Suspicious transaction identification method and system for internet finance

Abstract

The present application belongs to the technical field of financial risk control, and discloses a suspicious transaction identification method and system for internet finance, which comprises the following steps: generating a complete signal stream based on user transaction flow, existing entity portrait and dendritic cell algorithm configuration parameters; generating an initial dendritic cell population state based on the dendritic cell algorithm configuration parameters; generating a final dendritic cell population state based on the complete signal stream, the initial dendritic cell population state and a previous dendritic cell population state; generating an aggregated context signal and a next cycle dendritic cell population state based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters; generating a system action instruction based on the aggregated context signal and the dendritic cell algorithm configuration parameters; and encapsulating the system action instruction, the existing entity portrait and the next cycle dendritic cell population state as a program final output. The present application can autonomously distinguish between benign behavior evolution and high-risk abnormalities, and solve the problem of alarm fatigue.

Description

Technical Field

[0001] This invention relates to the field of financial risk control technology, and more specifically, to a method and system for identifying suspicious transactions in internet finance. Background Technology

[0002] Currently, advanced methods for identifying suspicious transactions in internet finance heavily rely on entity profiling modeling technology. This technology analyzes historical transaction data to construct a baseline profile of "normal" behavior for each entity user or merchant, and then uses machine learning models to identify transactions that significantly deviate from this baseline. However, a common pain point is the phenomenon of "concept drift." In financial scenarios, a user's legitimate transaction behavior naturally evolves over time; for example, changes in lifestyle or financial habits can lead to slow but continuous changes in a user's transaction characteristics.

[0003] This gradual behavioral evolution causes pre-built static entity profiles to become ineffective. The model begins to incorrectly label entirely legitimate user behavior patterns as anomalous, leading to a significant increase in false positives. This not only severely impacts the financial service experience for legitimate users but also causes significant "alarm fatigue" for fraud analysts in the back office, consuming considerable manpower to identify transactions that are actually risk-free. The currently prevalent industry strategy of periodic model retraining is not only computationally expensive but is also essentially a lagging, passive response mechanism, unable to adapt to such non-stationary changes in a timely and proactive manner when problems occur.

[0004] In view of this, the present invention proposes a method and system for identifying suspicious transactions in Internet finance to solve the above problems. Summary of the Invention

[0005] To overcome the aforementioned deficiencies of the prior art and achieve the above objectives, the present invention provides the following technical solution: a method for identifying suspicious transactions in internet finance, comprising:

[0006] Step S1: Generate a complete signal stream based on user transaction flow, existing entity profiles, and dendritic cell algorithm configuration parameters;

[0007] Step S2: Configure parameters based on the dendritic cell algorithm to generate the initial dendritic cell population state;

[0008] Step S3: Based on the complete signal flow, the initial dendritic cell population state, and the previous dendritic cell population state, generate the final dendritic cell population state;

[0009] Step S4: Based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters, generate the aggregation context signal and the dendritic cell population state for the next cycle;

[0010] Step S5: Based on the aggregated context signal and the dendritic cell algorithm configuration parameters, generate system action commands;

[0011] Step S6: Generate suspicious transaction identification results, which include: the system action instructions for risk assessment of user transaction flows; the existing entity profile; and the dendritic cell population state for the next cycle, which is used as the previous dendritic cell population state when step S3 is executed in the next analysis cycle.

[0012] Furthermore, the implementation method of step S4 includes:

[0013] Step S4S1: Initialize the total semi-mature context value to 0.0;

[0014] Step S4S2: Initialize the total mature context value to 0.0;

[0015] Step S4S3: Initialize an empty list and name it the next cycle dendritic cell population state;

[0016] Step S4: Extract the initial cell life cycle from the dendritic cell algorithm configuration parameters;

[0017] For each cell object in the final dendritic cell population state that contains cumulative safety signal values, cumulative danger signal values, and cumulative pathogen-associated molecular pattern signal values, perform the following steps:

[0018] Steps S4 and S5: The cumulative safety signal value of the cell object is added to the total semi-mature context value;

[0019] Steps S4 and S6: The cumulative danger signal value and the cumulative pathogen-associated molecular pattern signal value of the cell object are added together and accumulated into the total maturation context value;

[0020] If the lifecycle counter of the cell object is less than or equal to 0, the following steps are executed: Step S4S7, call the reusable step to initialize a new immature cell, take the initial lifecycle of the cell as input, and obtain a new cell object; Step S4S8, add the new cell object to the dendritic cell population state list for the next cycle.

[0021] Otherwise, if the lifecycle counter of the cell object is greater than 0, then step S4S9 is executed to directly append the current cell object to the dendritic cell population state list for the next cycle.

[0022] After the loop ends, step S4S10 is executed to generate an aggregated context signal, which includes: the total semi-mature context value corresponding to the key named semi-mature context aggregate value, and the total mature context value corresponding to the key named mature context aggregate value.

[0023] Furthermore, the implementation method of step S5 includes:

[0024] Step S5S1: Extract the total semi-mature context value corresponding to the key named semi-mature context aggregation value and the total mature context value corresponding to the key named mature context aggregation value from the aggregated context signal.

[0025] Step S5S2: Calculate the sum of the total semi-mature context value and the total mature context value to obtain the total context value;

[0026] If the total context value is greater than 0, then proceed to step S5S3 to calculate the total mature context value divided by the total context value to obtain the mature context ratio; otherwise, proceed to step S5S4 to set the mature context ratio to 0.0.

[0027] Step S5: Extract the drift threshold and fraud threshold from the dendritic cell algorithm configuration parameters;

[0028] In steps S5 and S6, if the mature context ratio is greater than or equal to the fraud threshold, the system action instruction is determined to be to generate a high-priority alarm; otherwise, if the mature context ratio is greater than or equal to the drift threshold, the system action instruction is determined to be to update the existing entity profile; otherwise, the system action instruction is determined to be to indicate that no operation is required.

[0029] Furthermore, the method for reusable steps to initialize new immature cells includes: Step 1, creating a data structure named "New Cell Object"; Step 2, creating an attribute named "Lifetime Counter" in the New Cell Object and setting the value of the Lifetime Counter to the input initial lifetime of the cell; Step 3, creating an attribute named "Accumulated Safety Signal Value" in the New Cell Object and setting the value of the Accumulated Safety Signal Value to 0.0; Step 4, creating an attribute named "Accumulated Danger Signal Value" in the New Cell Object and setting the value of the Accumulated Danger Signal Value to 0.0; Step 5, creating an attribute named "Accumulated Pathogen-Associated Molecular Pattern Signal Value" in the New Cell Object and setting the value of the Accumulated Pathogen-Associated Molecular Pattern Signal Value to 0.0.

