Risk processing method and device, electronic equipment, medium and program product

Abstract

The invention provides a risk processing method and device, electronic equipment, a medium and a program product, and can be applied to the technical field of artificial intelligence, the technical field of big data and the technical field of financial science and technology. The method comprises the steps of obtaining multi-modal data for a target transaction, and extracting multi-modal features based on the multi-modal data; performing cross-modal attention fusion on the multi-modal features to obtain a comprehensive risk vector and a corresponding modal weight vector; obtaining a transaction dynamic baseline constructed and updated based on historical transaction behaviors, and calculating a deviation amount of the target transaction relative to the transaction dynamic baseline; and generating a risk processing result by using a reinforcement learning strategy network based on the comprehensive risk vector, the modal weight vector and the deviation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, the technical field of big data and the technical field of financial technology, and more particularly to a risk processing method, device, equipment, medium and program product. BACKGROUND

[0002] The existing financial transaction risk processing technology mainly relies on expert systems based on hard-coded rules, traditional machine learning models and big data analysis platforms. Although the above methods have improved the automation level of risk control to some extent, there are still technical bottlenecks: the data sources are limited to structured systems, making it difficult to cover multi-modal information such as images, behavior trajectories and real-time dynamic signals, resulting in insufficient risk identification dimensions; at the same time, the rules need to be manually maintained and the model iteration period is long, making it difficult to adapt to the rapid evolution of new risk patterns; in addition, the existing methods have high false positive rates, resulting in a large number of low-risk transactions being incorrectly labeled as abnormal, increasing the pressure on manual review and reducing the overall disposal efficiency. SUMMARY

[0003] In view of the above problems, the present application provides a risk processing method, device, equipment, medium and program product.

[0004] According to a first aspect of the present application, a risk processing method is provided, the method comprising: acquiring multi-modal data for a target transaction, extracting multi-modal features based on the multi-modal data; performing cross-modal attention fusion on the multi-modal features to obtain a comprehensive risk vector and a corresponding modal weight vector; acquiring a transaction dynamic baseline constructed and updated based on historical transaction behavior, calculating the deviation of the target transaction relative to the transaction dynamic baseline; and based on the comprehensive risk vector, the modal weight vector and the deviation, generating a risk processing result using a reinforcement learning policy network.

[0005] According to an embodiment of the present application, the multi-modal data at least includes visual data, behavior and transaction data and relationship network data.

[0006] According to an embodiment of the present application, the multi-modal features are extracted based on the multi-modal data, including: performing optical character recognition on the visual data, and generating document authenticity features based on image anti-counterfeiting detection and tamper trace detection; using behavior profiling to obtain behavior embedding vectors of the behavior and transaction data and profiling stability indicators; and based on the relationship network data, extracting a target heterogeneous subgraph from a pre-constructed heterogeneous graph, and using a graph neural network to obtain relationship risk features of the target heterogeneous subgraph.

[0007] According to an embodiment of the present application, the behavior portrait is used to obtain the behavior embedding vector of the behavior and transaction type data and the portrait stability index, comprising: obtaining a long-term behavior portrait of a target user constructed based on historical transaction data; generating a session-level behavior portrait based on interaction events of the target transaction, extracting a behavior embedding vector based on the session-level behavior portrait; and comparing the long-term behavior portrait and the session-level behavior portrait to calculate the portrait stability index.

[0008] According to an embodiment of the present application, the target heterogeneous subgraph is extracted from the pre-constructed heterogeneous graph based on the relationship network type data, and the relationship risk feature of the target heterogeneous subgraph is obtained by using a graph neural network, comprising: taking a transaction associated entity of the target transaction as a center node, extracting a target heterogeneous subgraph containing a preset hop number of neighbors from the pre-constructed heterogeneous graph; performing message passing and feature aggregation of the graph neural network on the target heterogeneous subgraph to generate node embedding representation; and calculating the relationship risk score of the center node based on the node embedding representation to obtain the relationship risk feature.

[0009] According to an embodiment of the present application, the graph neural network comprises at least one of the following: an attention graph neural network for introducing attention weights in the message passing process of the target heterogeneous subgraph; a graph isomorphism network for introducing a structure preservation mechanism and an information enhancement mechanism in the message passing and feature aggregation process of the target heterogeneous subgraph.

[0010] According to an embodiment of the present application, the long-term behavior portrait and the session-level behavior portrait are compared to calculate the portrait stability index, comprising: inputting the long-term behavior portrait and the session-level behavior portrait into an unsupervised learning anomaly detection algorithm to output an anomaly score, wherein the anomaly detection algorithm comprises at least one of an isolation forest, an autoencoder and a local outlier factor; and obtaining the portrait stability index based on the anomaly score.

[0011] According to an embodiment of the present application, the comprehensive risk vector, the modal weight vector and the deviation amount are used to generate a risk processing result by using a reinforcement learning policy network, comprising: inputting a joint state composed of the comprehensive risk vector, the modal weight vector and the deviation amount into the reinforcement learning policy network; and selecting a disposal measure in a predefined action space, and generating a risk processing result based on the disposal measure.

[0012] According to an embodiment of the present application, the method further comprises: obtaining transaction after-event performance, constructing a reward signal based on the transaction after-event performance; and updating parameters of the reinforcement learning policy network by using the reward signal.

[0013] According to an embodiment of the present application, the method further comprises: obtaining a target feature corresponding to the risk processing result, performing importance calculation on the target feature; sorting the target feature according to the importance calculation result, obtaining a feature set for representing an influence on the risk processing result; and generating explanation data based on the feature set.

[0014] A second aspect of the present application provides a risk processing device, the device comprising: a data acquisition module, configured to: acquire multi-modal data for a target transaction, and extract multi-modal features based on the multi-modal data; a feature fusion module, configured to: perform cross-modal attention fusion on the multi-modal features, and obtain a comprehensive risk vector and a corresponding modal weight vector; an offset calculation module, configured to: acquire a transaction dynamic baseline constructed and updated based on historical transaction behaviors, and calculate a deviation of the target transaction relative to the transaction dynamic baseline; and a risk processing module, configured to: based on the comprehensive risk vector, the modal weight vector and the deviation, generate a risk processing result by using a reinforcement learning policy network.

[0015] A third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0016] A fourth aspect of the present application further provides a computer-readable storage medium having stored thereon a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the above method.

[0017] A fifth aspect of the present application further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the above method.

