Anti-fraud method and system based on multi-modal perception and cross-time feature modeling

Abstract

The invention provides an anti-fraud method and system based on multi-modal perception and cross-time feature modeling. The method comprises the following steps: receiving a multi-modal financial transaction graph sent by an edge computing node; inputting the multi-modal financial transaction graph into a risk control model for risk analysis to obtain a node risk score of each node, an edge risk score of each edge and a gang risk score of each sub-graph; the risk control model is a multi-scale ST-Transform-GCN framework, and the risk control model is a multi-scale ST-Transform-GCN framework; processing the node risk score, the edge risk score and the gang risk score through a gating fusion mechanism to obtain a comprehensive risk score; based on the node risk score, the edge risk score and the gang risk score, extracting a suspicious transaction sub-graph from the multi-modal financial transaction graph; and inputting the comprehensive risk score and the suspicious transaction sub-graph into a preset reinforcement learning decision maker to obtain an anti-fraud strategy, and executing the anti-fraud strategy to achieve the purpose of accurately identifying the complex collaborative fraud behavior.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of financial technology and data security, and in particular to an anti-fraud method and system based on multi-modal perception and cross-time feature modeling. BACKGROUND

[0002] Traditional anti-fraud systems highly rely on cloud centralized computing framework, and are mostly based on single-dimensional rule analysis of accounts or devices, which is difficult to identify complex coordinated fraud behaviors (such as: a large number of credit cards in a short time make small consumption on multiple POS machines and then refund or return, forming a star-chain mode, which is a typical team cash-out and belongs to complex coordinated fraud behavior). Especially in the scenarios of "device farm", "shared IP", "GPS aggregation", etc., it is often misjudged or missed due to lack of in-depth modeling of cross-user / device / spatial-temporal relationships. SUMMARY

[0003] Therefore, the embodiments of the present application provide an anti-fraud method and system based on multi-modal perception and cross-time feature modeling to achieve the purpose of accurately identifying complex coordinated fraud behaviors.

[0004] To achieve the above purpose, the embodiments of the present application provide the following technical solutions:

[0005] The first aspect of the embodiments of the present application discloses an anti-fraud method based on multi-modal perception and cross-time feature modeling, applied to a central risk control platform, and the method comprises:

[0006] receiving a multi-modal financial transaction graph sent by an edge computing node; the multi-modal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on collected multi-modal transaction data;

[0007] inputting the multi-modal financial transaction graph into a pre-trained risk control model for risk analysis to obtain a node risk score of each node, an edge risk score of each edge, and a team risk score of each subgraph; the risk control model is a multi-scale ST-Transformer-GCN framework;

[0008] processing the node risk score, the edge risk score and the team risk score through a gating fusion mechanism to obtain a comprehensive risk score;

[0009] extracting a suspicious transaction subgraph from the multi-modal financial transaction graph based on the node risk score, the edge risk score and the team risk score;

[0010] inputting the comprehensive risk score and the suspicious transaction subgraph into a pre-set reinforcement learning decision maker to obtain an anti-fraud strategy, and executing the anti-fraud strategy.

[0011] Optionally, the training process of the risk control model comprises:

[0012] Based on the multi-scale ST-Transformer-GCN framework, a to-be-trained risk control model is constructed.

[0013] The to-be-trained risk control model is pre-trained by graph contrastive learning and protocol-restricted adversarial training to obtain a trained risk control model.

[0014] Optionally, based on the node risk score, the edge risk score and the gang risk score, a suspicious transaction subgraph is extracted from the multi-modal financial transaction graph, comprising:

[0015] From the multi-modal financial transaction graph, a target node with a node risk score greater than a node risk threshold, a target edge with an edge risk score greater than an edge risk threshold, and a target subgraph with a gang risk score greater than a gang risk threshold are extracted.

[0016] Based on the target node, the target edge and the target subgraph, a suspicious transaction subgraph is generated.

[0017] Optionally, the method further comprises:

[0018] The suspicious transaction subgraph is subjected to noise processing by using a graph-aware differential privacy mechanism.

[0019] The noise-processed suspicious transaction subgraph is stored in a consortium chain; the participating nodes of the consortium chain include an initiating bank, a cooperative bank, a payment institution and a regulatory authority.