[0030] Furthermore, the implementation method of step S2 includes:

[0031] Step S2S1: Initialize an empty list and name it Initial Dendritic Cell Population State;

[0032] Step S2: Extract the cell population size and initial cell life cycle from the dendritic cell algorithm configuration parameters;

[0033] For each integer from 1 to the cell population size, the following steps are executed in a loop: Step S2S3, call the reusable step to initialize new immature cells, taking the initial life cycle of the cells as input, to obtain new cell objects; Step S2S4, append the new cell objects to the initial dendritic cell population state list.

[0034] Furthermore, the implementation method of step S3 includes:

[0035] Step S3S1: If the previous dendritic cell population state exists and is not empty, then assign the previous dendritic cell population state to the current dendritic cell population state; otherwise, assign the initial dendritic cell population state to the current dendritic cell population state.

[0036] For each classification signal vector in the complete signal stream, the following steps are executed iteratively: Step S3S2, based on the classification signal vector and the current dendritic cell population state, generate an updated dendritic cell population state; Step S3S3, rename the updated dendritic cell population state to the current dendritic cell population state, and use it as the input for the next loop.

[0037] After the loop ends, execute steps S3 and S4 to name the final current dendritic cell population state as the final dendritic cell population state.

[0038] Furthermore, the implementation methods for steps S3 and S2 include:

[0039] Step S3S2S1: Initialize an empty list and name it the updated dendritic cell population state;

[0040] For each cell object in the current dendritic cell population state, perform the following steps: Step S3S2S2, update the internal signal accumulation value and lifespan of the current cell object according to the input classification signal vector to obtain the updated cell object; Step S3S2S3, append the updated cell object to the updated dendritic cell population state list.

[0041] Furthermore, the implementation method of step S3S2S2 includes: step S3S2S2S1, extracting safety signal values, danger signal values, and pathogen-related molecular pattern signal values ​​from the classification signal vector; step

[0042] Step S3S2S2S2: Calculate the sum of the cumulative safety signal value and the cumulative safety signal value of the cell object to obtain a new cumulative safety signal value; Step S3S2S2S3: Calculate the sum of the cumulative danger signal value and the cumulative danger signal value of the cell object to obtain a new cumulative danger signal value; Step S3S2S2S4: Calculate the sum of the cumulative pathogen-related molecular pattern signal value and the cumulative pathogen-related molecular pattern signal value of the cell object to obtain a new cumulative pathogen-related molecular pattern signal value; Step S3S2S2S5: Decrement the lifecycle counter of the cell object by 1 to obtain a new lifecycle counter; Step S3S2S2S6: Create a new data structure and name it "Updated Cell Object"; Step S3S2S2S7: In the updated... In step S3S2S2S8, an attribute named "Lifetime Counter" is created in the cell object, and the value of the Lifetime Counter is set to the new Lifetime Counter; in step S3S2S2S9, an attribute named "Accumulated Safety Signal Value" is created in the updated cell object, and the value of the Accumulated Safety Signal Value is set to the new Accumulated Safety Signal Value; in step S3S2S2S10, an attribute named "Accumulated Pathogen-Associated Molecular Pattern Signal Value" is created in the updated cell object, and the value of the Accumulated Pathogen-Associated Molecular Pattern Signal Value is set to the new Accumulated Pathogen-Associated Molecular Pattern Signal Value.

[0043] A suspicious transaction identification system for internet finance, implementing the aforementioned suspicious transaction identification method for internet finance, the system comprising:

[0044] The signal module generates a complete signal stream based on user transaction flow, existing entity profiles, and dendritic cell algorithm configuration parameters.

[0045] The initial state module configures parameters based on the dendritic cell algorithm to generate the initial dendritic cell population state;

[0046] The final state module generates the final dendritic cell population state based on the complete signal flow, the initial dendritic cell population state, and the previous dendritic cell population state.

[0047] The aggregation module generates an aggregation context signal and the dendritic cell population state for the next cycle based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters.

[0048] The action command module generates system action commands based on aggregated contextual signals and dendritic cell algorithm configuration parameters.

[0049] The output module generates suspicious transaction identification results, which include: the system action instructions for risk assessment of user transaction flows; the existing entity profile; and the dendritic cell population state for the next cycle, which is used as the previous dendritic cell population state when step S3 is executed in the next analysis cycle.

[0050] The beneficial effects of the suspicious transaction identification method and system for internet finance provided by this invention are as follows:

[0051] The core value of this invention lies in its ability to generate ternary system action instructions, thereby enabling refined management of entity behavior and directly solving the "alarm fatigue" problem caused by traditional binary classifiers when facing concept drift.

[0052] Specifically, the introduction of "triggering profile updates" provides the system with a built-in, low-cost adaptive mechanism that enables the system to proactively identify and tolerate legitimate, gradual changes in user behavior, rather than misclassifying them as abnormal. This directly avoids a large number of false alarms caused by benign drift, greatly improving user experience and analyst productivity.

[0053] At the same time, the "high-priority alarm" command clearly identifies truly suspicious sudden anomalies, ensuring that security monitoring resources can be precisely focused on the highest-risk events.

[0054] Ultimately, by outputting an updated entity profile, this invention ensures the continued effectiveness of the behavioral baseline, avoids expensive and lagging periodic model retraining, and thus constructs an intelligent risk control system that can evolve with the environment and has long-term stability. Attached Figure Description

[0055] Figure 1 This is a schematic diagram of the method flow for identifying suspicious transactions in internet finance according to the present invention;

[0056] Figure 2 This is a schematic diagram of the system modules of the suspicious transaction identification system for internet finance according to the present invention;

[0057] Figure 3 This is a schematic diagram illustrating an application scenario of the suspicious transaction identification method of the present invention for internet finance. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example 1

[0060] See Figure 1 The suspicious transaction identification method for Internet finance described in this embodiment includes steps S1 to S6.