[0018] According to an embodiment of the present application, by introducing multi-modal information and combining cross-modal attention mechanism for fusion, the limitation of relying only on structured data for risk identification is broken, making the dimension of risk identification and processing more comprehensive; at the same time, by calculating the deviation based on the dynamic baseline constructed based on historical transaction behaviors, and inputting the deviation, the comprehensive risk vector and the modal weight vector into the reinforcement learning policy network, the adaptive optimization of the strategy is realized, which can quickly adapt to the evolving risk pattern. In addition, under the joint action of multi-modal features, dynamic baseline and reinforcement learning, the false positive rate is effectively reduced, thereby reducing unnecessary manual review burden and improving overall risk control efficiency and accuracy. BRIEF DESCRIPTION OF DRAWINGS

[0019] The above and other objects, features and advantages of the present application will become more apparent from the following description when taken in conjunction with the accompanying drawings, in which:

[0020] Figure 1 An application scenario diagram of the risk processing method, device, equipment, medium and program product according to the embodiments of the present application is schematically shown;

[0021] Figure 2 A flowchart of the risk processing method according to the embodiments of the present application is schematically shown;

[0022] Figure 3 A flowchart of the method for obtaining the behavior embedding vector of the behavior and transaction data and the portrait stability index by using the behavior portrait according to some exemplary embodiments of the present application is schematically shown;

[0023] Figure 4 A flowchart of the method for obtaining the relationship risk feature of the target heterogeneous subgraph according to some exemplary embodiments of the present application is schematically shown;

[0024] Figure 5 A structural block diagram of the risk processing device according to the embodiments of the present application is schematically shown; and

[0025] Figure 6 A block diagram of the electronic device suitable for implementing the risk processing method according to the embodiments of the present application is schematically shown. DETAILED DESCRIPTION

[0026] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It is to be understood, however, that the description is merely exemplary of the present application, and is not intended to limit the scope of the present application. In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that one or more embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present application.

[0027] The terms used herein are merely used to describe specific embodiments, and are not intended to limit the present application. The terms "include" and "have" and the like used herein indicate the presence of the described features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0028] All terms used herein, including technical and scientific terms, have the same meanings as those generally understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the specification, and should not be interpreted in an idealized or overly formal manner.

[0029] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0030] The following will explain and clarify the terms used in this article.

[0031] Heterogeneous graphs refer to graph structures composed of different types of nodes and different types of edges. For example, entities such as accounts, devices, merchants, and network addresses serve as nodes, while different transaction relationships or sharing relationships serve as edges.

[0032] Graph neural networks are neural network models that propagate and aggregate features on graph structures to generate embedding vectors for nodes or subgraphs, thereby uncovering potential relationships between entities.

[0033] With the rapid growth of online financial services, the volume and complexity of transactions have continued to increase, making the identification and control of transaction risks a critical issue that financial institutions urgently need to address. In response, the industry has proposed various technical solutions.

[0034] One existing approach is an expert system based on hard-coded rules. Risk control experts, relying on historical experience, directly embed risk rules into program code, such as "authorization is required for single transfers exceeding a certain amount" or "process is blocked if documents expire." This type of system matches rules one by one during business execution and triggers corresponding handling strategies, featuring simple implementation and fast execution speed.

[0035] Another approach is based on traditional machine learning-based risk control models. To overcome the rigidity of rule-based systems, the industry has introduced common models such as logistic regression, decision trees, and random forests. These methods, trained on large amounts of historical transaction data, can automatically identify potential risk patterns and generate a risk score for each transaction, thereby improving the intelligence level of risk management to some extent.

[0036] Some solutions also propose big data-based aggregation and analysis platforms that can combine data such as enterprise operating conditions and negative information with internal business data, and combine them with model libraries and rule units to carry out risk processing and customer rating, achieving relatively comprehensive data utilization and business support.

[0037] However, existing technologies still have significant shortcomings. First, data sources are limited. Rules and models often rely solely on structured data from core trading systems, making it difficult to incorporate unstructured data such as images, text, and voice, as well as real-time behavioral signals, resulting in a one-dimensional view of risk. Second, the system lacks dynamism and foresight. Rules require frequent manual updates, and model training and iteration cycles are lengthy, making it difficult to respond promptly to new risk scenarios. Furthermore, feature calculations are mostly performed offline in batch processing, failing to reflect user dynamics in real time, leading to high false positive and false negative rates. Third, high false positive rates result in extensive manual review of low-risk transactions, increasing labor costs and causing risk control experts to spend excessive time maintaining the rule base, making it difficult to focus on high-value risk assessment and strategy development. Finally, many machine learning models lack transparency in their decision-making process, making it difficult to explain the specific judgment criteria, creating a "black box" problem and posing compliance and auditing challenges in practical use.

[0038] Based on this, embodiments of this application provide a risk processing method, the method comprising: acquiring multimodal data for a target transaction; extracting multimodal features based on the multimodal data; performing cross-modal attention fusion on the multimodal features to obtain a comprehensive risk vector and a corresponding modality weight vector; acquiring a dynamic baseline for transactions constructed and updated based on historical transaction behavior; calculating the deviation of the target transaction relative to the dynamic baseline; and generating a risk processing result using a reinforcement learning policy network based on the comprehensive risk vector, the modality weight vector, and the deviation. According to embodiments of this application, by introducing multimodal information and combining it with a cross-modal attention mechanism, the limitation of relying solely on structured data for risk identification is overcome, making risk identification and processing more comprehensive. Simultaneously, by calculating the deviation using a dynamic baseline constructed based on historical transaction behavior and inputting this deviation along with the comprehensive risk vector and modality weight vector into the reinforcement learning policy network, adaptive optimization of the policy is achieved, enabling rapid adaptation to evolving risk patterns. Furthermore, the combined effect of multimodal features, dynamic baselines, and reinforcement learning effectively reduces the false alarm rate, thereby reducing unnecessary manual review burden and improving overall risk control efficiency and accuracy.

[0039] It should be noted that the risk processing methods, apparatus, devices, media, and program products defined in this application can be used in the fields of artificial intelligence, big data, and fintech, and can also be used in various other fields besides artificial intelligence, big data, and fintech. The application areas of the risk processing methods, apparatus, devices, media, and program products provided in the embodiments of this application are not limited.

[0040] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0041] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided in this application all provide users with corresponding operation entry points for users to choose to agree to or reject the automated decision results; if the user chooses to reject, the process enters the expert decision-making process.

[0042] Figure 1 The illustrations depict application scenarios of risk handling methods, apparatus, devices, media, and program products according to embodiments of this application.

[0043] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0044] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0045] In the embodiments of this application, the first terminal device 101 can be an example of the first device, and the second terminal device 102 and / or the third terminal device 103 can be an example of at least one second device. The first device and the second device can communicate collaboratively through an internal client mechanism to implement the data distribution and rendering logic described in the risk handling method.

[0046] In some embodiments, the first device and at least one second device may be different display modules, windows or screens on the same computing terminal (such as a host), or multiple physical devices that work together through a network, such as different client instances deployed on a desktop computer, tablet terminal or mobile device respectively.

[0047] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smart mobile terminals, tablet computers, laptop computers, and desktop computers.

[0048] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0049] It should be noted that the risk handling method provided in this application embodiment can generally be executed by server 105. Correspondingly, the risk handling device provided in this application embodiment can generally be located in server 105. The risk handling method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the risk handling device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0050] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0051] The following will be based on Figure 1 The described scene, through Figures 2 to 4 The risk handling methods of the disclosed embodiments are described in detail.

[0052] Figure 2 A flowchart illustrating a risk handling method according to an embodiment of this application is shown.

[0053] like Figure 2 As shown, the risk handling method 200 of this embodiment includes operations S210 to S240.

[0054] In operation S210, multimodal data for the target transaction is acquired, and multimodal features are extracted based on the multimodal data.

