Financial risk control and anomaly detection method and system based on graph neural network

Abstract

The invention provides a financial risk control and anomaly detection method and system based on a graph neural network, and relates to the field of financial risk control, and the method comprises the steps: constructing a financial transaction graph network, constructing a feature graph in combination with transaction time sequence information, extracting a time sequence feature vector, calculating a risk propagation feature vector, and determining a node embedding vector and a fusion node vector. And constructing a transaction flow diagram and carrying out community division, and finally determining an abnormal transaction community through fuzzy clustering and carrying out early warning.

Description

Technical Field

[0001] This invention relates to the field of financial risk control technology, and in particular to a financial risk control and anomaly detection method and system based on graph neural networks. Background Technology

[0002] With the rapid development of internet finance, online transactions are becoming increasingly frequent, and the security risks of financial transactions are also increasing. Traditional financial risk control methods mainly rely on rule engines and simple machine learning algorithms, which are difficult to cope with the increasing financial risks. Financial risk control and anomaly detection methods based on graph neural networks are gradually becoming a new way to solve the problem of identifying abnormal transactions in complex financial networks. However, existing graph neural networks still lack comprehensive utilization of transaction time-series information and network topology when implementing financial risk control and abnormal transaction detection. They cannot effectively capture the time-series evolution patterns and risk propagation paths of financial transactions, resulting in limited risk identification capabilities and difficulty in modeling dynamic interaction relationships between nodes. Especially in large-scale financial networks, they cannot accurately characterize the context-aware characteristics and relative position information of nodes, leading to incomplete risk assessment of transaction nodes and inability to effectively identify abnormal fund flows across communities. In particular, their detection performance is poor in complex scenarios such as multi-level fund transfers. Summary of the Invention

[0003] This invention provides a financial risk control and anomaly detection method and system based on graph neural networks, which can at least solve some of the problems existing in the prior art.

[0004] A first aspect of this invention provides a financial risk control and anomaly detection method based on graph neural networks, comprising: Collect user-submitted transaction data, construct a financial transaction graph network based on the transaction data, construct a transaction sequence feature map for each account node in the financial transaction graph network based on transaction time sequence information, extract local transaction patterns through causal convolution to obtain time sequence feature vectors, construct transaction relationship propagation paths based on the neighbor nodes of each account node and calculate risk propagation probability to obtain risk propagation feature vectors; The temporal feature vector and the risk propagation feature vector are concatenated, and an initial node embedding vector is determined by combining the graph neural network. The node correlation matrix is ​​calculated based on the initial node embedding vector. The context-aware node vector is calculated by combining the relative position of each account node and stacked to obtain the fused node vector. Based on the fused node vector, an account transaction flow graph is constructed and the transaction behavior pattern of each transaction node is determined. The transaction objects of each transaction node are divided into communities and cross-community transaction features are calculated. Transaction flow features are extracted and combined with the cross-community transaction features. Abnormal transaction communities are identified through fuzzy clustering and warning information is output.

[0005] In one alternative implementation, A financial transaction graph network is constructed based on the transaction data. For each account node in the financial transaction graph network, a transaction sequence feature map is constructed based on transaction time-series information. The time-series feature vector is obtained by extracting local transaction patterns through causal convolution, including: Based on the transaction data, the source node and target node of the transaction are taken as account nodes, the transaction edges are determined based on the transaction relationship between the account nodes, and the edge weights are determined based on the transaction amount, thus obtaining a financial transaction graph network. The transaction sequence data corresponding to each account node in the financial transaction graph network is extracted. The transaction mutation degree is determined by calculating the mean and standard deviation of the transaction amount of the transaction sequence data within a unit time. Based on the transaction mutation degree, key event points are determined and resampling is performed based on the key event points to obtain a transaction sequence feature map. The transaction sequence feature map is added to a pre-set variational causal convolutional network, and feature extraction is performed in combination with a pre-set information bottleneck constraint. Forward and reverse verification are performed on the extracted causal features respectively. The difference between the verification results is calculated and a bidirectional causal consistency loss is constructed. The temporal feature vector corresponding to the local transaction pattern is obtained based on the bidirectional causal consistency loss and the information bottleneck constraint.

[0006] In one alternative implementation, Based on the neighbor nodes of each account node, a transaction relationship propagation path is constructed and the risk propagation probability is calculated, resulting in a risk propagation feature vector including: For each account node, extract the set of neighbor nodes corresponding to the current account node, and calculate the transaction intensity between the current account node and each neighbor node based on the pre-acquired transaction amount and transaction frequency, combined with the pre-set time decay coefficient, and construct a transaction relationship matrix; Historical risk events between account nodes and each neighbor node are extracted separately, a historical risk time set is constructed, and the risk correlation coefficient is calculated by determining the number of intersections and unions. Based on the transaction relationship matrix and the risk correlation coefficient, the risk propagation probability between different node pairs in the financial transaction graph network is obtained. Based on the risk propagation probability, a propagation path containing multiple account nodes is constructed. The initial risk probability corresponding to the starting node on the propagation path is calculated. The joint path probability is calculated in combination with the risk propagation probability. The distance decay rate is initialized based on the transaction intensity and the length of each propagation path, and the decay center point is set. The path propagation probability is calculated in combination with the joint path probability. The statistical features of the path propagation probability are extracted to obtain the risk propagation feature vector.

[0007] In one alternative implementation, The temporal feature vector and the risk propagation feature vector are concatenated, and an initial node embedding vector is determined using a graph neural network. A node correlation matrix is ​​calculated based on the initial node embedding vector. A context-aware node vector is then calculated by combining the relative position of each account node and stacked to obtain a fused node vector, including: The fused feature vector is obtained by sequentially combining each dimension value of the time series feature vector and each dimension value of the risk propagation feature vector according to a pre-set dimension order. The fused feature vector is then added to a pre-set graph neural network, and the initial node embedding vector is obtained through feature transformation. The feature similarity between the account node and its neighboring nodes is calculated based on the initial node embedding vector. The feature similarity is then non-linearly mapped, and a node association matrix is ​​constructed based on the mapping result. The relative position code is determined based on the shortest path distance between different account nodes in the financial transaction graph network. The relative position code is fused with the initial node embedding vector, and the context-aware node vector is obtained by combining the node correlation matrix. The context-aware node vectors corresponding to different time sequences are stacked to obtain the fused node vector.