[0061] like Figure 3 The diagram illustrates an application scenario of the suspicious transaction identification method for internet finance in this embodiment. This embodiment will elaborate on the end-to-end implementation process of the concept drift adaptive decision-making framework. The entire process begins by converting the original user transaction flow into a standardized, complete signal flow that the algorithm can understand. Next, a pre-initialized virtual dendritic cell population iteratively processes this signal flow, integrating information within a set time window to form a collective evaluation of the current behavioral context. Finally, based on this aggregated evaluation result, the system generates a clear and executable system action instruction, thus completing the entire analysis and decision-making cycle.

[0062] Step S1: Generate a complete signal stream based on user transaction flow, existing entity profiles, and dendritic cell algorithm configuration parameters.

[0063] Step S1 transforms the raw, high-dimensional transaction data stream into a low-dimensional, immunologically significant contextual signal stream that can be directly processed by the Dendritic Cell Algorithm (DCA). This is the core of the entire framework's data preprocessing and feature engineering. Abstracting the complex, rule-based signal generation logic into a single deterministic matrix multiplication not only greatly improves the algorithm's engineering level and configurability but also aligns with standard mathematical models in the field of Dendritic Cell Algorithm research. In the formal model of the Dendritic Cell Algorithm, using a signal mapping weight matrix W to transform the multidimensional input signal S(t) into an internally processed signal is standard practice. The linear transformation S used in this step... output =V deviation W is a direct application of this principle. This step treats the degree of deviation between transaction features and the profile baseline (feature deviation vector) as the input signal V. deviationThrough a configurable signal mapping weight matrix, the input signal is mapped into three components: a safe signal (SS), a hazard signal (DS), and pathogen-associated molecular patterns (PAMPs). output This represents the mapping result of the input signal, providing a quantitative basis for subsequent cell state evolution.

[0064] User transaction flows originate from the core transaction processing system of financial institutions. Each transaction is captured in real time as it occurs and structured into a standardized data object. The quantification process involves serializing various attributes of the transaction (e.g., transaction amount, merchant category code, timestamp) into key-value pairs with clearly defined data types (e.g., floating-point numbers, integers, ISO 8601 standard strings), thereby ensuring a deterministic, machine-readable format for downstream processing systems.

[0065] Existing entity profiles are derived from offline batch statistical analysis of a large number of verified legitimate transaction records of a specific entity within a trusted historical period. The method for determining these profiles involves calculating the mean μ and standard deviation σ for each relevant numerical transaction feature. These statistical parameters are then stored as key-value pair objects, where the key is the feature name and the value is the corresponding {"mean": <numerical value>, "std_dev": <numerical value>} structure, thus establishing a quantitative statistical baseline for the entity's normal behavior.

[0066] The signal mapping weight matrix is ​​determined using a two-stage data-driven approach. In the first stage, feature importance analysis is performed on a labeled historical dataset, employing techniques such as information gain or tree-based feature importance scoring to identify and rank transaction features most predictive of fraudulent behavior. In the second stage, weights are assigned based on this ranking to construct matrix W. Features highly correlated with fraud are assigned high weights in the columns corresponding to danger signal values ​​and pathogen-related molecular pattern signal values, while features clearly indicating normal behavior are assigned high weights in the columns corresponding to safe signal values. This method formalizes the domain expert's experiential knowledge and the statistical regularities of historical data into a deterministic linear transformation operation.

[0067] The implementation method of step S1 includes: Step S1: Initialize an empty list and name it "Complete Signal Flow". For each new transaction in the user transaction flow, the following steps are executed cyclically: Step S1: Extract key numerical features from the new transaction and compare the extracted key numerical features with the statistical baseline of features with the same name in the existing entity profile to calculate the standardized feature deviation vector. Step S1: Extract the signal mapping weight matrix from the dendritic cell algorithm configuration parameters. Step S1: Perform matrix multiplication on the feature deviation vector and the signal mapping weight matrix to obtain the result containing the safety signal value S. SS Danger signal value S DS Pathogen-associated molecular pattern signal value S PAMP The three-component classification signal vector. Steps S1 and S5: Append the generated classification signal vector to the complete signal stream list.

[0068] To further clarify, the calculation of the classification signal vector can be expressed by the following formula:

[0069] [S SS ,S DS ,S PAMP ] = [|z1|,|z2|,...,|z n |]·W

[0070] In the formula, [S SS ,S DS ,S PAMP [] is the output classification signal vector containing three signal values; [|z1|,|z2|,...,|z] n |] is the input feature deviation vector, where |z n | is the absolute value of the Z-score standardized deviation of the nth transaction feature; while W is the signal mapping weight matrix, which is an n×3 matrix whose weight coefficients reflect the expert knowledge of financial risk control, and n is the number of transaction features.

[0071] For example, suppose the existing entity profile contains two key features: transaction amount (transaction_amount) and daily login count (daily_login_count). A new transaction record is: {transaction amount: 5000 yuan, daily login count: 10 times}; mean, the existing entity profile's statistical baseline is: {transaction amount: {mean μ = 1000, standard deviation σ = 500}, daily login count: {mean μ = 3, standard deviation σ = 1}}.

[0072] First, calculate the feature deviation vector based on the above data. The deviation of the transaction amount is |z1|=|(5000-1000) / 500|=8.0, and the deviation of the number of logins is |z2|=|(10-3) / 1|=7.0. Therefore, the feature deviation vector is [8.0,7.0].

[0073] Next, we define the signal mapping weight matrix W and explain how it correlates deviations in financial characteristics with the strength of the immune signal. For example, based on risk control experience, W is defined as follows:

[0074]

[0075] The first row of the matrix corresponds to the weight of transaction amount. When the transaction amount deviates significantly, the transaction is considered to be highly likely to be dangerous, but it could also be a sudden, normal large-amount consumption. It is unlikely to be a regular safe behavior. Therefore, its weight is highest in the "danger signal" column (0.8), followed by the "pathogen signal" column (0.4), and lowest in the "safe signal" column (0.1). The second row of the matrix corresponds to the weight of login frequency. When the number of logins increases sharply in a short period of time, it has the characteristics of both danger (possible account theft) and abnormal pattern (significantly different from normal habits). Therefore, its weight is relatively high in both the "pathogen signal" column (0.7) and the "danger signal" column (0.6).