[0055] In the embodiments of this application, multimodal data related to the target transaction can be acquired in real time through the interface layer. This multimodal data can originate from the core transaction system, customer relationship management system, and external data sources. For example, when a user performs a transfer, the system not only collects traditional transaction field data but also simultaneously acquires the device's geographical location and interactive behavior data generated during the transaction. For uploaded document images, the image file can be directly accessed through the image acquisition module and incorporated into the feature extraction process as part of the visual data.

[0056] In some embodiments, the extraction of multimodal features can be achieved by combining deep learning models with rule engines. For example, for structured transaction data, the system can use feature engineering methods to extract statistical features such as amount range, transaction time distribution, and transaction frequency; for visual data, the system can use image recognition models to extract features such as the validity period of documents and the consistency of document number positions; for behavioral interaction data, feature vectors of user operation habits can be generated through sequence modeling methods.

[0057] In some embodiments, the system can continuously collect and cache historical data related to the target user through a multimodal data access module, and invoke it for risk analysis of the target transaction when needed. For example, visual data includes not only single ID photos submitted by the user, but also comparison photos submitted in the past, facilitating subsequent consistency checks. As another example, behavioral data is not limited to the sequence of operations within a single transaction, but can also be combined with the user's overall transaction frequency and time distribution over a recent period, thus forming cross-time-period behavioral characteristics. Through this extended data acquisition method, the extracted multimodal features can take into account both short-term behavior and long-term habits, further improving the accuracy of risk identification.

[0058] In some embodiments, the system can employ heterogeneous feature extraction methods for different types of multimodal data. For example, for textual transaction notes or external credit data, the system can introduce natural language processing models to extract key risk words or generate semantic vectors; for relational network data, the system can first generate node connection information between users and accounts through graph construction methods, and then extract the structural features of the local graph as part of the multimodal features.

[0059] In some embodiments, the extraction of multimodal features can also be combined with an incremental update mechanism. For example, when the system detects a new device or account involved in a target transaction, it can generate new device vectors or account features in real time and merge them with existing historical profiles. For visual data, when a user submits document images multiple times, the latest feature values ​​can be selected as the current analysis reference based on the time series.

[0060] In some embodiments, for behavioral and transactional data, the system can extract recent transaction behavior patterns of users through time series modeling methods (such as long short-term memory networks or temporal convolutional networks), such as average daily transaction frequency, common transaction time periods, and amount distribution characteristics. Simultaneously, the system can input the user's keyboard input intervals, mouse trajectory curvature, or touchscreen swipe speed during the transaction process as interactive behavior feature inputs to the model and generate corresponding behavior embedding vectors.

[0061] In some embodiments, the extraction of multimodal features can also be combined with unsupervised learning methods. For example, an autoencoder model can be used to compress and reconstruct a user's historical transaction behavior to generate a low-dimensional embedding vector, and the reconstruction error can be used as an anomaly score. For image data, contrastive learning methods can be used to extract more discriminative image representations. For relational data, graph embedding algorithms can be used to generate node vectors to capture local and global structural features.

[0062] In some embodiments, the system can also employ rule-based and statistical methods as supplementary multimodal features. For example, for transaction data, features such as "daily cumulative transaction amount" and "cross-border transaction ratio" can be manually defined; for image data, outliers in file resolution and file size can be detected as auxiliary features; for behavioral data, the frequency of login location changes or the number of device switches can be calculated to form numerical features. These statistical or rule-based features can be combined with vector features generated by deep learning models to form a richer multimodal feature set.

[0063] In operation S220, cross-modal attention fusion is performed on the multimodal features to obtain a comprehensive risk vector and a corresponding modal weight vector.

[0064] In the embodiments of this application, when processing a target transaction, multimodal features can be fused using cross-modal attention. During this process, the attention mechanism can be used to calculate the correlation and contribution between different modal features. For different types of transactions, the attention mechanism can adaptively assign weights to different modalities. For example, when dealing with new ID card images, visual features have a higher weight, while in high-frequency cross-border transfers, relationship network features may dominate. After this processing, the resulting comprehensive risk vector can fully characterize the transaction risk, and the output modal weight vector reflects the contribution ratio of each modality to the final judgment.

[0065] In some embodiments, the cross-modal attention fusion process can employ a multi-head attention structure to model the interactions between features from different modalities in parallel. Each attention head is responsible for capturing the relationships between specific modalities. For example, the correspondence between visual features and behavioral features can be learned by one attention head, while the neighborhood aggregation of relational network features can be focused on by another attention head. Through the combined output of multi-head attention, a comprehensive risk vector containing both local interaction information and global dependencies can be obtained, thereby enhancing the accuracy and robustness of risk identification.

[0066] In some embodiments, the cross-modal attention fusion process can be further extended to other types of data. For example, when the target transaction involves external news, online comments, or public opinion information, this unstructured data can be encoded first and then incorporated into the fusion process. The attention mechanism dynamically assigns its weights based on the context of the current transaction. If a low relevance is detected, its influence in the overall risk vector is reduced, while when it is highly correlated with transaction risk, it will account for a larger proportion in the fusion result.

[0067] In some embodiments, cross-modal attention fusion can combine residual connections and normalization to enhance numerical stability and prevent gradient vanishing. Through multi-layered attention computation, the resulting comprehensive risk vector can simultaneously preserve the independence of visual, behavioral, and relational features, and capture the interaction relationships between different modalities, making the vector more expressive in subsequent risk identification tasks. Furthermore, the output modal weight vector can serve as an interpretative basis for identifying which modal features primarily contribute to the transaction risk.

[0068] In some embodiments, cross-modal attention fusion can introduce a gating mechanism to suppress the interference of low-quality features on the results. When the system detects anomalies in a certain modality of data (e.g., blurry document images or missing transaction behavior data), the attention mechanism automatically reduces the weight of that modality in the overall risk vector while increasing the influence of other modalities, thereby ensuring the stability and credibility of the final result.

[0069] In some embodiments, the results of cross-modal attention fusion can also be compared with historical composite risk vectors to identify risk evolution trends. By establishing temporal correlations between composite risk vectors generated at different time periods, intermodal dependencies can be captured horizontally while reflecting the changes in risk characteristics over time vertically, thereby forming a temporally enhanced risk representation.

[0070] In the embodiments of this application, after the multimodal features are fused, a comprehensive risk vector and a corresponding modality weight vector can be generated simultaneously. The comprehensive risk vector represents the unified risk representation formed by the fusion of different modal features. It contains multidimensional information from the multimodal features and is a holistic characterization of the target transaction risk state. Through the comprehensive risk vector, the system can express the risk contribution of multimodal data in a unified feature space, thereby providing standardized input for subsequent dynamic baseline comparison and strategy decision-making. The modality weight vector indicates the relative importance of each modality in this risk assessment. When performing cross-modal fusion, the system can differentiate the features of different modalities based on attention mechanisms or other weighted calculation methods. For example, when verifying identity-related transactions, the weight of the visual modality may be higher, while when detecting frequent cross-account transfers, the weight of the relationship network modality may be more prominent. In this way, the modality weight vector can dynamically reflect the contribution ratio of each modality feature in a specific transaction context.