[0008] In one alternative implementation, Based on the initial node embedding vector, the feature similarity between the account node and its neighboring nodes is calculated. A non-linear mapping is then performed on the feature similarity, and a node association matrix is ​​constructed based on the mapping result, including: The initial node embedding vector is transformed using a pre-set feature transformation matrix, and a bias vector is added to obtain the financial transaction features; Extract the inflow and outflow of funds between the account node and the neighbor node within a preset time window. Calculate the fund balance based on the inflow and outflow of funds. Combine the fund flow characteristics to obtain the fund flow similarity. Based on the fund flow similarity and the transaction strength between the account node and the neighbor node, combine the initial node embedding vector to obtain the feature similarity. Obtain the fund size between the account node and the neighbor node, calculate the ratio of the fund size to the preset standard fund size, initialize an adaptive factor based on the ratio, and perform sigmoid mapping on the feature similarity based on the adaptive factor to obtain the mapping result; A directional factor is determined based on the direction of fund flow between the account node and the neighbor node, and the node correlation matrix is ​​constructed based on the directional factor and the mapping result.

[0009] In one alternative implementation, Based on the fused node vectors, an account transaction flow graph is constructed, and the transaction behavior pattern of each transaction node is determined. The transaction objects of each transaction node are then divided into communities, and cross-community transaction characteristics are calculated, including: Obtain the constraint rules of financial transactions and construct the constraint-enhanced node vector by combining the fusion node vector. Extract the transaction direction information in the financial transaction graph network and map the account nodes in the financial transaction graph network to the transaction nodes in the account transaction flow graph. Construct the account transaction flow graph by combining the constraint-enhanced node vector. Calculate the constraint violation degree between different transaction nodes in the account transaction flow graph, construct a constraint propagation matrix based on the constraint violation degree and calculate the constraint propagation probability, and determine the transaction behavior pattern corresponding to each transaction node based on the constraint propagation probability. Calculate the community similarity between the transaction node and the pre-set community center based on the transaction behavior pattern, determine the community division criteria based on the community similarity, and divide the transaction objects of the transaction node into communities according to the community division criteria to obtain multiple transaction communities. Calculate the transaction volume within each trading community and the degree of constraint conflict between different trading communities, construct a relationship graph between communities, and analyze the cross-community transaction characteristics.

[0010] In one alternative implementation, Extracting transaction flow features and combining them with the cross-community transaction features, abnormal transaction communities are identified through fuzzy clustering, and early warning information is output, including: The transaction flow direction is extracted from the account transaction flow graph to obtain the transaction flow direction feature. The transaction flow direction feature and the cross-community transaction feature are respectively constructed as dual-view feature representations and feature learning is performed to obtain the hidden layer representation of the transaction flow feature and the hidden layer representation of the cross-community transaction feature and feature reconstruction is performed. Calculate the first similarity matrix corresponding to the reconstructed transaction flow characteristics and the second similarity matrix corresponding to the cross-community transaction characteristics, and calculate the difference between the first similarity matrix and the second similarity matrix to obtain the perspective consistency constraint; The mutual information between the reconstructed transaction flow characteristics and the cross-community transaction characteristics is calculated to obtain the perspective importance. Based on the perspective importance and the perspective consistency constraint, a fuzzy clustering objective function is constructed, and the fuzzy clustering center is obtained by solving the fuzzy clustering objective function. Anomaly score is obtained by calculating the minimum distance between each trading community and the fuzzy cluster center. Based on the anomaly score, abnormal trading communities are identified and warning information is output.

[0011] A second aspect of this invention provides a financial risk control and anomaly detection system based on graph neural networks, comprising: The first unit is used to collect transaction data submitted by users, construct a financial transaction graph network based on the transaction data, construct a transaction sequence feature map for each account node in the financial transaction graph network based on transaction time sequence information, extract local transaction patterns through causal convolution to obtain time sequence feature vectors, construct transaction relationship propagation paths based on the neighbor nodes of each account node and calculate risk propagation probability to obtain risk propagation feature vectors. The second unit is used to concatenate the time-series feature vector and the risk propagation feature vector, combine them with a graph neural network to determine the initial node embedding vector, calculate the node correlation matrix based on the initial node embedding vector, and calculate the context-aware node vector by combining the relative position of each account node and stack them to obtain the fused node vector. The third unit is used to construct an account transaction flow graph based on the fused node vector and determine the transaction behavior pattern of each transaction node, divide the transaction objects of each transaction node into communities and calculate cross-community transaction features, extract transaction flow features and combine them with the cross-community transaction features, determine abnormal transaction communities through fuzzy clustering and output early warning information.

[0012] A third aspect of the present invention provides an electronic device, comprising: A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0014] This invention constructs a financial transaction graph network and extracts local transaction patterns by combining transaction time-series information. Simultaneously, it calculates risk propagation characteristics, comprehensively capturing transaction behavior features and risk propagation paths, thus improving the accuracy and completeness of risk identification. It utilizes a combination of graph neural networks and node correlation matrices for node representation learning, considering the relative position information of account nodes in the transaction network, generating context-aware fusion node vectors. This enhances the ability to express complex transaction relationships and improves the adaptability and robustness of the risk control model. Furthermore, it constructs an account transaction flow graph and performs community segmentation. By calculating cross-community transaction features and using fuzzy clustering methods, it identifies abnormal transaction communities, effectively detecting organized risk behaviors that are difficult to detect using traditional methods, and providing a more accurate risk warning mechanism. Attached Figure Description

[0015] Figure 1 This is a flowchart illustrating the financial risk control and anomaly detection method based on graph neural networks according to an embodiment of the present invention. Figure 2 This is a flowchart illustrating the abnormal transaction community detection process of the financial risk control and anomaly detection method based on graph neural networks according to an embodiment of the present invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0018] Figure 1 This is a flowchart illustrating the method of an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes: Collect user-submitted transaction data, construct a financial transaction graph network based on the transaction data, construct a transaction sequence feature map for each account node in the financial transaction graph network based on transaction time sequence information, extract local transaction patterns through causal convolution to obtain time sequence feature vectors, construct transaction relationship propagation paths based on the neighbor nodes of each account node and calculate risk propagation probability to obtain risk propagation feature vectors; The temporal feature vector and the risk propagation feature vector are concatenated, and an initial node embedding vector is determined by combining the graph neural network. The node correlation matrix is ​​calculated based on the initial node embedding vector. The context-aware node vector is calculated by combining the relative position of each account node and stacked to obtain the fused node vector. Based on the fused node vector, an account transaction flow graph is constructed and the transaction behavior pattern of each transaction node is determined. The transaction objects of each transaction node are divided into communities and cross-community transaction features are calculated. Transaction flow features are extracted and combined with the cross-community transaction features. Abnormal transaction communities are identified through fuzzy clustering and warning information is output.