[0076] Finally, matrix multiplication is performed to calculate the final signal value:

[0077]

[0078] The safety signal value S can be calculated. SS = (8.0 × 0.1) + (7.0 × 0.2) = 0.8 + 1.4 = 2.2; Danger signal value S DS =(8.0×0.8)+(7.0×0.6)=6.4+4.2=10.6; Pathogen-associated molecular pattern signal value S PAMP = (8.0 × 0.4) + (7.0 × 0.7) = 3.2 + 4.9 = 8.1.

[0079] In summary, this demonstrates how a specific new transaction can be transformed into a classification signal vector containing risk control significance through the above calculation steps. This vector will serve as the input for subsequent steps, thus reflecting the complete mapping process from a single transaction to three quantitative signal values ​​and its inherent logical relationship.

[0080] The complete signal stream generated in step S1 is a list, where each element is a categorical signal vector containing the security signal value S. SS Danger signal value S DS Pathogen-associated molecular pattern signal value SPAMP These three floating-point values. Logically, the complete signal stream acts as a temporally ordered record of environmental stimuli throughout the entire analysis cycle, successfully transforming the original, business-related user transaction flow into an immunologically significant signal sequence that the algorithm can directly process. The complete signal stream will serve as the core input for the subsequent step S3, undergoing iterative processing and information integration by each cell object in the current dendritic cell population state.

[0081] Before generating immunologically meaningful classification signal vectors, the heterogeneous features in each original transaction must be converted into a standardized, comparable deviation measure. Original transaction features, such as transaction amount and number of transactions, have different physical units and numerical ranges, making direct mathematical operations or comparisons impossible. Therefore, the logical intent of subsequent steps is to use Z-score normalization to convert each feature value into a dimensionless score, which uniformly represents the degree to which the current value deviates from its historical normal baseline. This conversion is a necessary prerequisite for ensuring input consistency and statistical validity in the subsequent signal generation process.

[0082] The implementation method of steps S1S2 includes: Step S1S2S1, initializing an empty vector named the feature deviation vector. For each key numerical feature defined in the existing entity profile, the following steps are executed iteratively: Step S1S2S2, extracting the current value x of the key numerical feature from the new transaction. Step S1S2S3, extracting the mean μ and standard deviation σ of the key numerical feature from the existing entity profile. Step S1S2S4, dividing the difference between the current value and the mean by the standard deviation to obtain the Z-score standardized deviation. Step S1S2S5, appending the absolute value |z| of the calculated deviation z to the feature deviation vector.

[0083] Steps S1 and S2 aim to transform the original transaction characteristics with different dimensions and distributions into a dimensionless, comparable deviation measure. Z-score standardization is a standard statistical practice. Z-score standardization quantifies the degree to which an individual data point deviates from the mean of its group, providing a stable and statistically significant input for subsequent signal generation. The formula for calculating Z-score standardized deviation is: z = (x - μ) / σ, where z represents the Z-score standardized deviation.

[0084] The feature deviation vector generated in steps S1 and S2 is a one-dimensional numerical vector, the dimension of which is equal to the total number of numerical features defined in the existing entity profile. Each element in the vector is a non-negative floating-point number. Logically, the feature deviation vector represents a quantified snapshot of the multidimensional deviation of a single new transaction from the entity's historical behavior baseline. The feature deviation vector will be used as input for subsequent matrix multiplication operations, i.e., steps S1 and S4, to generate a classification signal vector with immunological significance.

[0085] The reusable steps for initializing new immature cells include: Step 1, creating a data structure named "New Cell Object". Step 2, creating an attribute named "Lifetime Counter" in the New Cell Object and setting the value of the Lifetime Counter to the initial lifetime of the input cell. Step 3, creating an attribute named "Accumulated Safety Signal Value" in the New Cell Object and setting the value of the Accumulated Safety Signal Value to 0.0. Step 4, creating an attribute named "Accumulated Danger Signal Value" in the New Cell Object and setting the value of the Accumulated Danger Signal Value to 0.0. Step 5, creating an attribute named "Accumulated Pathogen-Associated Molecular Pattern Signal Value" in the New Cell Object and setting the value of the Accumulated Pathogen-Associated Molecular Pattern Signal Value to 0.0.

[0086] Step S2: Configure parameters based on the dendritic cell algorithm to generate the initial dendritic cell population state.

[0087] Step S2 is responsible for creating the virtual cell population required for the algorithm to run. The population size and cell lifespan are key parameters that determine the algorithm's performance. A moderately sized population can provide stable and robust collective decision-making, while the lifespan defines the time window for the algorithm to make decisions.

[0088] Cell population size is an integer hyperparameter, and its value is determined using standard sensitivity analysis methods. This method involves repeatedly running the algorithm on a fixed validation dataset with different cell population sizes (e.g., from 50 to 200, with a step size of 10) and evaluating the stability of the final output signal. The final selected value strikes an optimal balance between acceptable computational cost and robustness of the results.

[0089] The initial cell lifetime is a fixed integer hyperparameter, and its value is determined based on the business scenario's requirements for the time granularity of context evaluation. For example, if the business requires evaluating an entity's behavioral patterns over the past 24 hours, the initial cell lifetime will be set to the average number of transactions that occurred during that period. Using a fixed, uniform lifetime is a standard practice adopted by the Deterministic Dendritic Cell Algorithm (dDCA) to ensure the reproducibility and analyzability of the algorithm's behavior.

[0090] The implementation method of step S2 includes: Step S2S1, initializing an empty list and naming it the initial dendritic cell population state. Step S2S2, extracting the cell population size and initial cell lifespan from the dendritic cell algorithm configuration parameters. For each integer from 1 to the cell population size, the following steps are executed iteratively: Step S2S3, calling a reusable step to initialize new immature cells, taking the initial cell lifespan as input to obtain new cell objects. Step S2S4, appending the new cell objects to the initial dendritic cell population state list.

[0091] The initial dendritic cell population state generated in step S2 is a list containing the number of cell objects specified by the population size. Each cell object is in the same initial "immature" state, with a preset lifecycle counter and a zeroed cumulative signal value. Logically, the initial dendritic cell population state represents an unstimulated virtual sensor array used by the algorithm to sense and process environmental signals. The initial dendritic cell population state will serve as the initial input for step S3, used to begin iterative processing of the complete signal stream during the algorithm's first run.

[0092] Step S3: Based on the complete signal flow, the initial dendritic cell population state, and the previous dendritic cell population state, generate the final dendritic cell population state.