[0020] Optionally, the noise-processed suspicious transaction subgraph is stored in the consortium chain, comprising:

[0021] The hash value of the noise-processed suspicious transaction subgraph is calculated.

[0022] Based on zero-knowledge proof technology, a zero-knowledge proof corresponding to the noise-processed suspicious transaction subgraph is generated.

[0023] The hash value and the zero-knowledge proof are stored in the consortium chain.

[0024] The second aspect of the embodiment of the application discloses an anti-fraud system based on multi-modal perception and cross-time feature modeling, applied to a central risk control platform, the system comprising:

[0025] A receiving unit is configured to receive a multi-modal financial transaction graph sent by an edge computing node; the multi-modal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on collected multi-modal transaction data;

[0026] an analysis unit, configured to input the multi-modal financial transaction graph into a pre-trained risk control model to perform risk analysis, to obtain a node risk score of each node, an edge risk score of each edge, and a gang risk score of each subgraph; the risk control model is a multi-scale ST-Transformer-GCN framework;

[0027] a fusion unit, configured to process the node risk score, the edge risk score, and the gang risk score through a gated fusion mechanism to obtain a comprehensive risk score;

[0028] an extraction unit, configured to extract a suspicious transaction subgraph from the multi-modal financial transaction graph based on the node risk score, the edge risk score, and the gang risk score;

[0029] a decision unit, configured to input the comprehensive risk score and the suspicious transaction subgraph into a pre-set reinforcement learning decision maker to obtain an anti-fraud strategy, and to execute the anti-fraud strategy.

[0030] Optionally, the system further includes:

[0031] a training unit, configured to construct a to-be-trained risk control model based on the multi-scale ST-Transformer-GCN framework;

[0032] perform graph contrastive learning pre-training and protocol-restricted adversarial training on the to-be-trained risk control model to obtain a trained risk control model.

[0033] Optionally, the extraction unit is specifically configured to:

[0034] extract, from the multi-modal financial transaction graph, a target node with a node risk score greater than a node risk threshold, a target edge with an edge risk score greater than an edge risk threshold, and a target subgraph with a gang risk score greater than a gang risk threshold;

[0035] generate a suspicious transaction subgraph based on the target node, the target edge, and the target subgraph.

[0036] Optionally, the system further includes:

[0037] a sharing unit, configured to perform noise addition processing on the suspicious transaction subgraph by using a graph-aware differential privacy mechanism, and store the noise-added suspicious transaction subgraph to a consortium chain; the participating nodes of the consortium chain include an initiating bank, a cooperative bank, a payment institution, and a regulatory authority.

[0038] Optionally, the sharing unit configured to store the noise-added suspicious transaction subgraph to the consortium chain is specifically configured to:

[0039] compute a hash value of the suspicious transaction subgraph after the noise adding processing;

[0040] Based on the zero-knowledge proof technology, generate a zero-knowledge proof corresponding to the suspicious transaction subgraph after the noise adding processing;

[0041] Store the hash value and the zero-knowledge proof to the consortium chain.

[0042] Based on the above-mentioned anti-fraud method and system based on multi-modal perception and cross-time feature modeling provided by the embodiment of the application, a multi-modal financial transaction graph sent by an edge computing node is received; the multi-modal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on collected multi-modal transaction data; the multi-modal financial transaction graph is input to a pre-trained risk control model for risk analysis to obtain a node risk score of each node, an edge risk score of each edge, and a gang risk score of each subgraph; the risk control model is a multi-scale ST-Transformer-GCN framework; the node risk score, the edge risk score, and the gang risk score are processed through a gating fusion mechanism to obtain a comprehensive risk score; based on the node risk score, the edge risk score, and the gang risk score, a suspicious transaction subgraph is extracted from the multi-modal financial transaction graph; the comprehensive risk score and the suspicious transaction subgraph are input to a pre-set reinforcement learning decision maker to obtain an anti-fraud strategy, and the anti-fraud strategy is executed. In this scheme, the risk control model using the multi-scale ST-Transformer-GCN framework continuously captures complex collaborative fraud behaviors in the transaction network from the multi-modal financial transaction graph to achieve the purpose of accurately identifying complex collaborative fraud behaviors. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only embodiments of the application, and for those skilled in the art, other drawings can be obtained without creative labor on the basis of the provided drawings.