[0019] In one alternative implementation, A financial transaction graph network is constructed based on the transaction data. For each account node in the financial transaction graph network, a transaction sequence feature map is constructed based on transaction time-series information. The time-series feature vector is obtained by extracting local transaction patterns through causal convolution, including: Based on the transaction data, the source node and target node of the transaction are taken as account nodes, the transaction edges are determined based on the transaction relationship between the account nodes, and the edge weights are determined based on the transaction amount, thus obtaining a financial transaction graph network. The transaction sequence data corresponding to each account node in the financial transaction graph network is extracted. The transaction mutation degree is determined by calculating the mean and standard deviation of the transaction amount of the transaction sequence data within a unit time. Based on the transaction mutation degree, key event points are determined and resampling is performed based on the key event points to obtain a transaction sequence feature map. The transaction sequence feature map is added to a pre-set variational causal convolutional network, and feature extraction is performed in combination with a pre-set information bottleneck constraint. Forward and reverse verification are performed on the extracted causal features respectively. The difference between the verification results is calculated and a bidirectional causal consistency loss is constructed. The temporal feature vector corresponding to the local transaction pattern is obtained based on the bidirectional causal consistency loss and the information bottleneck constraint.

[0020] A financial transaction graph network is constructed using source and target nodes from transaction data as account nodes. Transaction relationships are defined as edges in the graph, and transaction amounts are defined as edge weights. For example, when account A transfers 100 yuan to account B, a directed edge from A to B with a weight of 100 is created in the graph network. For repeated transactions, weights can be accumulated or multiple edges can be created. The graph network can be represented as G=(V, E, W), where V is the set of account nodes, E is the set of transaction edges, and W is the set of weights.

[0021] For each account node in the financial transaction graph network, transaction sequence data is extracted. This data includes information such as timestamps, transaction amounts, and transaction objects. The mean and standard deviation of transaction amounts within a unit of time (e.g., hour, day, week) are calculated. For example, using a day as the unit of time, the mean μ and standard deviation σ of daily transaction amounts are calculated for account C's transactions over the past 30 days. Transaction abruptness can be defined as the difference between the current day's transaction amount and the past mean, divided by the standard deviation, i.e., (today's amount - μ) / σ. When the abruptness exceeds a preset threshold (e.g., 3), that time point is marked as a critical event point.

[0022] Based on the identified key event points, a transaction sequence feature map is constructed through resampling. The resampling method focuses on transaction data before and after the key event point, performing intensive sampling within a fixed time window before and after the event point, while using a lower sampling frequency during regular transaction periods. For example, when an abnormally large transaction (abruptness of 4.2) is detected in account D on May 15th, detailed transaction records for the three days before and after that date are extracted to form a higher resolution feature map. The resampled transaction sequence feature map contains multi-dimensional features such as time, amount, and frequency.

[0023] The constructed transaction sequence feature map is input into a pre-defined variational causal convolutional network for processing. This network, combining variational autoencoders and causal convolutions, effectively processes time-series data and extracts potential causal relationships. The network architecture contains multiple layers of causal convolutional layers, each using convolutional kernels of different sizes to capture transaction patterns across different time spans. For example, for the transaction sequence feature map of account E, convolutional kernels of sizes 3, 5, and 7 are used to extract short-term, medium-term, and long-term transaction patterns, respectively.

[0024] During feature extraction, information bottleneck constraints are incorporated to reduce redundant information and improve the model's ability to capture true causal relationships. Information bottleneck constraints limit the amount of information extracted from features, forcing the model to retain the information most relevant to identifying suspicious transactions. Specifically, this is achieved by limiting the dimension of the feature vector or adding regularization terms. For example, high-dimensional features can be compressed into a 64-dimensional feature vector while retaining key transaction pattern information.

[0025] To verify the validity of the extracted causal features, perform forward and reverse verification. Forward verification uses features from the current point in time to predict future trading behavior; reverse verification uses features from future points in time to reconstruct current trading behavior. For example, use the trading features of account F in January to predict possible trading patterns in February (forward), and use the features from February to attempt to reconstruct the trading patterns in January (reverse).

[0026] A bidirectional causal consistency loss is constructed by comparing the differences between the results of forward and reverse validation. The bidirectional causal consistency loss function measures the ability to capture true causal relationships. When the positive predictions match the actual future transactions well, and the reverse reconstructions differ significantly from the actual historical transactions, it indicates that the model has captured the unidirectional causal relationship well. For example, if account G typically makes multiple small transfers after receiving a large amount of money, it can learn this pattern from historical data and issue an alert for possible scattered transfers when a large amount of money is detected in the future.

[0027] Solving the optimization problem based on bidirectional causal consistency loss and information bottleneck constraints yields a temporal feature vector reflecting local transaction patterns. This vector contains key temporal characteristics of account transaction behavior and can be used for subsequent anomaly detection and risk assessment. For example, for a typical cash-out account H, the feature vector will highlight a pattern of frequent large inflows followed by rapid outflows, forming a clear contrast with normal business accounts.

[0028] In this embodiment, by constructing a transaction graph network in financial transaction data and combining statistical and causal feature extraction methods for transaction sequences, a precise characterization of local transaction patterns is achieved. By calculating the mean and standard deviation of the transaction sequence to determine the degree of transaction mutation, and by identifying key event points based on the degree of mutation for resampling, abnormal transaction change characteristics can be highlighted, irrelevant data interference can be reduced, and the effectiveness of transaction sequence feature extraction can be improved. By inputting the transaction sequence feature map into a variational causal convolutional network and combining it with information bottleneck constraints for feature extraction, redundant information can be compressed, features with stronger causal correlation can be extracted, and the simplicity and causal rationality of feature expression can be improved.