[0093] Step S3 is the core dynamic process of the dendritic cell algorithm, simulating the continuous signal stimulation and state-changing process of immune cells in the tissue environment. Through iterative processing of the signal flow, the algorithm can integrate information within a time window to form a dynamic assessment of the environmental context, rather than relying solely on instantaneous data points. This population-based iterative update mechanism endows the algorithm with natural noise filtering capabilities and the ability to process time-series data.

[0094] The previous dendritic cell population state is not an external input, but rather a state propagation mechanism. The sole source of the previous dendritic cell population state is the dendritic cell population state data object for the next cycle, output as part of the final program output after the algorithm successfully executes the previous analysis cycle. This mechanism allows the algorithm to maintain state continuity across different analysis cycles, ensuring that the context established within one cycle can be seamlessly passed on and influence the analysis of the next cycle. On the first run for a given entity, the input value for the previous dendritic cell population state is defined as non-existent or empty.

[0095] The implementation method of step S3 includes: Step S3S1, if the previous dendritic cell population state exists and is not empty, then assign the previous dendritic cell population state to the current dendritic cell population state; otherwise, assign the initial dendritic cell population state to the current dendritic cell population state. For each classification signal vector in the complete signal stream, the following steps are executed iteratively: Step S3S2, based on the classification signal vector and the current dendritic cell population state, generate an updated dendritic cell population state. Step S3S3, rename the updated dendritic cell population state to the current dendritic cell population state, and use it as the input for the next loop. After the loop ends, execute step S3S4, and name the final current dendritic cell population state as the final dendritic cell population state.

[0096] The final dendritic cell population state generated in step S3 is a list with the same structure as the initial dendritic cell population state. However, the internal state of each cell object, including the cumulative safety signal value, cumulative danger signal value, cumulative pathogen-related molecular pattern signal value, and lifecycle counter, has been updated with all signals from the complete signal stream. Logically, the final dendritic cell population state represents the collective "memory" and final assessment state of the entire cell population regarding the environmental context after processing all transaction data in this analysis cycle. The final dendritic cell population state will serve as input for the subsequent step S4, used to aggregate and calculate the macroscopic context signals.

[0097] The implementation method of step S3S2 includes: Step S3S2S1, initializing an empty list and naming it the updated dendritic cell population state. For each cell object in the current dendritic cell population state, the following steps are performed: Step S3S2S2, updating the internal signal accumulation value and lifespan of the current cell object according to the input classification signal vector to obtain the updated cell object. Step S3S2S3, appending the updated cell object to the updated dendritic cell population state list.

[0098] Steps S3 and S2 specifically implement the impact of a single signal event on the entire cell population. In the deterministic dendritic cell algorithm model, all cells receive the same input signal in parallel and equally, and update their internal states in the same way. This design simplifies computation and ensures the analyzability and reproducibility of the algorithm.

[0099] The implementation method of step S3S2S2 includes: Step S3S2S2S1, extracting safe signal values, danger signal values, and pathogen-related molecular pattern signal values ​​from the classification signal vector. Step S3S2S2S2, calculating the sum of the cumulative safe signal values ​​of the cell object to obtain a new cumulative safe signal value. Step S3S2S2S3, calculating the sum of the cumulative danger signal values ​​of the cell object to obtain a new cumulative danger signal value. Step S3S2S2S4, calculating the sum of the cumulative pathogen-related molecular pattern signal values ​​of the cell object to obtain a new cumulative pathogen-related molecular pattern signal value. Step S3S2S2S5, decrementing the lifecycle counter of the cell object by 1 to obtain a new lifecycle counter. Step S3S2S2S6, creating a new data structure named "Updated Cell Object". Step S3S2S2S7, creating an attribute named "Lifecycle Counter" in the updated cell object and setting the value of the lifecycle counter to the new lifecycle counter. Step S3S2S2S8: Create an attribute named "Cumulative Safety Signal Value" in the updated cell object and set its value to the new cumulative safety signal value. Step S3S2S2S9: Create an attribute named "Cumulative Danger Signal Value" in the updated cell object and set its value to the new cumulative danger signal value. Step S3S2S2S10: Create an attribute named "Cumulative Pathogen-Associated Molecular Pattern Signal Value" in the updated cell object and set its value to the new cumulative pathogen-associated molecular pattern signal value.

[0100] Steps S3 and S2 are atomic operations for updating the cell state. Cells integrate environmental information "sensed" during their life cycle by accumulating different types of signals. The decrementing of the life cycle counter simulates the consumption of cell survival time, ensuring that each cell integrates information only within a finite time window.

[0101] Step S4: Based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters, generate the aggregation context signal and the dendritic cell population state for the next period.

[0102] Step S4 is the core innovation of this scheme. Step S4 draws on the maturation and differentiation mechanism of dendritic cells in biological immunology. When a cell's life cycle ends, it differentiates into different states based on the proportion of signals accumulated within the cell. In this scheme, this process is innovatively modified to calculate two independent contextual signals: semi-mature context and mature context. The semi-mature context is mainly contributed by safety signals, representing the "normality" of the environment; the mature context is jointly contributed by danger signals and pathogen-related molecular pattern signals, representing the "abnormality" or "variability" of the environment. Unlike traditional dendritic cell algorithms that typically output only a single comprehensive maturity index, this scheme, by aggregating these two contextual signals separately, can more finely distinguish between "safe stability" and "dangerous change," providing richer information input for subsequent ternary decision-making. The cell death and regeneration mechanism ensures the dynamic balance of the population and continuous monitoring capabilities.

[0103] Step S4 draws inspiration from the maturation and differentiation theory of dendritic cells (DCs) in immunology, but with key innovative modifications. In the classic deterministic dendritic cell algorithm (dDCA), the algorithm typically calculates a single Mature Context Antigen Value (MCAV) for each antigen (analogous to an entity in this application) after processing all data. This value is a scalar between 0 and 1, representing the probability of an anomaly. The innovation of this approach lies in its decision not to calculate such a comprehensive anomaly score, but rather to separately calculate and aggregate the total semi-mature context value and the total mature context value. The total semi-mature context value is primarily contributed by the cumulative safety signal value, while the total mature context value is contributed by the cumulative danger signal value and the cumulative pathogen-associated molecular pattern signal value. The rationale behind this dual-context output mechanism is that it clearly decouples "safe stable states" or "benign behavioral evolution" from "dangerous mutations" at the signal level. "Safe stable states" or "benign behavioral evolution" refer to high-safety signals, generating semi-mature contexts, while "dangerous mutations" refer to high-danger / PAMP signals, generating mature contexts. This decoupling provides the necessary and richer decision-making basis for distinguishing between concept drift and real anomalies in the subsequent step S5 using ratios and dual thresholds, and is fundamental to achieving ternary decision-making.