[0044] Figure 1 A flowchart of an anti-fraud method based on multi-modal perception and cross-time feature modeling disclosed by the embodiment of the application;

[0045] Figure 2 A structural diagram of an anti-fraud system based on multi-modal perception and cross-time feature modeling disclosed by the embodiment of the application. DETAILED DESCRIPTION

[0046] With reference to the accompanying drawings, the technical solutions in the embodiments of the present application will be clearly and completely described below, obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work belong to the protection scope of the present application.

[0047] In the present application, the term "comprising", "containing" or any other variant thereof is intended to cover the non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or includes the elements inherent to such process, method, article or equipment. Without more limitations, the element defined by the sentence "including a" does not exclude the presence of other identical elements in the process, method, article or equipment including the element.

[0048] As known from the background, the traditional anti-fraud system highly depends on the cloud centralized computing framework, and is mainly based on single-dimensional rule analysis of accounts or devices, which is difficult to identify complex coordinated fraud behaviors (such as: a large number of credit cards in a short time make small consumption on multiple POS machines and then refund or return, forming a star-chain mode, which is a typical team cashing and belongs to complex coordinated fraud behavior). Especially in the scenarios of "device farm", "shared IP" and "GPS aggregation", it is often misjudged or missed due to the lack of in-depth modeling of cross-user / device / space-time relationship.

[0049] Therefore, the embodiments of the present application disclose an anti-fraud method and system based on multi-modal perception and cross-time feature modeling. In the present scheme, the risk control model of the multi-scale ST-Transformer-GCN framework is used to continuously capture complex coordinated fraud behaviors in the transaction network from the multi-modal financial transaction graph, so as to achieve the purpose of accurately identifying complex coordinated fraud behaviors.

[0050] As Figure 1 A flowchart of an anti-fraud method based on multi-modal perception and cross-time feature modeling disclosed by the embodiments of the present application is provided. The method is applied to a central risk control platform connected with a plurality of edge computing nodes. The central risk control platform can be deployed in a bank risk control center. The method comprises the following steps:

[0051] Step S101: receiving the multi-modal financial transaction graph sent by the edge computing node.

[0052] The multi-modal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on the collected multi-modal transaction data.

[0053] The multi-modal transaction data includes: obtaining multi-modal transaction data from internal and external channels of the bank, including transaction flow (time, amount, channel), account relationship (transfer chain, common equipment), behavior characteristics (login location, terminal fingerprint), external information (blacklist, judicial risk data).

[0054] It should be noted that the edge computing node is generally a computing unit deployed on the bank front-end business system, network edge gateway or data access server, which is used to preprocess and encrypt before the data enters the center risk control platform, responsible for data pre-cleaning (such as denoising, formatting, desensitization), encryption or feature extraction, to avoid direct transmission of original sensitive data.

[0055] For example, when the transaction flow is collected by the mobile banking App or the POS machine, the data is first transmitted to the edge computing node deployed on the bank front-end business system, network edge gateway or data access server; the node can complete field desensitization, noise addition or encryption processing locally, and build a multi-modal financial transaction graph based on the processed data (feature-based data), and finally transmit it to the center risk control platform.

[0056] The multi-modal financial transaction graph can include:

[0057] ① Node features: account features, device fingerprint features, geographic location, social relationship features;

[0058] ② Edge features: transaction amount, transaction type, transaction time, device risk score, etc.

[0059] ③ Time series: windowed transaction sequence at second, minute, and hour levels.

[0060] In the process of building a multi-modal financial transaction graph, the multi-modal transaction data is filled with missing values, normalized, and timestamp aligned to obtain feature-based data and build a heterogeneous graph structure: nodes represent accounts / equipment / transaction entities, edges represent transfer, common, login, etc. relationship, and initial feature vector is assigned.

[0061] Step S102: input the multi-modal financial transaction graph into the pre-trained risk control model for risk analysis to obtain node risk scores of each node, edge risk scores of each edge, and gang risk scores of each subgraph.

[0062] The fraud control model is a multi-scale ST-Transformer-GCN framework. The multi-scale ST-Transformer-GCN framework is obtained by introducing a multi-scale time sequence branch, a cross-space-time Transformer, and a motif-aware pooling on the basis of an ST-GCN (Spatial-Temporal Graph Convolutional Network) framework, so that the model can capture short-time high-density patterns and long-time cross-domain collusion behaviors at the same time. The ST-GCN framework is a deep learning model specially used for processing spatial-temporal graph structure data.