[0029] In one alternative implementation, Based on the neighbor nodes of each account node, a transaction relationship propagation path is constructed and the risk propagation probability is calculated, resulting in a risk propagation feature vector including: For each account node, extract the set of neighbor nodes corresponding to the current account node, and calculate the transaction intensity between the current account node and each neighbor node based on the pre-acquired transaction amount and transaction frequency, combined with the pre-set time decay coefficient, and construct a transaction relationship matrix; Historical risk events between account nodes and each neighbor node are extracted separately, a historical risk time set is constructed, and the risk correlation coefficient is calculated by determining the number of intersections and unions. Based on the transaction relationship matrix and the risk correlation coefficient, the risk propagation probability between different node pairs in the financial transaction graph network is obtained. Based on the risk propagation probability, a propagation path containing multiple account nodes is constructed. The initial risk probability corresponding to the starting node on the propagation path is calculated. The joint path probability is calculated in combination with the risk propagation probability. The distance decay rate is initialized based on the transaction intensity and the length of each propagation path, and the decay center point is set. The path propagation probability is calculated in combination with the joint path probability. The statistical features of the path propagation probability are extracted to obtain the risk propagation feature vector.

[0030] In a financial transaction graph network, for each account node, the set of neighboring nodes that directly transact with the current account node is extracted. Neighboring nodes refer to other account nodes that have a direct transaction relationship with the current account node. For example, if account A has transactions with accounts B, C, and D, then B, C, and D constitute the set of neighboring nodes for A. After extracting the set of neighboring nodes, the transaction intensity is calculated based on pre-acquired transaction amount and frequency data, combined with a time decay coefficient. The time decay coefficient represents the timeliness of the transaction, with recent transactions having a higher weight than distant transactions. When calculating transaction intensity, the transaction amount is multiplied by the transaction frequency, and then multiplied by the time decay coefficient. In a specific implementation, the time decay coefficient can be set to an exponential decay form, such as a transaction t days ago having a decay coefficient of 0.95 to the power of t. For example, if account A transferred 5000 yuan to account B 10 days ago and 3000 yuan 5 days ago, then the transaction intensity from A to B is calculated as: 5000 × 0.95^10 + 3000 × 0.95^5. A complete transaction relationship matrix is ​​constructed by calculating the transaction strength between an account node and all its neighboring nodes. This matrix is ​​an N×N square matrix, where N is the total number of account nodes, and the element (i, j) in the matrix represents the transaction strength between node i and node j.

[0031] To calculate risk correlation, historical risk events between each account node and its neighboring nodes are extracted. These historical risk events include, but are not limited to, dishonest transactions, account theft, and abnormal fund flows. The risk events are arranged chronologically to construct a historical risk time set. The risk correlation coefficient is obtained by calculating the ratio of the intersection to the union of the historical risk time sets of two account nodes. For example, if account C's historical risk events occurred on January 5th, February 10th, and March 15th, and account D's historical risk events occurred on January 5th, February 20th, March 15th, and April 25th, then the intersection of the risk events for the two accounts is January 5th and March 15th, with an intersection count of 2; the union is January 5th, February 10th, February 20th, March 15th, and April 25th, with a union count of 5. Therefore, the risk correlation coefficient is 2 / 5 = 0.4. Based on the transaction relationship matrix and the risk correlation coefficient, the probability of risk propagation between different node pairs in the financial transaction graph network is calculated. Risk propagation probability represents the likelihood of risk spreading from one account node to another. It is calculated by multiplying the transaction intensity by the risk correlation coefficient and then normalizing the result.

[0032] A risk propagation path is constructed based on the risk propagation probability, encompassing multiple account nodes. This path represents the chain of risk propagation within the account network. For example, the path A→B→E→G indicates that risk propagates from account A to B, then from B to E, and finally from E to G. For each propagation path, the initial risk probability of the starting node needs to be calculated. The initial risk probability is determined based on factors such as the historical frequency of risk events and the degree of transaction anomaly at the starting node. For instance, if account F experienced 5 risk events in the past year, while the platform averages 2 risk events per account, then F has a relatively high initial risk probability. Combining the initial risk probability with the risk propagation probabilities between nodes along the path, the joint path probability is calculated. This joint path probability equals the initial risk probability multiplied by the product of all risk propagation probabilities along the path.

[0033] The distance decay rate is initialized based on transaction strength and propagation path length. The distance decay rate represents the degree to which risk decreases as propagation distance increases. Generally, the longer the propagation path, the lower the probability of risk propagation. A decay center point is set as a reference point; this center point can be the starting node of the path or a specific high-risk node. The path propagation probability is calculated by combining the joint probability of the path and the distance decay model. The path propagation probability represents the actual probability of risk propagating along a specific path after considering the distance decay effect. For example, for a path P with a path length of 3, its joint probability is 0.6, and its distance decay rate is 0.8; therefore, the path propagation probability is 0.6 × 0.8^3 = 0.3072.

[0034] Statistical features of the path propagation probability are extracted to obtain a risk propagation feature vector. These statistical features include the mean, variance, maximum, minimum, and median of the propagation probability. For example, for all propagation paths related to account H, features such as the mean (0.25), variance (0.04), maximum (0.45), minimum (0.08), and median (0.22) of the path propagation probability are extracted to form the risk propagation feature vector [0.25, 0.04, 0.45, 0.08, 0.22].

[0035] In this embodiment, by combining transaction amount, transaction frequency, and time decay coefficient to calculate transaction intensity and construct a transaction relationship matrix, the dynamic transaction relationship between account nodes can be accurately reflected. Based on historical risk events, a risk correlation coefficient is constructed and jointly calculated with the transaction relationship matrix, which can effectively reveal the probability of risk propagation between different account nodes. At the propagation path level, the path propagation probability is calculated by combining transaction intensity, path length, and decay rate, and its statistical characteristics are extracted to construct a risk propagation feature vector. This enables a quantitative description of the multi-path risk transmission pattern, which not only improves the accuracy and interpretability of risk propagation modeling, but also enhances the ability to identify and predict potential risk diffusion trends, providing stronger technical support for financial risk monitoring and prevention.

[0036] In one alternative implementation, The temporal feature vector and the risk propagation feature vector are concatenated, and an initial node embedding vector is determined using a graph neural network. A node correlation matrix is ​​calculated based on the initial node embedding vector. A context-aware node vector is then calculated by combining the relative position of each account node and stacked to obtain a fused node vector, including: The fused feature vector is obtained by sequentially combining each dimension value of the time series feature vector and each dimension value of the risk propagation feature vector according to a pre-set dimension order. The fused feature vector is then added to a pre-set graph neural network, and the initial node embedding vector is obtained through feature transformation. The feature similarity between the account node and its neighboring nodes is calculated based on the initial node embedding vector. The feature similarity is then non-linearly mapped, and a node association matrix is ​​constructed based on the mapping result. The relative position code is determined based on the shortest path distance between different account nodes in the financial transaction graph network. The relative position code is fused with the initial node embedding vector, and the context-aware node vector is obtained by combining the node correlation matrix. The context-aware node vectors corresponding to different time sequences are stacked to obtain the fused node vector.