[0071] In operation S230, a transaction dynamic baseline constructed and updated based on historical transaction behavior is obtained, and the deviation of the target transaction from the transaction dynamic baseline is calculated.

[0072] In embodiments of this application, the system can construct a dynamic transaction baseline based on the target user's historical transaction records. The dynamic transaction baseline can be obtained through statistical modeling, for example, by calculating the mean, standard deviation, and frequency distribution of the target user's transaction amounts over a past period to form a reference interval for the user's transaction behavior. When a target transaction (e.g., the current transaction) occurs, the amount, frequency, or time period information of the target transaction can be compared with the dynamic transaction baseline to obtain the deviation. If the deviation exceeds a preset threshold, it indicates that the transaction carries a high risk.

[0073] In the embodiments of this application, the updating of the transaction dynamic baseline can be combined with a sliding time window mechanism. The system can continuously update the user's historical transaction behavior characteristics within a set time window, such as recalculating the transaction pattern within the last seven or thirty days to form new baseline parameters. This can avoid the problem that static thresholds cannot reflect the evolution of user behavior over time and improve the real-time performance of risk identification.

[0074] Furthermore, the dynamic baseline for transactions can be constructed not only based on the historical behavior of a single user, but also by incorporating group behavioral characteristics. For example, the system can first establish typical transaction patterns of similar user groups as a global baseline, and then combine it with the individual baseline of the target user. When a target transaction occurs, its deviation from both the individual and group baselines can be calculated simultaneously, and the degree of risk can be determined based on the combined effect of both. This approach of combining individual and group factors can effectively prevent situations where long-term abnormal user behavior is considered "normal."

[0075] In some embodiments, the calculation of the dynamic baseline can incorporate machine learning methods. For example, the system can use clustering algorithms to classify historical transaction behaviors into patterns, forming multiple clusters of typical transaction behaviors, and compare the target user's current transaction with the center of the most similar cluster to calculate the deviation.

[0076] In some embodiments, the construction of a dynamic baseline can incorporate cross-modal information. For example, the system not only tracks transaction amounts and times but also incorporates device usage habits and geographic location patterns to form a multi-dimensional baseline. When a target transaction occurs, if its device origin or location differs significantly from the historical baseline, even if the transaction amount is within the normal range, a high deviation will be calculated, thereby capturing potential risk signals. This multi-dimensional baseline can more comprehensively reflect the user's true behavioral characteristics.

[0077] In some embodiments, the dynamic baseline can be updated using an incremental learning approach. When new trading data arrives, the user baseline can be updated immediately, rather than being completely rebuilt. For example, an exponentially weighted average method can be used to gradually adjust the baseline parameters, allowing it to quickly adapt to changes in the user's recent trading patterns while maintaining the stability of historical behavior.

[0078] In operation S240, risk processing results are generated using a reinforcement learning policy network based on the comprehensive risk vector, the modality weight vector, and the deviation.

[0079] In the embodiments of this application, after obtaining the comprehensive risk vector, modal weight vector, and transaction deviation, the system can concatenate them into a joint state vector and input it into the reinforcement learning policy network. In this embodiment, the reinforcement learning policy network learns from a large amount of historical transaction data during the training phase. Each transaction sample carries a posterior risk label or disposal result, and the network gradually forms a stable policy through continuous trial and error and feedback. When a target transaction arrives, the network can select a disposal measure from a preset action set based on the input joint state, such as directly approving, rejecting, or transferring to manual review, thereby achieving automated risk handling.

[0080] In other embodiments, the reinforcement learning policy network can employ a deep Q-network structure. After inputting the joint state, a deep neural network estimates the value function of each action and selects the action with the highest value as the output. During this process, the system can continuously update online using new transaction data, enabling the policy to maintain a high level of recognition capability when facing new risk patterns.

[0081] Furthermore, reinforcement learning policy networks can be constructed using policy gradient methods to directly model action distributions. When generating risk handling results, the system can not only output the optimal action but also the probability distribution of that action, thus providing more information for subsequent interpretability analysis. For example, when encountering a high-risk transaction with insufficient evidence, the network may choose "transfer to manual review" with a high probability, while simultaneously providing a second-best option of "reject," enabling risk control personnel to make a more reasonable judgment based on the probability distribution.

[0082] In some embodiments, the system can incorporate a hierarchical action space design when generating risk processing results. For example, the policy network first determines whether the transaction is low-risk, medium-risk, or high-risk. If it is determined to be low-risk, it is directly approved; if it is medium-risk, it enters a secondary policy network to decide whether to transfer it to manual review; and if it is high-risk, it is directly rejected. Through this hierarchical reinforcement learning structure, the system can ensure efficiency while also taking into account the diverse processing needs of complex transaction scenarios.

[0083] In some embodiments, the system can incorporate a multi-objective optimization mechanism while generating risk processing results. Besides risk reduction, user experience and business efficiency can also be considered, and these objectives can be incorporated into the reinforcement learning reward function in a weighted manner. For example, while ensuring security, the proportion of manual review can be minimized to increase the automatic approval rate. Through multi-objective optimization, the risk processing results generated by the reinforcement learning policy network can dynamically achieve a balance between security and efficiency.

[0084] According to embodiments of this application, by fusing multi-source heterogeneous information and generating a unified risk representation, the importance of key features can be highlighted while maintaining information comprehensiveness, thereby avoiding the one-sidedness caused by traditional methods relying on single data. A dynamic baseline formed by combining historical behavioral patterns allows risk assessment to move beyond static thresholds and continuously update over time, better aligning with users' actual trading habits. Finally, an adaptive learning mechanism is introduced in the decision-making process, enabling the system to continuously optimize strategies based on feedback. This reduces false positive and false negative rates while maintaining business efficiency and transparency, thereby improving the accuracy, real-time performance, and interpretability of overall risk identification and processing.

[0085] The risk handling method of this application will be specifically described below by way of preferred embodiments.

[0086] In the embodiments of this application, multimodal data includes at least visual data, behavioral and transactional data, and relationship network data. Visual data may include image information such as ID card images, selfies, and scanned copies of business licenses submitted by users during account opening or transactions. Features related to identity verification can be obtained through image recognition and character extraction. Behavioral and transactional data may include user interaction behavior characteristics and transaction flow information during actual operation, such as keyboard input rhythm, touchscreen swipe trajectory, transaction amount, time and location distribution, reflecting user behavior patterns and transaction habits. Relationship network data can reflect the relationships between different entities, such as the binding of user accounts to devices, fund transfers between multiple accounts, and transaction connections between accounts and merchants. Constructing heterogeneous relationship graphs can capture potential risk propagation paths. Furthermore, the aforementioned multimodal data can undergo feature fusion and interactive modeling during collection, storage, and processing, thereby achieving cross-modal information complementarity and semantic enhancement, effectively improving the accuracy and robustness of risk identification. By simultaneously acquiring and utilizing the above three types of multimodal data, the system can characterize the target transaction in different dimensions, thereby providing a more comprehensive and reliable foundation for subsequent feature extraction and risk analysis.