[0063] Specifically, the following structural improvements are introduced on the basis of the traditional ST-GCN framework:

[0064] ① Multi-Rate Temporal Bank: simultaneously processing second-level, minute-level, and hour-level transaction sequences, and aggregating multi-scale time dependencies through a learnable time convolution kernel.

[0065] ② Edge-Conditioned GCN: introducing conditional features (transaction type, amount, and device risk score) of transaction edges when updating nodes, and dynamically adjusting the convolution weight.

[0066] ③ Cross-Time Subgraph Transformer Module: converting long-time dependencies into token sequences, and capturing non-continuous abnormal patterns through a multi-head attention mechanism.

[0067] ④ Motif-Aware Pooling: in view of the gang collusion mode in the anti-fraud scene, high-frequency three-element or four-element transaction motifs are pre-mined, and motif tokens are generated to participate in subsequent graph convolution.

[0068] ⑤ Residual Multi-Branch Fusion Mechanism: multi-scale convolution branches, Transformer branches, and motif branches are fused in a residual framework to improve the generalization and stability.

[0069] In the embodiment of the application, the motif perception enhanced ST-GCN structure: a motif convolution layer is introduced on the basis of the traditional ST-GCN, directly modeling high-risk modes such as star, chain and double-part graph, and integrating them into the space-time feature modeling process as motif-tokens. This design changes the feature propagation method of the traditional ST-GCN which only relies on node adjacency information, supports high-order mode perception across nodes and time, and improves the detection capability of gang-type fraud. Multi-time resolution + cross-time Transformer joint modeling: a multi-branch time sequence feature extractor is set up at the second, minute and hour levels, and multi-scale space-time information fusion is realized through residual aggregation. A cross-time subgraph Transformer is introduced to capture long-range dependencies through a multi-head attention mechanism, realize unified analysis of short-term behavior and long-term behavior, and effectively identify delay-type and cross-cycle fraud modes.

[0070] It should be noted that the risk control model has a large amount of calculation and needs to rely on a high-performance GPU / server, and is usually deployed in the core computing cluster of the central risk control platform.

[0071] In step S102, the node risk score corresponding to each node is obtained, which is used to represent whether each account / device is abnormal; and the edge risk score corresponding to each edge is obtained, which is used to represent the suspicious degree of each transaction or transaction link; and the gang risk score is the risk score of each subgraph in the multi-modal financial transaction graph, which is used to represent whether there is a group fraud mode (such as a cash-out gang or a money laundering chain).

[0072] Optionally, the risk control model training process is as follows:

[0073] Based on the multi-scale ST-Transformer-GCN framework, a to-be-trained risk control model is constructed; the to-be-trained risk control model is pre-trained through graph contrast learning and protocol-restricted adversarial training to obtain a trained risk control model.

[0074] Among them, the graph contrast learning pre-training: normal transactions and historical fraud transactions are used to construct positive and negative samples to enhance the model's abnormal pattern perception. Let the model better distinguish "normal mode vs fraud mode" in the training stage to enhance the recognition effect.

[0075] Protocol-restricted adversarial training: in the simulated attack scenario, the model robustness is optimized through adversarial perturbation. Let the model remain stable even when it is "poisoned / bypassed" by black and gray production.

[0076] During the training process, the training enhancement, i.e., the graph contrast learning and the adversarial training, is performed to make the risk control model more accurate and more anti-interference.

[0077] Step S103: The node risk score, the edge risk score and the gang risk score are processed through a gated fusion mechanism to obtain a comprehensive risk score.

[0078] Wherein, the gating fusion mechanism determines the node risk score, the edge risk score and the group risk score, and how much proportion enters the comprehensive risk score.

[0079] In the embodiment of the application, the risk calculation is no longer single-dependent on the node features, but introduces three channels of node local risk, edge risk and global subgraph risk for parallel scoring. Through a gating mechanism, the weights of the three channels are dynamically adjusted to automatically enhance stability and robustness in a high-noise data environment.

[0080] Step S104: Extracting a suspicious transaction subgraph from the multi-modal financial transaction graph based on the node risk score, the edge risk score and the group risk score.