[0037] The obtained temporal feature vector and risk propagation feature vector are combined to form a fused feature vector. The temporal feature vector reflects the time pattern characteristics of account transactions, while the risk propagation feature vector reflects the propagation characteristics of the account in the risk network. The combination of the temporal feature vector and the risk propagation feature vector follows a pre-set dimensional order. For example, if the temporal feature vector is [0.45, 0.32, 0.78, 0.21, 0.65] and the risk propagation feature vector is [0.25, 0.43, 0.37], then the fused feature vector is [0.45, 0.32, 0.78, 0.21, 0.65, 0.25, 0.43, 0.37]. The fused feature vector is used as the initial input and added to a pre-set graph neural network. The graph neural network contains multiple graph convolutional layers. Through feature transformation operations within the network, the fused feature vector is mapped to the latent feature space to obtain the initial node embedding vector. The feature transformation process involves the combined application of linear transformations and nonlinear activation functions, such as transforming features through weight matrix multiplication and the ReLU activation function. Taking account A as an example, the fused feature vector corresponding to account A, after being transformed by the first layer of the graph neural network, yields an initial node embedding vector of dimension 64 [0.12, 0.35, ..., 0.56].

[0038] The feature similarity between account nodes and their neighboring nodes is calculated based on the initial node embedding vectors. The cosine similarity method is used to measure the proximity of the directions of the two node embedding vectors. For account B and its neighbor account C, the dot product of their initial node embedding vectors divided by the product of their magnitudes yields a feature similarity value of 0.78. A non-linear mapping is then applied to the feature similarity, converting the similarity value into association strength. The sigmoid function is used to map the similarity value to between 0 and 1, enhancing high similarity values ​​and suppressing low similarity values. Applying the sigmoid function to the feature similarity of 0.78 yields a mapping result of 0.85. Based on the mapping results between all node pairs, a complete node association matrix is ​​constructed. This matrix is ​​an N×N square matrix, where N is the total number of account nodes, and the element (i, j) in the matrix represents the association strength between node i and node j.

[0039] The relative position encoding is determined based on the shortest path distance between different account nodes in the financial transaction graph network. The shortest path distance is calculated using breadth-first search or Dijkstra's algorithm. The relative position encoding aims to provide structural information between nodes in the graph neural network. For accounts D and E, if the shortest path distance in the graph is 2, a corresponding relative position encoding vector [0, 1, 0, 0, ...] can be generated, where the second element of the vector is 1 and the rest are 0, indicating a distance of 2. The relative position encoding is then fused with the initial node embedding vector, either by vector concatenation or element-wise weighted summation. For example, the initial node embedding vector of account F is [0.42, 0.53, ..., 0.38], and the relative position encoding is [0.2, 0.6, ..., 0.1]. Element-level weighted summation with weights of 0.7 and 0.3 yields the fused vector [0.42×0.7+0.2×0.3, 0.53×0.7+0.6×0.3, ..., 0.38×0.7+0.1×0.3]. Combined with the node correlation matrix, the node representation is updated through a message passing mechanism to obtain the context-aware node vector. The message passing process includes the aggregation of neighbor information and the updating of its own information, considering node correlation as a weight to enhance the influence of highly correlated neighbor node information.

[0040] The context-aware node vectors corresponding to different time points are stacked to obtain a fused node vector. The stacking operation preserves the behavioral characteristics of the account at different time points. For example, the context-aware node vectors of account G at time points t1, t2, and t3 are [0.31, 0.45, ..., 0.62], [0.35, 0.48, ..., 0.59], and [0.40, 0.52, ..., 0.57], respectively. After stacking, the fused node vector is [[0.31, 0.45, ..., 0.62], [0.35, 0.48, ..., 0.59], [0.40, 0.52, ..., 0.57]].

[0041] For example, a financial platform detects a set of suspicious transactions. Account H has large sums of money flowing between multiple accounts in a short period of time, forming a complex transaction network. The temporal feature vector [0.85, 0.42, 0.93, 0.37, 0.79] and the risk propagation feature vector [0.62, 0.54, 0.71] of H are extracted and fused to obtain the feature vector [0.85, 0.42, 0.93, 0.37, 0.79, 0.62, 0.54, 0.71]. This fused feature vector is input into a graph neural network to obtain the initial node embedding vector of H. The feature similarities between H and its neighbors I, J, and K are calculated to be 0.82, 0.65, and 0.39, respectively. After nonlinear mapping, a node correlation matrix is ​​constructed. Combined with the encoding of H's relative position in the transaction network, a context-aware node vector is generated. The behavioral changes of H within three consecutive time windows are analyzed, and the resulting vectors are stacked to obtain the fused node vector. Based on the fused node vector, the "ant moving house" style fund transfer pattern involving H was successfully identified. This pattern avoids the monitoring of traditional risk control systems by using multiple accounts, small amounts, and high-frequency transactions, and the relevant accounts are frozen in time to prevent fund loss.

[0042] In this embodiment, by fusing temporal feature vectors and risk propagation feature vectors and inputting them into a graph neural network, multi-dimensional feature comprehensive modeling of account nodes is achieved. This can simultaneously characterize transaction evolution features and risk diffusion features, improving the completeness of node representation. Based on the initial node embedding vector, the feature similarity between account nodes and neighboring nodes is calculated, and a node correlation matrix is ​​constructed, which can enhance the accuracy of characterizing potential relationships between nodes and improve the effectiveness of feature aggregation. Combining the shortest path distance in the financial transaction graph network for relative position encoding and fusing it with the node embedding vector can introduce structural position information into the feature expression, making the node representation more consistent with the topological characteristics of the transaction network. By stacking context-aware node vectors of different time series, a fused node vector is obtained, which can effectively reflect the temporal evolution law of node features in the transaction network.