[0104] The implementation method of step S4 includes: Step S4S1, initializing the total semi-mature context value to 0.0. Step S4S2, initializing the total mature context value to 0.0. Step S4S3, initializing an empty list and naming it the next cycle dendritic cell population state. Step S4S4, extracting the initial cell lifecycle from the dendritic cell algorithm configuration parameters. For each cell object in the final dendritic cell population state containing a cumulative safety signal value, a cumulative danger signal value, and a cumulative pathogen-related molecular pattern signal value, the following steps are performed: Step S4S5, adding the cumulative safety signal value of the cell object to the total semi-mature context value. Step S4S6, adding the cumulative danger signal value and the cumulative pathogen-related molecular pattern signal value of the cell object and adding them to the total mature context value. If the lifecycle counter of the cell object is less than or equal to 0, the following steps are performed: Step S4S7, calling a reusable step to initialize a new immature cell, using the initial cell lifecycle as input, to obtain a new cell object. Step S4S8: Append the new cell object to the dendritic cell population state list for the next cycle. Otherwise, if the cell object's lifecycle counter is greater than 0, proceed to step S4S9: directly append the current cell object to the dendritic cell population state list for the next cycle. After the loop ends, proceed to step S4S10: generate an aggregation context signal, which includes: the total semi-mature context value corresponding to the key named semi-mature context aggregation value, and the total mature context value corresponding to the key named mature context aggregation value.

[0105] The aggregated context signal generated in step S4 is a composite object containing two key-value pairs ("semi-mature context aggregate value" and "mature context aggregate value"), both of which are floating-point numbers. Logically, the aggregated context signal represents a macroscopic, aggregated assessment of the environmental context of the entire cell population during this analysis period, refining the microscopic cumulative cell signal values ​​into two overall indicators representing "safety / stability" and "danger / change." The aggregated context signal will serve as input for the subsequent step S5, used to calculate the final decision indicator, the mature context ratio.

[0106] The next-cycle dendritic cell population state generated in step S4 is a list of cell objects, whose data format is exactly the same as the final dendritic cell population state. The logical purpose of the next-cycle dendritic cell population state is to provide a "warm-start" state containing partial context information of the current cycle for the next analysis cycle. Cells whose lifecycles have expired are replaced by newly initialized cells, while the remaining cells retain their accumulated signal states. Its purpose is to ensure that when this algorithm is invoked in the next analysis cycle, the next-cycle dendritic cell population state will be used as input to the previous dendritic cell population state, thereby achieving state continuity across cycles.

[0107] Step S5: Generate system action commands based on aggregated context signals and dendritic cell algorithm configuration parameters.

[0108] Step S5 is the final decision-making module of this invention, directly realizing its core value. By introducing the mature context ratio as a key indicator, the decision no longer relies solely on the absolute strength of the danger signal, but considers the relative balance between danger and safety signals. This allows the algorithm to more effectively distinguish between genuine abnormalities and harmless behavioral pattern changes. Based on a dual threshold T... drift and T fraud The decision-making mechanism divides the one-dimensional ratio value into three semantically clear intervals, corresponding to the three system states of "normal", "drift" and "abnormal", which is the key to realizing the transformation from the traditional binary classifier to the ternary (tolerance / adaptation / alarm) adaptive system.

[0109] The drift threshold and fraud threshold are two floating-point hyperparameters ranging from [0, 1], determined through empirical analysis on labeled historical validation datasets. Fraud threshold T fraud The method for determining the threshold is as follows: By plotting Receiver Operational Characteristics (ROC) curves, the true positive rate (TPR) and false positive rate (FPR) at different thresholds are analyzed. Ultimately, the mature context ratio, which maximizes the fraud detection rate while keeping the false positive rate within an acceptable business range, is selected as the threshold. Drift threshold T drift The determination method is as follows: run the algorithm on a dataset that contains only known legitimate user behavior pattern transitions (i.e. benign concept drifts), obtain the empirical cumulative distribution function (ECDF) of mature context ratio, and select a high percentile of this distribution (e.g., 95%) as the threshold, aiming to make it sensitive enough to capture real pattern transitions while ignoring normal, small-scale behavioral fluctuations.

[0110] Step S5 uses the mature context ratio as the core decision indicator, its principle rooted in signal processing and statistical process control. Compared to relying solely on the absolute strength of the total mature context value, using the relative ratio of the total mature context value to the total context value can effectively normalize changes in the overall activity level of the system. For example, during periods of increased trading activity, the absolute values ​​of both safe and dangerous signals may rise, but their ratio more stably reflects the true "signal-to-noise ratio" of abnormal behavior. Using two independent thresholds—drift threshold and fraud threshold—to segment this ratio is a robust method for setting decision boundaries; and deterministically mapping a one-dimensional continuous indicator space to three discrete, semantically clear system action commands is a key technological achievement in realizing the transition from binary classification to ternary adaptive control.

[0111] The implementation method of step S5 includes: Step S5S1, extracting the value with the key of semi-mature context aggregation value from the aggregated context signal, as the total semi-mature context value. Step S5S2, extracting the value with the key of mature context aggregation value from the aggregated context signal, as the total mature context value. Step S5S3, calculating the sum of the total semi-mature context value and the total mature context value to obtain the total context value. If the total context value is greater than 0, then execute step S5S4, calculating the total mature context value divided by the total context value to obtain the mature context ratio. Otherwise, execute step S5S5, setting the mature context ratio to 0.0. Step S5S6, extracting the drift threshold and fraud threshold from the dendritic cell algorithm configuration parameters. If the mature context ratio is greater than or equal to the fraud threshold, then execute step S5S7, assigning the string 'high priority alarm' to the system action command. Otherwise, if the mature context ratio is greater than or equal to the drift threshold, then execute step S5S8, assigning the string 'trigger profile update' to the system action command. Otherwise, proceed to step S5S9 and assign the string 'No operation required' to the system action instruction.