[0087] In the embodiments of this application, the system can extract multimodal features based on multimodal data to achieve multi-dimensional risk characterization of target transactions. Specifically, for visual data, the system can automatically extract key information fields from images such as ID cards and business licenses using optical character recognition technology. Simultaneously, it combines image anti-counterfeiting detection and tampering trace detection methods to identify issues such as missing watermarks, inconsistent fonts, and pixel anomalies in the document images, and generates document authenticity features accordingly. For behavioral and transactional data, the system can construct long-term behavioral profiles and session-level behavioral profiles of target users, mapping data such as transaction amount, time, device usage habits, and interaction operation trajectories into vector representations to extract behavioral embedding vectors. Furthermore, by comparing the differences between the long-term profile and the current profile, a profile stability index is generated to measure the degree of abnormality in the user's current behavior. For relational network data, the system can extract the target heterogeneous subgraph related to the target transaction from the heterogeneous graph composed of pre-built entities such as accounts, devices, and merchants. Then, it can use graph neural networks to perform message passing and feature aggregation on the subgraph to obtain the embedded representation of the node or subgraph. Based on this, the system can calculate the relational risk features to reflect the potential risk level of the target user in the overall network.

[0088] In some embodiments, for visual data, the system can not only perform optical character recognition to extract key information from the document, but also combine deep convolutional neural networks to detect texture features of the document image, such as the integrity of watermarks, dark patterns, and holographic markings. When abnormal pixel distribution or unnatural font splicing is detected, anomaly markers can be generated to enhance the credibility of the document's authenticity features. Furthermore, the system can also associate user selfies with ID photos through face comparison and liveness detection to determine whether the submitted image matches the actual user, thereby improving the accuracy of visual modality recognition.

[0089] In some embodiments, feature extraction of behavioral and transactional data can be combined with time series modeling methods. The system can construct long-term transaction curves based on a user's past transaction behavior, such as the distribution of transaction amounts over the past month, common transaction periods, and frequently used payees, and generate long-term behavioral embedding vectors through recurrent neural networks or temporal convolutional networks. Simultaneously, during a single transaction, micro-behavioral information such as keyboard input intervals, mouse trajectory shapes, and touchscreen swipe speeds can be collected in real time and mapped to session-level vector representations. By comparing the long-term vectors and session-level vectors, the system can generate a profile stability index to characterize whether the current behavior deviates from historical habits.

[0090] In some embodiments, the system can combine a rule engine with model-based methods to perform hybrid feature extraction on multimodal data. For transaction data, features can be generated using statistical methods, such as "daily cumulative amount" and "frequency of logins from different locations"; for visual data, auxiliary features can be generated by introducing image sharpness detection or format consistency detection; for relational network data, graph statistical indicators such as node degree, clustering coefficient, or path length can be calculated. The aforementioned rule-based and statistical features can be combined with embedding vectors generated by deep models to form a more comprehensive feature set.

[0091] In a further implementation, the system can also utilize large-scale pre-trained models as the basis for feature extraction. For example, a pre-trained visual recognition model can be used to extract deep semantic features from document images, a language model can be used to generate semantic vectors from transaction notes or external text data, and a pre-trained graph neural network can be used to learn embeddings for relational subgraphs.

[0092] By extracting features from multimodal information such as visual data, behavioral and transaction data, and relational network data, it is possible not only to identify the authenticity and consistency of document images, but also to capture the deviations in users' long-term and short-term behavioral patterns and reveal the potential complex relationships between transaction entities, generating more comprehensive, fine-grained, and discriminative feature representations, thereby improving the coverage, accuracy, and robustness of risk identification.

[0093] In the embodiments of this application, by combining the user's long-term transaction behavior patterns with the real-time interactive behavior in the current transaction process, integrated modeling and deviation detection of user behavior can be achieved, thereby providing more accurate and dynamic feature support for subsequent risk identification and handling.

[0094] Figure 3 The flowchart illustrates a method for obtaining behavioral embedding vectors and profile stability metrics from behavioral profiles according to some exemplary embodiments of this application.

[0095] like Figure 3 As shown, the method for obtaining behavioral embedding vectors and profile stability indicators of behavioral profiles includes operations S310 to S330.

[0096] When operating S310, obtain a long-term behavioral profile of the target user based on historical transaction data.

[0097] For example, long-term behavioral profiles can be generated by statistically modeling a user's transaction records over the past few months or years. These profiles include dimensions such as the user's average transaction amount, transaction amount distribution range, transaction frequency, preferred transaction time periods, and common receiving accounts. To enhance the stability of the profile, the system can use a sliding window technique to dynamically update historical data, for example, using transaction data from the most recent 30 or 90 days as a benchmark to reflect the user's typical recent behavioral patterns.

[0098] In some embodiments, long-term behavioral profiles can also be constructed using time series modeling methods, such as training historical transaction sequences with recurrent neural networks to generate vector representations that can capture behavioral evolution trends.

[0099] In operation S320, a session-level behavioral profile is generated based on the interaction events of the target transaction, and a behavioral embedding vector is extracted based on the session-level behavioral profile.

[0100] In the embodiments of this application, the session-level behavioral profile can be used to characterize the real-time behavioral features of a user during the current transaction process. For example, the interaction event may include information such as transaction amount, transaction type, payment channel, geographical location, device identifier, login method, and operation path.

[0101] In some embodiments, the system can also collect micro-behavioral data of users during the interaction process, such as the interval of keyboard input, the sliding trajectory of the touch screen, the movement curve of the mouse and the click frequency, and map these time-series data into high-dimensional vectors through feature engineering or deep learning models.

[0102] Furthermore, the session-level behavioral profile can be input into the embedding network for encoding, and the resulting behavioral embedding vector can represent the current session's operating pattern in a compact form, thereby enabling rapid comparison with long-term profiles during risk assessment.

[0103] In operation S330, the long-term behavioral profile and the session-level behavioral profile are compared, and the profile stability index is calculated.

[0104] The comparison process can be implemented in several ways. For example, the statistical differences between the two can be calculated directly, such as comparing the deviation of transaction amount ranges, the consistency of transaction time periods, or the differences in device usage frequency; or, the vector representations of long-term profiles and session-level profiles can be input into a similarity calculation model, and measures such as cosine similarity, Euclidean distance, or Manhattan distance can be used to measure the differences.

[0105] By combining long-term behavioral profiles with conversation-level behavioral profiles, information about users' long-term stable habits is preserved, while sudden deviations in individual transactions can be sensitively captured, thus ensuring robustness while providing high-risk detection flexibility.

[0106] In the embodiments of this application, an unsupervised learning-based anomaly detection method can be used to compare long-term behavioral profiles with conversation-level behavioral profiles, and a profile stability index can be calculated accordingly.

[0107] Specifically, the long-term behavioral profile generated based on historical transaction data and the session-level behavioral profile of the current transaction can be converted into vector representations respectively, and then used as inputs to the anomaly detection algorithm for analysis.

[0108] In some embodiments, the anomaly detection algorithm may employ the isolated forest method, which identifies outliers by recursively segmenting the feature space and outputs an anomaly score characterizing the degree of deviation. In other embodiments, the anomaly detection algorithm may employ an autoencoder, which measures the reconstruction error by reconstructing the input vector. If the session-level profile differs significantly from the long-term profile, the reconstruction error increases, resulting in a higher anomaly score. In still other embodiments, the anomaly detection algorithm may employ the local anomaly factor method, which determines the consistency between the current profile and historical patterns by comparing the differences in local neighborhood density. If the density deviates significantly, a higher anomaly score is generated.