[0081] It should be noted that the suspicious transaction subgraph (such as a Merkle subgraph) is a local account-transaction relationship structure extracted from the overall transaction network (multi-modal financial transaction graph) and determined as high risk. It usually includes: suspicious account nodes involved (personal account, enterprise account, device ID); transaction edges related thereto (transfer, payment, withdrawal); local transaction patterns (such as circular transfer, star-shaped cash-out, chain-like money laundering).

[0082] In the specific implementation process of step S104, the target nodes with a node risk score greater than a node risk threshold, the target edges with an edge risk score greater than an edge risk threshold and the target subgraphs with a group risk score greater than a group risk threshold are extracted from the multi-modal financial transaction graph; and based on the target nodes, the target edges and the target subgraphs, a suspicious transaction subgraph is generated.

[0083] It should be noted that the node risk score of each node, the edge risk score of each edge and the group risk score of each subgraph have been calculated;

[0084] When the risk score of some nodes or edges exceeds the threshold value (for example, the node risk score > 0.85, the group risk score > 0.75), the system will trigger suspicious pattern recognition; at this time, these nodes, related edges and related subgraphs will be extracted to form a suspicious transaction subgraph.

[0085] For example: if it is detected that 5 accounts frequently form a ring-shaped transfer within 10 minutes, and the risk score exceeds the threshold value, then the local network of the ring-shaped transfer will be extracted as a suspicious transaction subgraph.

[0086] In an embodiment, a graph-aware differential privacy mechanism is used to perform noise processing on the suspicious transaction subgraph; the noise-processed suspicious transaction subgraph is stored in a consortium chain; the participating nodes of the consortium chain include: an initiating bank, a cooperative bank, a payment institution and a regulatory authority.

[0087] It should be noted that the graph-aware differential privacy mechanism is introduced to add noise to the high-risk node / edge features in the suspicious transaction subgraph, so as to protect privacy when sharing across institutions.

[0088] In the embodiments of the present application, a graph-aware differential privacy protection strategy is adopted: in federated inference, a motif correlation weighted gradient compression method is adopted to preferentially retain gradient information related to high-risk motifs and reduce irrelevant gradient transmission volume. Differential privacy budget is dynamically allocated, low noise is allocated to high-risk channels, and high noise is allocated to low-risk channels, so as to maintain model accuracy while protecting privacy.

[0089] Among them, the alliance chain is a permissioned chain composed of specific financial institutions and regulatory parties. In the context of the present patent, typical participating nodes of the alliance chain include:

[0090] ①Initiating bank (subject bank): the bank to which the present system belongs, responsible for detection and storage of suspicious subgraphs; ②Cooperating bank or payment institution: other financial institutions that have financial transactions with the subject bank, which can confirm the authenticity of suspicious subgraphs through on-chain verification mechanism; ③Clearing institution (such as UnionPay, Netlink): a settlement party for cross-bank transactions, participating in the verification of storage, and improving the credibility; ④Regulatory department node (such as the central bank, financial regulatory authorities): with regulatory authority, can audit storage data through zero-knowledge verification method when necessary.

[0091] Optionally, the suspicious transaction subgraph after noise addition is stored in the alliance chain, including:

[0092] The hash value of the suspicious transaction subgraph after noise addition is calculated; based on zero-knowledge proof technology, the zero-knowledge proof corresponding to the suspicious transaction subgraph after noise addition is generated; the hash value and the zero-knowledge proof are stored in the alliance chain.

[0093] Among them, the zero-knowledge proof technology is a kind of cryptography technology, which can make the prover believe that a certain conclusion is true without revealing the original data, and in cross-institutional sharing, the system only discloses the necessary proof without disclosing the complete transaction data.

[0094] It should be noted that in cross-institutional anti-fraud cooperation, different banks or payment institutions need to verify suspicious transaction patterns with each other. If the complete transaction data (such as all transaction details, account information) is directly sent to the other party, it will cause serious privacy leakage; but if it is completely not shared, cooperation cannot be achieved, so the zero-knowledge proof technology needs to be introduced.