[0112] The system action command generated in step S5 can take the values ​​'No operation required,' 'Trigger profile update,' or 'High-priority alarm,' respectively indicating that no operation is required, updating the existing entity profile, or generating a high-priority alarm. Logically, the system action command is the final, condensed decision conclusion reached by the algorithm for the current analysis cycle. The system action command will be included in the final program output as a command that can be directly consumed and executed by downstream business systems to drive corresponding business processes, such as maintaining monitoring, updating profiles, or issuing alarms.

[0113] Step S6 generates a suspicious transaction identification result, which includes: the system action instruction for risk assessment of user transaction flows; the existing entity profile; and the dendritic cell population state for the next cycle, used as the previous dendritic cell population state when step S3 is executed in the next analysis cycle. Specifically, the existing entity profile included in the suspicious transaction identification result is the updated existing entity profile when the system action instruction in step S5 is 'trigger profile update'; otherwise, it is the current existing entity profile.

[0114] The above implementation process constitutes a logically rigorous, end-to-end data processing and decision-making workflow. This workflow begins with the original user transaction flow, which, through a series of deterministic transformation steps, is first abstracted into a standardized feature deviation vector, thereby generating a complete signal flow with immunological significance. Subsequently, a dendritic cell population state that can maintain its state across cycles integrates this signal flow, condensing temporal information into its internal state. By aggregating the final state of the population, an aggregated contextual signal containing dual-channel information is generated. Finally, this aggregated signal is further refined into a single, semantically clear system action command. The entire data flow, from high-dimensional raw data, undergoes progressive abstraction and information refinement, ultimately converging into a discrete command that directly drives business decisions, and is encapsulated together with the existing entity profile and the next-cycle dendritic cell population state used for state transmission as the final program output.

[0115] The technical value of this implementation lies in realizing an intelligent decision-making system capable of proactively adapting to environmental changes in a fully deterministic and auditable manner. By clearly distinguishing between benign behavioral drift and high-risk sudden anomalies at the algorithmic level, this framework fundamentally solves the core pain point of high false alarm rates in traditional static models in dynamic financial environments. This capability not only significantly improves the accuracy of threat detection but also optimizes the allocation of human analysis resources through refined instruction output. Compared to static monitoring systems that cannot adapt to changes, this represents a significant technological paradigm shift.

[0116] The core innovation of this solution lies in addressing the concept drift problem in financial transactions by shifting from the traditional statistical pattern matching paradigm to a new paradigm inspired by the biological immune system, which involves dynamic contextual assessment. Instead of treating each transaction as an isolated data point to be compared with a static profile, the solution leverages the inherent information fusion and time-dependent processing capabilities of the Dendritic Cell Algorithm (DCA). Its core strategy is to abstract the continuous flow of user transactions into a series of immunologically significant internal signals (safety signals S). SS Danger signal S DS Pathogen-associated molecular pattern signaling (S) PAMPA virtual population of dendritic cells continuously processes these signals and integrates them over its finite lifespan, transforming instantaneous data points into a cumulative perception of the behavioral "context" over a period of time. The key breakthrough of this approach lies in its ability to clearly distinguish between two different contexts by computing an aggregated context signal: a "semi-mature context" dominated by high-intensity safety signals, representing benign behavioral evolution or a stable state; and a "mature context" dominated by high-intensity danger signals, representing potential anomalies. This fine decoupling of contexts allows the system to make "tolerance," "adaptation," or "alarm" decisions based on a ternary system action command, fundamentally solving the problem that static models cannot distinguish between benign drift and malicious attacks.

[0117] Example 2

[0118] See Figure 2 As shown, this embodiment provides a suspicious transaction identification system for internet finance, the system including:

[0119] The signal module generates a complete signal stream based on user transaction flow, existing entity profiles, and dendritic cell algorithm configuration parameters.

[0120] The initial state module configures parameters based on the dendritic cell algorithm to generate the initial dendritic cell population state;

[0121] The final state module generates the final dendritic cell population state based on the complete signal flow, the initial dendritic cell population state, and the previous dendritic cell population state.

[0122] The aggregation module generates an aggregation context signal and the dendritic cell population state for the next cycle based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters.

[0123] The action command module generates system action commands based on aggregated contextual signals and dendritic cell algorithm configuration parameters.

[0124] The output module generates suspicious transaction identification results, which include: the system action instructions for risk assessment of user transaction flows; the existing entity profile; and the dendritic cell population state for the next cycle, which is used as the previous dendritic cell population state when step S3 is executed in the next analysis cycle.

[0125] For any parts not mentioned in this application, existing technologies may be used or referenced.

[0126] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0127] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying suspicious transactions in internet finance, characterized in that, include: Step S1: Generate a complete signal stream based on user transaction flow, existing entity profiles, and dendritic cell algorithm configuration parameters; Step S2: Configure parameters based on the dendritic cell algorithm to generate the initial dendritic cell population state; Step S3: Based on the complete signal flow, the initial dendritic cell population state, and the previous dendritic cell population state, generate the final dendritic cell population state; the implementation method of step S3 includes: Step S3S1: If the previous dendritic cell population state exists and is not empty, then assign the previous dendritic cell population state to the current dendritic cell population state; otherwise, assign the initial dendritic cell population state to the current dendritic cell population state. For each classification signal vector in the complete signal stream, perform the following steps: Step S3S2, generate an updated dendritic cell population state based on the classification signal vector and the current dendritic cell population state; Step S3S3, rename the updated dendritic cell population state to the current dendritic cell population state, and use it as the input for the next loop. After the loop ends, execute steps S3 and S4 to name the final current dendritic cell population state as the final dendritic cell population state. Step S4: Based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters, generate the aggregation context signal and the dendritic cell population state for the next cycle; Step S5: Based on the aggregated context signal and the dendritic cell algorithm configuration parameters, generate system action commands; Step S6: Generate suspicious transaction identification results, which include: the system action instructions for risk assessment of user transaction flows; the existing entity profile; and the next cycle dendritic cell population state, which is used as the previous dendritic cell population state when step S3 is executed in the next analysis cycle.