[0109] After obtaining anomaly scores, the system can map them to a profile stability index, which quantifies the difference between current session behavior and long-term behavior patterns. If this index exceeds a preset threshold, it indicates that the user's current transaction behavior is significantly abnormal compared to historical habits, thus highlighting potential risks.

[0110] In this way, the system can combine the results of multiple unsupervised detection methods to flexibly quantify the degree of deviation of user behavior, effectively improving the accuracy and robustness of risk identification.

[0111] In the embodiments of this application, a method for obtaining relational risk features based on heterogeneous graphs is also proposed. This method constructs local subgraphs related to the target transaction within the transaction network and uses graph neural networks for feature learning within the subgraphs, which can effectively capture the direct and indirect relationships between entities, thereby revealing potential risk associations.

[0112] Figure 4 The flowchart illustrates a method for obtaining relational risk characteristics of a target heterogeneous subgraph according to some exemplary embodiments of this application.

[0113] like Figure 4 As shown, the method for obtaining the relational risk characteristics of the target heterogeneous subgraph includes operations S410 to S430.

[0114] In operation S410, taking the transaction-related entity of the target transaction as the central node, a target heterogeneous subgraph containing neighbors with a preset number of hops is extracted from the pre-constructed heterogeneous graph.

[0115] In the embodiments of this application, the heterogeneous graph can be composed of various entity types and relational edges, such as user accounts, merchants, devices, network addresses, etc. as nodes, and fund transfers, device sharing, identity binding, etc. as edges. When extracting the target heterogeneous subgraph, the system can take the account or device involved in the target transaction as the center and expand outward to neighbor nodes with a certain number of hops. For example, a one-hop neighbor represents a direct transfer relationship, and a two-hop neighbor represents an indirect relationship through an intermediate account.

[0116] According to embodiments of this application, the preset number of hops can be adjusted according to the needs of risk identification. The larger the number of hops, the wider the coverage of the subgraph, which can reveal more complex potential risk links, but at the same time, the computational overhead is also higher.

[0117] In operation S420, message passing and feature aggregation of a graph neural network are performed on the target heterogeneous subgraph to generate node embedding representations.

[0118] Graph neural networks iteratively update subgraphs, enabling each node to incorporate information from its neighbors to obtain a representation that includes the context structure. During message passing, each node receives representation information from its neighbors and combines it with its own features. In feature aggregation, nodes integrate neighbor information into the updated representation, gradually forming an embedding vector that includes both local relationships and reflects the global context. After multiple iterations, each node's embedding representation not only includes its own attribute information but also reflects its position within the network structure and its neighborhood features, thus providing input for subsequent risk calculation.

[0119] In operation S430, the relationship risk score of the central node is calculated based on the node embedding representation to obtain the relationship risk characteristics.

[0120] In some embodiments, the system can design a scoring function that maps the embedding vector of the central node to a numerical risk indicator, such as outputting a risk score through a feedforward neural network or logistic regression model. In some embodiments, the risk score can also incorporate the average or maximum risk level of neighboring nodes to reflect the relative positional risk of the central node within the entire relationship network. For example, when multiple neighboring nodes of an account are closely associated with known high-risk accounts, the risk score of that account will increase significantly. Ultimately, the relationship risk feature will serve as an important input feature, used in conjunction with visual and behavioral features for comprehensive risk assessment.

[0121] Using the methods described above, the system can automatically identify local structures related to target transactions within complex heterogeneous relationship networks and extract multi-hop neighbor information. This allows risk identification to not only rely on individual transaction features but also comprehensively consider the context and potential indirect connections. By utilizing graph neural networks for message passing and feature aggregation within subgraphs, network structure information can be transformed into numerical node embedding representations, thereby capturing hidden risk propagation paths and group characteristics. The resulting relationship risk features accurately reflect the target entity's location and association risks within the network. Compared to traditional analysis methods that rely on single-point or unilateral relationships, this approach is more comprehensive, dynamic, and robust, helping to improve the system's ability to identify complex collaborative risks and potential abnormal transactions.

[0122] In embodiments of this application, the graph neural network used to perform message passing and feature aggregation on the target heterogeneous subgraph may include an attention graph neural network. When updating node information, the attention graph neural network assigns differentiated weights to different neighbor nodes, rather than averaging all neighbors. Therefore, the central node can highlight neighbor nodes with strong correlation or potential risk value when aggregating information. For example, in the account subgraph associated with the target transaction, neighbor nodes that frequently transfer funds to high-risk accounts will receive higher weights, while ordinary neighbor nodes with low-frequency transactions will receive lower weights, thus naturally amplifying risk signals in the embedding representation. Through this mechanism, the attention graph neural network can achieve selective aggregation of neighbor information, making the generated node embedding vectors more discriminative and flexible in expressing risk features.

[0123] In embodiments of this application, the graph neural network may include a graph isomorphic network. Graph isomorphic networks prioritize preserving the structural information of subgraphs when updating node representations. Their core principle is to ensure, through isomorphism constraints, that a node's representation reflects its position and role within the overall subgraph structure. For example, two nodes with similar local structures in different subgraphs will obtain similar embedding representations through a graph isomorphic network, thus achieving consistent comparison across subgraphs. In risk identification scenarios, this means that even if the target account's trading behavior does not currently exhibit obvious anomalies, if its trading relationship structure is highly similar to historically known high-risk structures, its embedding representation will still reflect a high risk correlation. By introducing structure preservation and information enhancement mechanisms, graph isomorphic networks can strengthen the role of topological structure during feature aggregation, thereby avoiding information loss problems caused by relying solely on local node attributes.

[0124] It should be noted that attention-based graph neural networks and graph isomorphic networks can be used individually or in combination. When used individually, the system can choose according to actual needs: when the focus is on distinguishing the importance of different neighbor nodes, attention-based graph neural networks can be used first; when the focus is on maintaining the isomorphic characteristics of the overall graph structure, graph isomorphic networks can be used first. When used in combination, the graph isomorphic network can be used first to perform structural embedding learning on the target heterogeneous subgraph, preserving the topological pattern and overall structural features, and then an attention mechanism can be introduced to further highlight the influence of high-risk neighbors.

[0125] By introducing attention-based graph neural networks and graph isomorphic networks into the acquisition of relational risk features, embodiments of this application can balance the representation of local features and the overall structure. When using attention-based graph neural networks, the system can dynamically allocate the weights of neighboring nodes during message passing, thereby highlighting neighbor information closely related to risk and improving the sensitivity and discriminativeness of risk signals. When using graph isomorphic networks, the system can maintain the isomorphism and consistency of the subgraph structure during feature aggregation, enabling node embeddings to accurately reflect their position and pattern in the transaction network, thus improving the expressive power at the structural level. In some embodiments, the two networks can also be used in combination, preserving both topological patterns and global structural features while highlighting the differentiated contributions of high-risk neighbors, thereby generating more robust and expressive relational risk features.