[0043] In one alternative implementation, Based on the initial node embedding vector, the feature similarity between the account node and its neighboring nodes is calculated. A non-linear mapping is then performed on the feature similarity, and a node association matrix is ​​constructed based on the mapping result, including: The initial node embedding vector is transformed using a pre-set feature transformation matrix, and a bias vector is added to obtain the financial transaction features; Extract the inflow and outflow of funds between the account node and the neighbor node within a preset time window. Calculate the fund balance based on the inflow and outflow of funds. Combine the fund flow characteristics to obtain the fund flow similarity. Based on the fund flow similarity and the transaction strength between the account node and the neighbor node, combine the initial node embedding vector to obtain the feature similarity. Obtain the fund size between the account node and the neighbor node, calculate the ratio of the fund size to the preset standard fund size, initialize an adaptive factor based on the ratio, and perform sigmoid mapping on the feature similarity based on the adaptive factor to obtain the mapping result; A directional factor is determined based on the direction of fund flow between the account node and the neighbor node, and the node correlation matrix is ​​constructed based on the directional factor and the mapping result.

[0044] The initial node embedding vector is transformed using a pre-set feature transformation matrix, and a bias vector is added to obtain the fund transaction features. The feature transformation matrix is ​​a parameter matrix obtained in advance through training and optimization, used to map the node embedding vector to the fund transaction feature space. For example, assuming the initial node embedding vector of account A has a dimension of 64 and the feature transformation matrix has a dimension of 64×32, the transformed vector has a dimension of 32. The initial node embedding vector is multiplied by the feature transformation matrix, and the pre-set bias vector is added. For example, if the initial node embedding vector of account A is [0.25, 0.38, 0.42, ..., 0.51], after transformation by the feature transformation matrix and addition of the bias vector, the fund transaction features [0.35, 0.42, 0.28, ..., 0.39] are obtained.

[0045] Extract the inflow and outflow of funds for account nodes and neighboring nodes within a preset time window. The preset time window can be one day, one week, or one month, determined according to actual business needs. Inflow refers to the total amount of funds transferred into the account within the preset time window, and outflow refers to the total amount of funds transferred out of the account within the preset time window. Calculate the fund balance score based on the inflow and outflow. The fund balance score represents the degree of equilibrium between fund inflows and outflows in an account, calculated by dividing the minimum and maximum of the inflow and outflow scores. The closer the fund balance score is to 1, the more balanced the inflow and outflow of funds; the closer it is to 0, the more unbalanced the fund flow. For example, if account B has an inflow of 8000 yuan and an outflow of 6000 yuan within one week, then the fund balance score is 6000 / 8000 = 0.75. Fund flow similarity is calculated by combining pre-calculated fund flow characteristics. Fund flow similarity measures the similarity between two accounts in their fund flow patterns, and is calculated as a weighted average of the cosine similarity and fund balance of the fund flow characteristics of the two accounts. For example, if the cosine similarity of fund flow characteristics between accounts C and D is 0.85, and C's fund balance is 0.7 and D's fund balance is 0.8, with weights of 0.6 and 0.4 respectively, then the fund flow similarity is 0.85 × 0.6 + (0.7 + 0.8) / 2 × 0.4 = 0.75. Based on fund flow similarity and the transaction strength between account nodes and neighboring nodes, feature similarity is obtained by combining the initial node embedding vectors. Feature similarity comprehensively considers fund flow similarity, transaction strength, and node embedding vector similarity, and is calculated as a weighted sum of these three factors. For example, if the similarity of fund flows between accounts E and F is 0.6, the transaction intensity is 0.8, the cosine similarity of node embedding vectors is 0.7, and the weights are 0.3, 0.4, and 0.3 respectively, then the feature similarity is 0.6×0.3+0.8×0.4+0.7×0.3=0.71.

[0046] Obtain the fund size between account nodes and neighboring nodes. Fund size refers to the total transaction amount between two accounts within a certain time range. Calculate the ratio of the fund size to a preset standard fund size. The standard fund size is a reference value preset according to the business scenario, which is the average transaction size of accounts of the same type or an industry benchmark. The larger the ratio, the more significant the transaction size. Initialize an adaptive factor based on the ratio. The adaptive factor is used to adjust the steepness of the sigmoid mapping function so that the mapping function can adapt to transaction relationships of different sizes. The adaptive factor is initialized by multiplying the logarithm of the ratio by a preset constant. For example, if the fund size between account G and account H is 50,000 yuan, the standard fund size is 10,000 yuan, the ratio is 5, the logarithm is 1.61, multiplied by the preset constant 2, resulting in an adaptive factor of 3.22. Perform sigmoid mapping on feature similarity based on the adaptive factor to obtain the mapping result. The sigmoid mapping function converts feature similarity into a value between 0 and 1, and the mapping result is the degree of correlation between the two accounts. In the sigmoid function, the adaptive factor controls the shape of the mapping curve. For example, a feature similarity of 0.71 and an adaptation factor of 3.22 result in a value of 0.89 after sigmoid mapping.

[0047] The directional factor is determined based on the direction of fund flow between account nodes and their neighboring nodes. Fund flow direction is categorized into three cases: inflow, outflow, and bidirectional flow. The directional factor is used to adjust for the asymmetry of the correlation degree, ensuring that the correlation matrix reflects the directional characteristics of fund flow. For fund inflow, the directional factor can be set to 1.2; for fund outflow, it can be set to 0.8; and for bidirectional flow, it can be set to 1.0. For example, if funds flow from account I to account J, the directional factor from I to J is 0.8, and the directional factor from J to I is 1.2. The node correlation matrix is ​​constructed based on the directional factor and the aforementioned mapping results. The node correlation matrix is ​​constructed by multiplying the mapping result by the directional factor. For example, if the mapping result between account K and account L is 0.75, the direction of fund flow from K to L is outflow, and the directionality factor is 0.8, then the element value from K to L in the correlation matrix is ​​0.75 × 0.8 = 0.6; if the direction of fund flow from L to K is inflow, and the directionality factor is 1.2, then the element value from L to K in the correlation matrix is ​​0.75 × 1.2 = 0.9.