[0095] For example, bank A detects a suspicious transaction subgraph, such as a ring-shaped money laundering pattern; bank B wants to confirm whether this is credible, but does not need to see all the original transaction flow of bank A;

[0096] So bank A generates a zero-knowledge proof that "there exists a set of transactions that satisfy the ring structure and the risk score exceeds the threshold"; bank B can confirm the conclusion by verifying this proof without knowing the specific accounts, amounts, and other sensitive data involved.

[0097] In the embodiments of the present application, the blockchain Merkle subgraph attestation is integrated with zero-knowledge verification: a Merkle tree structure is generated for the high-risk transaction subgraph, and only the hash value is stored on the chain to prevent leakage of original data. Combined with zero-knowledge proof (ZKP), compliance verification and judicial evidence are realized, and the authenticity of the data can be proved without disclosing the transaction details, greatly shortening the audit and evidence collection time.

[0098] Step S105: input the comprehensive risk score and suspicious transaction subgraph into a preset reinforcement learning decision maker to obtain an anti-fraud strategy, and execute the anti-fraud strategy.

[0099] In step S105, the reinforcement learning decision maker is a decision maker that dynamically adjusts the comprehensive risk score threshold, and the threshold is flexibly adjusted according to the scene (for example, during the Double Eleven peak transaction, the threshold is relaxed to avoid false negatives; but in the case of cross-border suspicious large transactions, the threshold is more stringent).

[0100] The reinforcement learning decision maker selects the optimal strategy among transaction interception, delayed review, account freezing, etc. based on the dynamically adjusted comprehensive risk score threshold, and selects the optimal strategy as the anti-fraud strategy.

[0101] Optionally, the feedback result (such as "whether the fraud is successfully prevented") after executing the anti-fraud strategy is used for online training to optimize future decisions (such as dynamically adjusting the comprehensive risk score threshold and adjusting the available strategies).

[0102] Scenario Embodiment 1: Credit card syndicate cashing detection (online scenario)

[0103] Scenario introduction: A large number of credit cards make small consumption in multiple POS machines within a short time and then refund or return, forming a star-chain mode, which is a typical syndicate cashing.

[0104] System operation process:

[0105] 1. The edge node constructs a subgraph within a 10-minute sliding window

[0106] The multi-scale branches respectively sample and calculate local representations at 10s, 1min, and 10min: , the edge amount and the timestamp.

[0107] 2. The multi-scale branches respectively sample and calculate local representations at 10s, 1min, and 10min:

[0108]

[0109] 3. Spotlight: motif detector detects high-frequency star motifs and generates motif tokens Zstar

[0110] 4. Local ST-GCN extracts node embeddings, and Transformer models cross-window correlations.

[0111] 5. Output node risk scores. If a card score > 0.85 and motif score > θ (e.g., 0.7), mark it as high-risk.

[0112] 6. High-risk events:

[0113] Construct a Merkle-subgraph (only node ID + edge hash) and record the root on the chain.

[0114] Trigger RL policy: if the current risk control queue load is low and the user credit level is low → directly refuse payment; if high → trigger secondary manual review or SMS verification.

[0115] Scenario Example 2: Cross-institutional fraud evidence sharing and judicial evidence (offline audit scene)

[0116] Scenario Introduction: When multiple banks suspect that the same merchant / device is involved in fraud but cannot share plaintext data, they need to provide auditable but privacy-protected evidence to regulatory or judicial authorities.

[0117] Steps:

[0118] Each institution locally detects suspicious subgraphs and generates a Merkle-subgraph root.

[0119] Each institution chains the Merkle root with a timestamp, model version (on a consortium chain).

[0120] When the regulatory party requests further investigation, an institution can generate a ZK proof (proving that there is a path that satisfies the amount / time / node attributes), and the verifier verifies the consistency of the ZK proof and the on-chain root to obtain "existence" or "attribute satisfaction" proof without disclosing the original details.

[0121] If the judiciary needs to disclose, the institution can disclose the minimum data set under compliance authorization and prove its consistency with the on-chain hash to ensure tamper resistance.

[0122] Technical effects:

[0123] 1. Motif convolution + cross-time Transformer improves the F1-score of long-period fraud detection by about 7.5% compared to the original ST-GCN.

[0124] 2. The three-channel risk scoring and gating fusion mechanism improves accuracy by more than 5% when the noise ratio is 20%.

[0125] 3. The graph-aware differential privacy framework exhibits a performance decrease of no more than 3% under the condition of ε=2, which is significantly better than the traditional differential privacy strategy (performance decrease of 8%-10%).