[0126] In the embodiments of this application, after obtaining the comprehensive risk vector, modal weight vector, and deviation, these three can be combined to form a joint state, which is then input into a reinforcement learning policy network for processing. During the training phase, the reinforcement learning policy network can optimize its learning based on a large amount of historical transaction data, accumulating a better decision-making strategy through continuous trial and error and feedback. During the inference phase, when the joint state of the target transaction is input, the policy network can automatically select the most appropriate action from a predefined action space. For example, the action space can include actions such as "pass directly," "reject transaction," or "transfer to manual review," and the system outputs the corresponding risk handling result based on the selected action. In this way, risk handling no longer relies on fixed threshold judgments or static rules, but can adaptively select actions under different combinations of risk characteristics, thereby improving the flexibility and accuracy of risk handling.

[0127] Furthermore, reinforcement learning policy networks can simultaneously consider multi-dimensional factors when generating risk processing results, such as transaction risk level, business efficiency requirements, and the resource consumption of manual review, and dynamically balance these factors. Thus, the system can decisively reject high-risk transactions, transfer transactions to manual review when there is significant risk uncertainty, and quickly approve low-risk transactions, thereby ensuring both security and business continuity and user experience.

[0128] In embodiments of this application, the process may further include optimizing the reinforcement learning policy network based on post-transaction performance. Specifically, after generating and executing the risk processing result, the system can continuously track the actual performance of the transaction in the post-transaction phase, such as whether the transaction was subsequently confirmed to have risk, whether there were any abnormal fund transactions, and whether it was confirmed to be correct through manual review. Based on the above information, the system can construct a reward signal: a positive reward is given when the processing result is consistent with the post-transaction performance, and a negative reward is given when the processing result is inconsistent with the actual result. Subsequently, the parameters of the reinforcement learning policy network can be updated using this reward signal, enabling it to better adjust its decision-making strategy in subsequent risk assessments.

[0129] Through a self-correction mechanism based on ex-post performance, the system can continuously optimize the accuracy and robustness of risk handling, gradually reduce false alarm and false negative rates, thereby forming a dynamically evolving adaptive risk control model.

[0130] In the embodiments of this application, the transparency and traceability of the risk identification and handling process can be ensured based on an interpretable artificial intelligence generation and auditing mechanism. This mechanism, while the system makes a risk handling decision, can analyze key factors influencing the decision and generate corresponding explanatory data to assist in manual review and compliance checks.

[0131] In some embodiments, after generating the risk processing result, the system can calculate the contribution of the input multimodal features to identify which modalities and which features within them play a key role in the final result. For example, the system can invoke existing interpretability computing frameworks, such as feature perturbation-based contribution analysis methods or gradient-based sensitivity analysis methods, to quantify the degree of influence of each feature on the final result.

[0132] In some embodiments, the system can not only output quantitative feature importance results, but also generate structured explanatory reports based on these results. The explanatory reports clearly demonstrate the basis for risk handling results, such as indicating that a transaction was flagged as abnormal because its behavioral pattern significantly deviated from the user's long-term profile, or was rejected because of multi-hop connections to high-risk accounts in the relationship network. The reports can also present the weight distribution of each modality in the form of visual charts, enabling reviewers to intuitively understand the system's judgment logic.

[0133] Furthermore, the generated explanatory data can be recorded along with the risk processing procedure to form a complete audit log. The audit log includes not only the final risk outcome but also the key features referenced during risk assessment, modal weights, and the generated explanatory information. These logs can be stored long-term for use in subsequent compliance checks, risk reviews, or model iteration and optimization.

[0134] By introducing the aforementioned explainable AI-generated and audited mechanisms, the system maintains its advantages of automation and intelligence while avoiding "black box" decision-making problems, ensuring that the processing results of each transaction have clear explanations and verifiable evidence. This not only improves the work efficiency of auditors but also helps meet the stringent requirements for transparency and compliance in the financial risk control field.

[0135] According to embodiments of this application, comprehensive risk characterization can be achieved based on multimodal data. This includes not only verifying the authenticity of visual data but also integrating dynamic deviation detection of behavioral and transaction data, and revealing potential multi-hop association risks by combining relational network data, thereby avoiding the one-sidedness caused by a single data source. By generating a comprehensive risk vector and modality weight vector through cross-modal attention fusion, the system can dynamically highlight the contribution of key modalities in different scenarios, improving the accuracy and flexibility of risk representation. Combined with dynamic baselines and deviation calculations built based on historical transaction behavior, the method can adaptively reflect the evolution of user behavior over time, enhancing sensitivity to abnormal behavior. By introducing a reinforcement learning policy network, the system can automatically select appropriate handling measures under different combinations of risk characteristics and continuously optimize through post-event feedback, reducing false positives and false negatives. Furthermore, by using an interpretability mechanism to analyze and record key features of risk handling results, not only is the transparency and traceability of the decision-making process guaranteed, but a reliable basis is also provided for manual review and compliance checks. In summary, embodiments of this application achieve comprehensiveness, dynamism, adaptability, and interpretability in risk identification, effectively improving the accuracy and credibility of the overall risk control system.

[0136] Corresponding to the above-described risk management method, embodiments of this application also provide a risk management device.

[0137] Figure 5 A schematic block diagram of a risk handling apparatus according to an embodiment of this application is shown.

[0138] like Figure 5 As shown, the risk processing device 500 of this embodiment includes a data acquisition module 510, a feature fusion module 520, an offset calculation module 530, and a risk processing module 540.

[0139] The data acquisition module 510 can be used to acquire multimodal data for a target transaction and extract multimodal features based on the multimodal data. In one embodiment, the data acquisition module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0140] The feature fusion module 520 can be used to perform cross-modal attention fusion on the multimodal features to obtain a comprehensive risk vector and a corresponding modality weight vector. In one embodiment, the feature fusion module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0141] The offset calculation module 530 can be used to obtain a transaction dynamic baseline constructed and updated based on historical transaction behavior, and calculate the deviation of the target transaction relative to the transaction dynamic baseline. In one embodiment, the offset calculation module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0142] The risk processing module 540 can be used to generate a risk processing result using a reinforcement learning policy network based on the comprehensive risk vector, the modality weight vector, and the deviation. In one embodiment, the risk processing module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0143] According to embodiments of this application, the multimodal data includes at least visual data, behavioral and transactional data, and relational network data. The data acquisition module 510 can also be used to perform optical character recognition on the visual data and generate document authenticity features based on image anti-counterfeiting detection and tampering trace detection; obtain behavioral embedding vectors and profile stability indicators of the behavioral and transactional data using behavioral profiling; and extract target heterogeneous subgraphs from a pre-constructed heterogeneous graph based on the relational network data, and obtain relational risk features of the target heterogeneous subgraphs using graph neural networks.

[0144] According to an embodiment of this application, the data acquisition module 510 can also be used to acquire a long-term behavioral profile of a target user constructed based on historical transaction data; generate a session-level behavioral profile based on the interaction events of the target transaction; extract behavioral embedding vectors based on the session-level behavioral profile; and compare the long-term behavioral profile with the session-level behavioral profile to calculate the profile stability index.