[0048] For example, a financial platform detected that account M forms a close trading circle with accounts N, P, and Q. The initial node embedding vector of M, after feature transformation, yields the fund flow features [0.45, 0.32, 0.68, ..., 0.57]. Analysis shows that M experienced a fund inflow of 3 million yuan and an outflow of 2.8 million yuan within a month, with a fund balance of 0.93; N experienced a fund inflow of 1.5 million yuan and an outflow of 1.6 million yuan during the same period, with a fund balance of 0.94. The fund flow similarity between M and N is calculated to be 0.87. Considering the transaction intensity of 0.75 and the node embedding similarity of 0.82, the feature similarity is 0.82. The fund size between M and N is 1.2 million yuan, the standard fund size is 500,000 yuan, the ratio is 2.4, and the adaptive factor is calculated to be 2.8. Applying the adaptive factor of 2.8 to the feature similarity of 0.82 and performing a sigmoid mapping yields a value of 0.92. Considering that funds mainly flow from M to N, with directional factors of 0.8 and 1.2 respectively, the element value from M to N in the correlation matrix is ​​0.74, and the element value from N to M is 1.1. Through correlation calculation, a star-shaped fund flow pattern was successfully identified, with M as the fund distribution center and N, P, and Q as fund receiving points, triggering an alert and freezing the relevant accounts.

[0049] In this embodiment, by performing feature transformation on the initial node embedding vector and obtaining fund flow features, the transaction information between accounts can be explicitly mapped to the fund interaction space, enhancing the ability of node representation to characterize fund relationships. By extracting fund inflows and outflows within a time window and calculating fund balance, and combining fund flow features to solve for fund flow similarity, the fund flow characteristics between accounts can be reflected more accurately, improving the calculation accuracy of feature similarity. By introducing the direction of fund flow to determine the directional factor, and combining the mapping results to construct a node correlation matrix, the fund flow direction features can be effectively introduced, making the correlation relationship more consistent with the directional characteristics of the actual transaction network.

[0050] In one alternative implementation, Based on the fused node vectors, an account transaction flow graph is constructed, and the transaction behavior pattern of each transaction node is determined. The transaction objects of each transaction node are then divided into communities, and cross-community transaction characteristics are calculated, including: Obtain the constraint rules of financial transactions and construct the constraint-enhanced node vector by combining the fusion node vector. Extract the transaction direction information in the financial transaction graph network and map the account nodes in the financial transaction graph network to the transaction nodes in the account transaction flow graph. Construct the account transaction flow graph by combining the constraint-enhanced node vector. Calculate the constraint violation degree between different transaction nodes in the account transaction flow graph, construct a constraint propagation matrix based on the constraint violation degree and calculate the constraint propagation probability, and determine the transaction behavior pattern corresponding to each transaction node based on the constraint propagation probability. Calculate the community similarity between the transaction node and the pre-set community center based on the transaction behavior pattern, determine the community division criteria based on the community similarity, and divide the transaction objects of the transaction node into communities according to the community division criteria to obtain multiple transaction communities. Calculate the transaction volume within each trading community and the degree of constraint conflict between different trading communities, construct a relationship graph between communities, and analyze the cross-community transaction characteristics.

[0051] Obtain the constraint rules of financial transactions and construct constraint-enhanced node vectors by combining them with the fusion node vectors. Financial transaction constraint rules include transaction amount limits, transaction frequency limits, and transaction object limits. For example, the daily transaction limit for individual accounts is no more than 50,000 yuan, and the monthly transaction frequency for corporate accounts is no more than 500 times. Constraint rules can be obtained from financial institution business regulations, regulatory policies, or historical experience. Represent the constraint rules as vectors and concatenate or weightedly fuse them with the fusion node vectors to obtain the constraint-enhanced node vectors. For example, the fusion node vector of account A is [0.42, 0.55, 0.37, ..., 0.62], and the constraint rule vector is [0.8, 0.6, 0.9, ..., 0.7]. By concatenating them, the constraint-enhanced node vector is obtained as [0.42, 0.55, 0.37, ..., 0.62, 0.8, 0.6, 0.9, ..., 0.7]. Extract transaction direction information from the financial transaction graph network, including the inflow and outflow directions of funds. The account nodes in the financial transaction graph network are mapped to transaction nodes in the account transaction flow graph. In the account transaction flow graph, nodes represent transaction entities, edges represent fund flows, and edge weights represent transaction amounts. A complete account transaction flow graph is constructed by combining constraint-enhanced node vectors. For example, for transaction node B, its constraint-enhanced node vector is [0.35, 0.48, 0.52, ..., 0.43]. Based on the constraint-enhanced node vector, the attribute characteristics of node B in the account transaction flow graph, such as transaction type and risk level, are determined.

[0052] Calculate the constraint violation degree between different transaction nodes in the account transaction flow graph. The constraint violation degree measures the extent to which a transaction violates constraint rules. Key characteristics of the transaction behavior, such as transaction amount, transaction frequency, and transaction time, are extracted and compared with the constraint rules to quantify the degree of deviation. For example, if the constraint rule stipulates that account C's maximum daily transaction amount is 100,000 yuan, and the actual transaction amount is 150,000 yuan, then the constraint violation degree can be expressed as (150,000-100,000) / 10 = 0.5. Construct a constraint propagation matrix based on the constraint violation degree. The constraint propagation matrix is ​​an M×M square matrix, where M is the number of transaction nodes, and the matrix element (u, p) represents the strength of the constraint violation propagating from node u to node p. Calculate the constraint propagation probability, which represents the likelihood of a constraint violation propagating from one node to another. The calculation of the constraint propagation probability considers factors such as transaction frequency, transaction amount proportion, and historical violation correlation. For example, if the transaction frequency between transaction nodes D and E is 3 times per week, the transaction amount accounts for 40% of D's total transaction amount, and there are 2 historical records of shared violations, the comprehensive calculation yields a constraint propagation probability of 0.65. The trading behavior pattern corresponding to each trading node is determined based on the constraint propagation probability. The trading behavior pattern is the typical behavioral characteristic exhibited by the trading node in the trading network, such as capital aggregation, capital dispersion, intermediate transformation, and cyclical. The determination of the trading behavior pattern is based on the characteristics of the node such as its in-degree, out-degree, and propagation probability distribution. For example, if trading node F has a high in-degree, a low out-degree, and generally high constraint propagation probability of its incoming edges, it can be determined as having a capital aggregation trading behavior pattern.

