to form a payment channel entity list, and using the payment channel entity list as the order of appearance of payment channel entities; traversing the payment channel entity list and comparing whether adjacent payment channel entities are the same, and marking a channel switching event when adjacent payment channel entities are different; counting the total number of channel switching events in the payment channel entity list as the switching frequency; and combining the order of appearance of payment channel entities and the switching frequency to generate payment channel sequence features.

6. The method for intelligent perception of potential risks by integrating big data payment data according to claim 1, characterized in that, The process involves performing risk factor extraction on the payment behavior sequence features, identifying abnormal behavior segments that conform to a preset risk pattern, and generating a risk factor set based on the frequency and duration of these abnormal behavior segments. This set includes preset abnormal transaction object patterns, abnormal payment channel patterns, and abnormal payment amount patterns. The abnormal transaction object pattern is defined as the order in which transaction object entities appear, which does not conform to normal transaction habits. The abnormal payment channel pattern is defined as the frequency of payment channel entity switching, which exceeds the normal range. The abnormal payment amount pattern is defined as abnormal increases or decreases in payment amount data. The process also involves matching the transaction object sequence features with the abnormal transaction object patterns, identifying segments that conform to these patterns as abnormal transaction object behavior segments, and statistically analyzing the frequency and duration of each occurrence of these abnormal transaction object behavior segments within a preset time window. Finally, the process involves matching the payment channel sequence features with the abnormal payment channel patterns. Segments in the payment channel sequence features that conform to the payment channel abnormality pattern are identified as payment channel abnormality behavior segments. The frequency of occurrence of these segments and the duration of each occurrence are statistically analyzed within a preset time window. Payment amount sequence features are matched with payment amount abnormality patterns to identify segments in the payment amount sequence features that conform to the payment amount abnormality pattern as payment amount abnormality behavior segments. The frequency of occurrence of these segments and the duration of each occurrence are statistically analyzed within a preset time window. Based on the frequency and duration of the transaction object abnormality behavior segments, a transaction object abnormality correlation factor is generated. Based on the frequency and duration of the payment channel abnormality behavior segments, a payment channel abnormality switching factor is generated. Based on the frequency and duration of the payment amount abnormality behavior segments, a payment amount abnormality volatility factor is generated. The transaction object abnormality correlation factor, payment channel abnormality switching factor, and payment amount abnormality volatility factor are combined to form a risk factor set.

7. The method for intelligent perception of potential risks by integrating big data payment data according to claim 6, characterized in that, The process of matching transaction object sequence features with transaction object anomaly patterns, identifying segments in the transaction object sequence features that match the transaction object anomaly patterns as transaction object anomaly behavior segments, and statistically analyzing the frequency of occurrence and duration of each occurrence of transaction object anomaly behavior segments within a preset time window includes: extracting the occurrence order of transaction object entities from the transaction object sequence features, converting it into a transaction object sequence string, with each transaction object entity represented by a unique identifier; pre-setting a transaction object anomaly pattern library, which contains various common transaction object anomaly sequence patterns, each pattern being a specific permutation and combination of transaction object entity identifiers; and using strings... The matching algorithm compares the transaction object sequence string with each pattern in the transaction object abnormal pattern library. When a substring in the transaction object sequence string completely matches a certain pattern, the position corresponding to the substring is marked as an abnormal behavior segment of the transaction object. The algorithm records the start and end positions of each abnormal behavior segment in the transaction object sequence string, calculates the number of transaction object entities contained in the abnormal behavior segment based on the start and end positions, and calculates the duration based on the transaction time interval. The algorithm counts the total number of abnormal behavior segments of the transaction object within a preset time window as the occurrence frequency, and saves the occurrence frequency and duration of each abnormal behavior segment of the transaction object.

8. The method for intelligent perception of potential risks by integrating big data payment data according to claim 1, characterized in that, The step of constructing a risk factor transmission network by using risk factors in the risk factor set as network nodes and establishing directed connections based on the co-occurrence relationship and influence degree between risk factors includes: treating each risk factor in the risk factor set as a network node in the risk factor transmission network; analyzing the occurrence of risk factors in historical payment data, counting the number of times any two risk factors occur simultaneously as the co-occurrence count, and considering a co-occurrence relationship between the two risk factors when the co-occurrence count is greater than a preset co-occurrence threshold; determining the direction of influence between the two risk factors for the two risk factors that have a co-occurrence relationship, and determining the direction of influence from the first risk factor to the second risk factor when the probability of the second risk factor occurring after the first risk factor occurs is greater than the probability of the first risk factor occurring after the second risk factor occurs; calculating the influence degree of the two risk factors that have a co-occurrence relationship, where the influence degree is determined based on the ratio of the co-occurrence count to the total occurrence count of each of the two risk factors, with a higher proportion of the co-occurrence count indicating a greater influence degree; and establishing directed connections between the two risk factor nodes whose influence direction is determined, using the influence degree as the influence strength attribute of the directed connection edge, with the influence strength attribute ranging from 0 to 1.

9. The method for intelligently perceiving potential risks by integrating big data payment data according to claim 8, characterized in that, The calculation of the influence degree of two risk factors with a co-occurrence relationship includes: extracting the occurrence records of a first risk factor and a second risk factor with a co-occurrence relationship from historical payment data; calculating the total number of occurrences of the first risk factor in the historical payment data as the first total number of occurrences, and calculating the total number of occurrences of the second risk factor in the historical payment data as the second total number of occurrences; obtaining the co-occurrence frequency of the first risk factor and the second risk factor, i.e., the number of times they occur simultaneously; calculating the ratio of the co-occurrence frequency to the first total number of occurrences as the first influence ratio, and calculating the ratio of the co-occurrence frequency to the second total number of occurrences as the second influence ratio; taking the average of the first influence ratio and the second influence ratio as the influence degree between the first risk factor and the second risk factor; and normalizing the calculated influence degree so that its value ranges between 0 and 1. The normalization is achieved by dividing the influence degree by the largest influence degree value in the historical data.

10. A potential risk intelligent perception system integrating big data payment data, characterized in that, The device includes a processor and a memory, the memory and the processor being connected. The memory is used to store programs, instructions or code, and the processor is used to execute the programs, instructions or code in the memory to implement the intelligent risk perception method for integrating big data payment data as described in any one of claims 1-9.

Images