[0126] 4. Merkle notarization + ZKP verification reduces notarization and verification time from hours to minutes, without exposing transaction details.

[0127] Based on the above-described anti-fraud method disclosed in this invention, which is based on multimodal perception and cross-temporal feature modeling, this solution utilizes a risk control model based on a multi-scale ST-Transformer-GCN framework to continuously capture complex collaborative fraud behaviors in the transaction network from a multimodal financial transaction graph, so as to achieve the purpose of accurately identifying complex collaborative fraud behaviors.

[0128] like Figure 2 The diagram shown is a structural diagram of an anti-fraud system based on multimodal perception and cross-temporal feature modeling disclosed in an embodiment of the present invention, comprising:

[0129] The receiving unit 201 is used to receive a multimodal financial transaction graph sent by the edge computing node; the multimodal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on the collected multimodal transaction data;

[0130] Analysis unit 202 is used to input the multimodal financial transaction graph into a pre-trained risk control model for risk analysis, and obtain the node risk score of each node, the edge risk score of each edge, and the group risk score of each subgraph; the risk control model is a multi-scale ST-Transformer-GCN framework.

[0131] The fusion unit 203 is used to process the node risk score, the edge risk score, and the gang risk score through a gating fusion mechanism to obtain a comprehensive risk score;

[0132] Extraction unit 204 is used to extract suspicious transaction subgraphs from the multimodal financial transaction graph based on the node risk score, the edge risk score and the group risk score;

[0133] The decision unit 205 is used to input the comprehensive risk score and the suspicious transaction subgraph into a preset reinforcement learning decision unit to obtain an anti-fraud strategy and execute the anti-fraud strategy.

[0134] Optionally, the system may also include:

[0135] The training unit is configured to construct a to-be-trained risk control model based on the multi-scale ST-Transformer-GCN framework, and perform graph contrastive learning pre-training and protocol-restricted adversarial training on the to-be-trained risk control model to obtain a trained risk control model.

[0136] Optionally, the extraction unit 204 is specifically configured to:

[0137] extract, from the multi-modal financial transaction graph, a target node with a node risk score greater than a node risk threshold, a target edge with an edge risk score greater than an edge risk threshold, and a target subgraph with a gang risk score greater than a gang risk threshold;

[0138] generate a suspicious transaction subgraph based on the target node, the target edge, and the target subgraph.

[0139] Optionally, the system further includes:

[0140] The sharing unit is configured to perform noise processing on the suspicious transaction subgraph by using a graph-aware differential privacy mechanism, and store the noise-processed suspicious transaction subgraph to a consortium chain. The participating nodes of the consortium chain include an initiating bank, a cooperative bank, a payment institution, and a regulatory authority.

[0141] Optionally, the sharing unit configured to store the noise-processed suspicious transaction subgraph to the consortium chain is specifically configured to: calculate a hash value of the noise-processed suspicious transaction subgraph; generate a zero-knowledge proof corresponding to the noise-processed suspicious transaction subgraph based on a zero-knowledge proof technology; and store the hash value and the zero-knowledge proof to the consortium chain.

[0142] Based on the anti-fraud system based on multi-modal perception and cross-time feature modeling disclosed in the above embodiments of the present application, in the present scheme, the risk control model of the multi-scale ST-Transformer-GCN framework is used to continuously capture complex collaborative fraud behaviors in the transaction network from the multi-modal financial transaction graph, so as to achieve the purpose of accurately identifying complex collaborative fraud behaviors.

[0143] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0144] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0145] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for anti-fraud based on multi-modal perception and cross-time feature modeling, characterized in that, The method is applied to a central risk control platform, and the method comprises the following steps: receiving a multi-modal financial transaction graph sent by an edge computing node; the multi-modal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on collected multi-modal transaction data; inputting the multi-modal financial transaction graph into a pre-trained risk control model for risk analysis to obtain a node risk score of each node, an edge risk score of each edge, and a gang risk score of each subgraph; the risk control model is a multi-scale ST-Transformer-GCN framework; processing the node risk score, the edge risk score, and the gang risk score through a gating fusion mechanism to obtain a comprehensive risk score; extracting a suspicious transaction subgraph from the multi-modal financial transaction graph based on the node risk score, the edge risk score, and the gang risk score; inputting the comprehensive risk score and the suspicious transaction subgraph into a preset reinforcement learning decision maker to obtain an anti-fraud strategy and executing the anti-fraud strategy.