2. The method for identifying suspicious transactions in internet finance according to claim 1, characterized in that, The implementation method of step S4 includes: Step S4S1: Initialize the total semi-mature context value to 0.0; Step S4S2: Initialize the total mature context value to 0.0; Step S4S3: Initialize an empty list and name it the next cycle dendritic cell population state; Step S4: Extract the initial cell life cycle from the dendritic cell algorithm configuration parameters; For each cell object in the final dendritic cell population state that contains cumulative safety signal values, cumulative danger signal values, and cumulative pathogen-associated molecular pattern signal values, perform the following steps: Steps S4 and S5: The cumulative safety signal value of the cell object is added to the total semi-mature context value; Steps S4 and S6: The cumulative danger signal value and the cumulative pathogen-associated molecular pattern signal value of the cell object are added together and accumulated into the total maturation context value; If the lifecycle counter of the cell object is less than or equal to 0, then the following steps are executed: Step S4S7, call the reusable step to initialize a new immature cell, take the initial lifecycle of the cell as input, and obtain a new cell object; Step S4S8, add the new cell object to the dendritic cell population state list for the next cycle. Otherwise, if the lifecycle counter of the cell object is greater than 0, then step S4S9 is executed to directly append the current cell object to the dendritic cell population state list for the next cycle. After the loop ends, step S4S10 is executed to generate an aggregated context signal, which includes: the total semi-mature context value corresponding to the key named semi-mature context aggregate value, and the total mature context value corresponding to the key named mature context aggregate value.

3. The method for identifying suspicious transactions in internet finance according to claim 1, characterized in that, The implementation method of step S5 includes: Step S5S1: Extract the total semi-mature context value corresponding to the key named semi-mature context aggregation value and the total mature context value corresponding to the key named mature context aggregation value from the aggregated context signal. Step S5S2: Calculate the sum of the total semi-mature context value and the total mature context value to obtain the total context value; If the total context value is greater than 0, proceed to step S5S3 to calculate the total mature context value divided by the total context value to obtain the mature context ratio; otherwise, proceed to step S5S4 to set the mature context ratio to 0.

0. Step S5: Extract the drift threshold and fraud threshold from the dendritic cell algorithm configuration parameters; In steps S5 and S6, if the mature context ratio is greater than or equal to the fraud threshold, the system action instruction is determined to be to generate a high-priority alarm; otherwise, if the mature context ratio is greater than or equal to the drift threshold, the system action instruction is determined to be to update the existing entity profile; otherwise, the system action instruction is determined to be to indicate that no operation needs to be performed.

4. The method for identifying suspicious transactions in internet finance according to claim 2, characterized in that, Methods for initializing new immature cells using reusable steps include: Create a data structure and name it "New Cell Object"; Create a property named Lifetime Counter in the new cell object, and set the value of the Lifetime Counter to the initial lifetime of the input cell; Create a property named "Accumulated Safety Signal Value" in the new cell object and set the value of "Accumulated Safety Signal Value" to 0.0; Create a property named "Cumulative Hazard Value" in the new cell object and set the value of "Cumulative Hazard Value" to 0.0; Create an attribute named "Cumulative Pathogen-Associated Molecular Pattern Signal Value" in the new cell object and set its value to 0.

0.

5. The method for identifying suspicious transactions in internet finance according to claim 1, characterized in that, The implementation methods for step S2 include: Step S2S1: Initialize an empty list and name it Initial Dendritic Cell Population State; Step S2: Extract the cell population size and initial cell life cycle from the dendritic cell algorithm configuration parameters; For each integer from 1 to the cell population size, perform the following steps: Step S2S3, call the reusable step to initialize new immature cells, taking the initial cell life cycle as input, to obtain new cell objects; Step S2S4, append the new cell objects to the initial dendritic cell population state list.

6. The method for identifying suspicious transactions in internet finance according to claim 1, characterized in that, The implementation methods for steps S3 and S2 include: Step S3S2S1: Initialize an empty list and name it the updated dendritic cell population state; For each cell object in the current dendritic cell population state, perform the following steps: Step S3S2S2, update the internal signal accumulation value and lifespan of the current cell object according to the input classification signal vector to obtain the updated cell object; Step S3S2S3, append the updated cell object to the updated dendritic cell population state list.

7. The method for identifying suspicious transactions in internet finance according to claim 6, characterized in that, The implementation method of step S3S2S2 includes: Step S3S2S2S1, extracting safe signal values, danger signal values, and pathogen-related molecular pattern signal values ​​from the classification signal vector; Step S3S2S2S2, calculating the sum of the cumulative safe signal values ​​of the cell object to obtain a new cumulative safe signal value; Step S3S2S2S3, calculating the sum of the cumulative danger signal values ​​of the cell object to obtain a new cumulative danger signal value; Step S3S2S2S4, calculating the sum of the cumulative pathogen-related molecular pattern signal values ​​of the cell object to obtain a new cumulative pathogen-related molecular pattern signal value; Step S3S2S2S5, decrementing the cell object's lifecycle counter by 1 to obtain a new lifecycle counter; Step S3S2S2S6, creating new data. The structure is named the updated cell object; Step S3S2S2S7, create an attribute named lifecycle counter in the updated cell object and set the value of the lifecycle counter to the new lifecycle counter; Step S3S2S2S8, create an attribute named cumulative safety signal value in the updated cell object and set the value of the cumulative safety signal value to the new cumulative safety signal value; Step S3S2S2S9, create an attribute named cumulative danger signal value in the updated cell object and set the value of the cumulative danger signal value to the new cumulative danger signal value; Step S3S2S2S10, create an attribute named cumulative pathogen-associated molecular pattern signal value in the updated cell object and set the value of the cumulative pathogen-associated molecular pattern signal value to the new cumulative pathogen-associated molecular pattern signal value.

8. A suspicious transaction identification system for internet finance, characterized in that, The system for implementing the suspicious transaction identification method for internet finance as described in any one of claims 1-7 includes: The signal module generates a complete signal stream based on user transaction flow, existing entity profiles, and dendritic cell algorithm configuration parameters. The initial state module configures parameters based on the dendritic cell algorithm to generate the initial dendritic cell population state; The final state module generates the final dendritic cell population state based on the complete signal flow, the initial dendritic cell population state, and the previous dendritic cell population state. The aggregation module generates an aggregation context signal and the dendritic cell population state for the next cycle based on the final dendritic cell population state and the dendritic cell algorithm configuration parameters. The action command module generates system action commands based on aggregated contextual signals and dendritic cell algorithm configuration parameters. The output module generates suspicious transaction identification results, which include: the system action instructions for risk assessment of user transaction flows; the existing entity profile; and the dendritic cell population state for the next cycle, which is used as the previous dendritic cell population state when step S3 is executed in the next analysis cycle.

Images