[0145] According to an embodiment of this application, the data acquisition module 510 can also be used to extract a target heterogeneous subgraph containing neighbors with a preset number of hops from the pre-constructed heterogeneous graph, using the transaction-related entity of the target transaction as the central node; perform message passing and feature aggregation of a graph neural network on the target heterogeneous subgraph to generate a node embedding representation; and calculate the relationship risk score of the central node based on the node embedding representation to obtain the relationship risk features. The graph neural network includes at least one of the following: an attention graph neural network, used to introduce attention weights during message passing in the target heterogeneous subgraph; and a graph isomorphic network, used to introduce a structure preservation mechanism and an information enhancement mechanism during message passing and feature aggregation in the target heterogeneous subgraph.

[0146] According to an embodiment of this application, the data acquisition module 510 can also be used to input the long-term behavioral profile and the session-level behavioral profile into an unsupervised learning anomaly detection algorithm and output anomaly scores, wherein the anomaly detection algorithm includes at least one of isolated forest, autoencoder and local anomaly factor; and to obtain the profile stability index based on the anomaly scores.

[0147] According to an embodiment of this application, the risk processing module 540 can also be used to input the joint state composed of the comprehensive risk vector, the modality weight vector and the deviation into the reinforcement learning policy network; and to select a disposal measure in a predefined action space, and generate a risk processing result based on the disposal measure.

[0148] According to an embodiment of this application, the risk processing module 540 can also be used to obtain post-trade performance, construct a reward signal based on the post-trade performance, and update the parameters of the reinforcement learning strategy network using the reward signal.

[0149] According to an embodiment of this application, the risk processing device 500 further includes an interpretation module. The interpretation module can be used to obtain target features corresponding to the risk processing result, perform importance calculation on the target features, sort the target features according to the importance calculation result, obtain a feature set representing the influence of the risk processing result, and generate interpretation data based on the feature set.

[0150] According to embodiments of this application, any multiple modules among the data acquisition module 510, feature fusion module 520, offset calculation module 530, and risk processing module 540 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the data acquisition module 510, feature fusion module 520, offset calculation module 530, and risk processing module 540 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the data acquisition module 510, feature fusion module 520, offset calculation module 530, and risk processing module 540 may be implemented at least partially as a computer program module, which can perform corresponding functions when the computer program module is run.

[0151] Figure 6 A block diagram schematically illustrates an electronic device suitable for implementing a risk management method according to an embodiment of this application.

[0152] like Figure 6 As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0153] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0154] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0155] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0156] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0157] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code is used to enable the computer system to implement the risk handling methods provided in the embodiments of this application.

[0158] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0159] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0160] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0161] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0162] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0163] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0164] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. A risk management method, characterized in that, The method includes: Acquire multimodal data for the target transaction, and extract multimodal features based on the multimodal data; Cross-modal attention fusion is performed on the multimodal features to obtain a comprehensive risk vector and a corresponding modal weight vector; Obtain a dynamic trading baseline constructed and updated based on historical trading behavior, and calculate the deviation of the target transaction relative to the dynamic trading baseline; and Based on the comprehensive risk vector, the modality weight vector, and the deviation, a risk processing result is generated using a reinforcement learning policy network.

2. The method according to claim 1, characterized in that, The multimodal data includes at least visual data, behavioral and transactional data, and relational network data.

3. The method according to claim 2, characterized in that, The extraction of multimodal features based on the multimodal data includes: Optical character recognition is performed on the visual data, and document authenticity features are generated based on image anti-counterfeiting detection and tampering trace detection; The behavioral embedding vectors and profile stability metrics of the behavioral and transactional data are obtained using behavioral profiling; and Based on the aforementioned relational network data, target heterogeneous subgraphs are extracted from pre-constructed heterogeneous graphs, and relational risk features of the target heterogeneous subgraphs are obtained using graph neural networks.

4. The method according to claim 3, characterized in that, The process of obtaining behavioral embedding vectors and profile stability metrics from behavioral profiles of behavioral and transactional data includes: Obtain long-term behavioral profiles of target users based on historical transaction data; Generate a session-level behavioral profile based on the interaction events of the target transaction, and extract behavioral embedding vectors based on the session-level behavioral profile; and The long-term behavioral profile and the session-level behavioral profile are compared to calculate the profile stability index.

5. The method according to claim 3, characterized in that, The step of extracting target heterogeneous subgraphs from pre-constructed heterogeneous graphs based on the relational network data, and obtaining relational risk features of the target heterogeneous subgraphs using graph neural networks, includes: Using the transaction-related entity of the target transaction as the central node, extract the target heterogeneous subgraph containing neighbors with a preset number of hops from the pre-constructed heterogeneous graph; Message passing and feature aggregation of a graph neural network are performed on the target heterogeneous subgraph to generate node embedding representations; and The relationship risk score of the central node is calculated based on the node embedding representation to obtain the relationship risk characteristics.

6. The method according to claim 5, characterized in that, The graph neural network includes at least one of the following: Attention graph neural network is used to introduce attention weights during message passing in the target heterogeneous subgraph; Graph homogeneous networks are used to introduce structure preservation and information enhancement mechanisms during message passing and feature aggregation of the target heterogeneous subgraph.

7. The method according to claim 4, characterized in that, The step of comparing the long-term behavioral profile and the session-level behavioral profile to calculate the profile stability index includes: The long-term behavioral profile and the conversation-level behavioral profile are input into an unsupervised learning anomaly detection algorithm, which outputs anomaly scores. The anomaly detection algorithm includes at least one of isolated forest, autoencoder, and local anomaly factor. The profile stability index is obtained based on the anomaly score.

8. The method according to claim 1, characterized in that, The process of generating risk processing results using a reinforcement learning policy network based on the comprehensive risk vector, the modality weight vector, and the deviation includes: The joint state, consisting of the integrated risk vector, the modality weight vector, and the deviation, is input into the reinforcement learning policy network. as well as Select a response measure from a predefined action space, and generate a risk management result based on the response measure.

9. The method according to claim 8, characterized in that, The method further includes: Obtain post-trade performance data, and construct a reward signal based on the post-trade performance data; and The parameters of the reinforcement learning policy network are updated using the reward signal.

10. The method according to claim 1, characterized in that, The method further includes: Obtain the target features corresponding to the risk processing results, and calculate the importance of the target features; The target features are sorted according to the importance calculation results to obtain a feature set that represents the impact on the risk treatment results; as well as Explanatory data is generated based on the feature set.

11. A risk management device, characterized in that, The device includes: The data acquisition module is used to: acquire multimodal data for the target transaction, and extract multimodal features based on the multimodal data; The feature fusion module is used to: perform cross-modal attention fusion on the multimodal features to obtain a comprehensive risk vector and a corresponding modal weight vector; The offset calculation module is used to: obtain a dynamic trading baseline constructed and updated based on historical trading behavior; and calculate the deviation of the target transaction relative to the dynamic trading baseline; and The risk processing module is used to generate risk processing results using a reinforcement learning policy network based on the comprehensive risk vector, the modality weight vector, and the deviation.

12. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 10.

13. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

14. A computer program product comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 10.

Images