2. The method of claim 1, wherein, The training process of the risk control model comprises the following steps: constructing a to-be-trained risk control model based on a multi-scale ST-Transformer-GCN framework; performing graph contrastive learning pre-training and protocol-constrained adversarial training on the to-be-trained risk control model to obtain a trained risk control model.

3. The method of claim 1, wherein, The step of extracting a suspicious transaction subgraph from the multi-modal financial transaction graph based on the node risk score, the edge risk score, and the gang risk score comprises the following steps: extracting a target node with a node risk score greater than a node risk threshold, a target edge with an edge risk score greater than an edge risk threshold, and a target subgraph with a gang risk score greater than a gang risk threshold from the multi-modal financial transaction graph; generating a suspicious transaction subgraph based on the target node, the target edge, and the target subgraph.

4. The method of claim 1, wherein, The method further comprises the following steps: performing noise processing on the suspicious transaction subgraph by using a graph-aware differential privacy mechanism; storing the noise-processed suspicious transaction subgraph to a consortium chain; the participating nodes of the consortium chain comprise an initiating bank, a cooperative bank, a payment institution, and a regulatory authority.

5. The method of claim 4, wherein, The step of storing the noise-processed suspicious transaction subgraph to the consortium chain comprises the following steps: calculating a hash value of the noise-processed suspicious transaction subgraph; generating a zero-knowledge proof corresponding to the noise-processed suspicious transaction subgraph based on a zero-knowledge proof technology; storing the hash value and the zero-knowledge proof to the consortium chain.

6. An anti-fraud system based on multi-modal perception and cross-time feature modeling, characterized in that, The system is applied to a central risk control platform, and the system comprises the following units: a receiving unit configured to receive a multi-modal financial transaction graph sent by an edge computing node; the multi-modal financial transaction graph is a heterogeneous graph structure generated by the edge computing node based on collected multi-modal transaction data; an analysis unit configured to input the multi-modal financial transaction graph into a pre-trained risk control model for risk analysis to obtain a node risk score of each node, an edge risk score of each edge, and a gang risk score of each subgraph; the risk control model is a multi-scale ST-Transformer-GCN framework; a fusion unit configured to fuse the node risk score, the edge risk score, and the group risk score by a gated fusion mechanism to obtain a comprehensive risk score; an extraction unit configured to extract a suspicious transaction subgraph from the multi-modal financial transaction graph based on the node risk score, the edge risk score, and the group risk score; a decision unit configured to input the comprehensive risk score and the suspicious transaction subgraph into a preset reinforcement learning decision maker to obtain an anti-fraud strategy and execute the anti-fraud strategy.

7. The system of claim 6, wherein, The system further comprises: a training unit configured to construct a to-be-trained risk control model based on a multi-scale ST-Transformer-GCN framework; perform graph contrastive learning pre-training and protocol-restricted adversarial training on the to-be-trained risk control model to obtain a trained risk control model.

8. The system of claim 6, wherein, The extraction unit is specifically configured to: extract a target node with a node risk score greater than a node risk threshold, a target edge with an edge risk score greater than an edge risk threshold, and a target subgraph with a group risk score greater than a group risk threshold from the multi-modal financial transaction graph; and generate a suspicious transaction subgraph based on the target node, the target edge, and the target subgraph.

9. The system of claim 6, wherein, The system further comprises: a sharing unit configured to perform noise processing on the suspicious transaction subgraph by using a graph-aware differential privacy mechanism, and store the noise-processed suspicious transaction subgraph to a consortium chain; and 10. The system of claim 9, wherein, the participating nodes of the consortium chain include an initiating bank, a cooperative bank, a payment institution, and a regulatory authority. The sharing unit configured to store the noise-processed suspicious transaction subgraph to the consortium chain is specifically configured to: calculate a hash value of the noise-processed suspicious transaction subgraph; generate a zero-knowledge proof corresponding to the noise-processed suspicious transaction subgraph based on a zero-knowledge proof technology; and store the hash value and the zero-knowledge proof to the consortium chain.

Images