[0053] The similarity between transaction nodes and pre-defined community centers is calculated based on transaction behavior patterns. Community centers are predefined typical transaction patterns representing different types of transaction groups, such as ordinary consumers, investment and financial management groups, and business operation groups. The cosine similarity method is used to measure the closeness between the transaction node's behavior pattern and the community center. For example, if the feature vector of transaction node G's behavior pattern is [0.75, 0.42, 0.38, ..., 0.56], and the feature vector of a certain community center is [0.72, 0.45, 0.35, ..., 0.58], the calculated community similarity is 0.93. Community partitioning criteria are determined based on this similarity. These criteria include a similarity threshold, partitioning levels, and priority rules. For example, if the community similarity threshold is set to 0.85, when the similarity between a node and a certain community center is greater than the threshold, the node is partitioned into the corresponding community. Based on the community segmentation criteria, the transaction objects of the transaction nodes are segmented into communities, resulting in multiple transaction communities. For example, if the similarity between transaction node H and the general consumer group is 0.88 and the similarity between H and the investment and financial management group is 0.72, then H is classified into the general consumer community.

[0054] Calculate the transaction scale within each trading community, including indicators such as the number of nodes, total transaction amount, and transaction frequency. For example, a general consumer community contains 500 nodes, with a total monthly transaction amount of 5 million yuan and an average transaction frequency of 15 times per node per month. Calculate the degree of constraint conflict between different trading communities. The degree of constraint conflict reflects the differences in transaction behavior constraints between different communities. The calculation method is to extract the constraint feature vectors of each community and calculate the Euclidean distance or KL divergence between the vectors. For example, the constraint conflict degree between the general consumer community and the investment and wealth management community is 0.45, indicating a moderate difference in transaction constraints between the two communities. Construct a relationship graph between communities, where nodes represent trading communities, edges represent transaction relationships between communities, and edge weights represent transaction intensity. Analyze the relationship graph to obtain cross-community transaction characteristics. Cross-community transaction characteristics include cross-community transaction frequency, amount distribution, and time patterns. For example, cross-community transactions between business communities and general consumer communities are mainly concentrated at the beginning of each month, with an average transaction amount of 2,000 yuan per transaction.

[0055] In this embodiment, by acquiring the constraint rules of financial transactions and constructing constraint-enhanced node vectors by combining them with fused node vectors, business rule information can be introduced into the node representation. This allows the node features to include not only transaction behavior features but also constraint compliance features, enhancing the comprehensiveness of the node representation. By mapping account nodes to transaction nodes in the account transaction flow graph and constructing the account transaction flow graph by combining constraint-enhanced node vectors, the directionality and rule constraint features in the transaction process can be described more clearly. By determining the community segmentation criteria based on the similarity between transaction behavior patterns and community centers, and segmenting transaction objects into communities, multiple transaction communities can be formed, improving the rationality and interpretability of the node grouping results.

[0056] Figure 2 This is a flowchart illustrating the abnormal transaction community detection process of the financial risk control and anomaly detection method based on graph neural networks according to an embodiment of the present invention.

[0057] In one alternative implementation, Extracting transaction flow features and combining them with the cross-community transaction features, abnormal transaction communities are identified through fuzzy clustering, and early warning information is output, including: The transaction flow direction is extracted from the account transaction flow graph to obtain the transaction flow direction feature. The transaction flow direction feature and the cross-community transaction feature are respectively constructed as dual-view feature representations and feature learning is performed to obtain the hidden layer representation of the transaction flow feature and the hidden layer representation of the cross-community transaction feature and feature reconstruction is performed. Calculate the first similarity matrix corresponding to the reconstructed transaction flow characteristics and the second similarity matrix corresponding to the cross-community transaction characteristics, and calculate the difference between the first similarity matrix and the second similarity matrix to obtain the perspective consistency constraint; The mutual information between the reconstructed transaction flow characteristics and the cross-community transaction characteristics is calculated to obtain the perspective importance. Based on the perspective importance and the perspective consistency constraint, a fuzzy clustering objective function is constructed, and the fuzzy clustering center is obtained by solving the fuzzy clustering objective function. Anomaly score is obtained by calculating the minimum distance between each trading community and the fuzzy cluster center. Based on the anomaly score, abnormal trading communities are identified and warning information is output.

[0058] Transaction flow features are extracted from the account transaction flow graph, including information such as fund inflow direction, outflow direction, number of flow nodes, and distribution of flow amount. For example, the transaction flow features of account A are represented by 5 inflow nodes, 12 outflow nodes, an average inflow amount of 3000 yuan, an average outflow amount of 1200 yuan, and a maximum outflow target percentage of 35%. Transaction flow features and cross-community transaction features are constructed as dual-view feature representations. Dual-view feature representations describe the same transaction behavior from different perspectives. The transaction flow perspective focuses on the fund flow pattern of a single account, while the cross-community perspective focuses on the interaction pattern of the account between different communities. Feature learning is performed on the dual-view features using a deep autoencoder structure, consisting of an encoder and a decoder. The encoder maps the input features to a low-dimensional latent space, and the decoder reconstructs the latent representation back into the original feature space. For example, the transaction flow feature dimension of account B is 20. Through an encoder, it is mapped to an 8-dimensional latent space, resulting in the latent representation of the transaction flow feature [0.42, 0.35, 0.68, 0.51, 0.23, 0.76, 0.39, 0.57]. Similarly, B's cross-community transaction feature is mapped to an 8-dimensional latent space through another encoder, resulting in the latent representation of the cross-community transaction feature [0.45, 0.32, 0.71, 0.48, 0.26, 0.73, 0.41, 0.54]. The latent representation is then reconstructed by the decoder, restoring it to the original feature space, resulting in the reconstructed transaction flow feature and cross-community transaction feature.

[0059] Calculate the first similarity matrix corresponding to the reconstructed transaction flow features. For each pair of accounts, calculate the cosine similarity of the reconstructed transaction flow features to construct a similarity matrix. For example, if the cosine similarity of the reconstructed transaction flow features of accounts C and D is 0.75, then the values ​​at positions (C, D) and (D, C) in the first similarity matrix are both 0.75. Calculate the second similarity matrix corresponding to the reconstructed cross-community transaction features. The calculation method is similar to the first similarity matrix, but based on the reconstructed cross-community transaction features. For example, if the cosine similarity of the reconstructed cross-community transaction features of accounts C and D is 0.62, then the values ​​at positions (C, D) and (D, C) in the second similarity matrix are both 0.62. Calculate the difference between the first and second similarity matrices to obtain the perspective consistency constraint. The perspective consistency constraint reflects the degree of consistency in the similarity relationship between accounts under the two perspectives. Subtract the corresponding elements and take the absolute value to obtain the difference matrix. For example, the similarity difference between C and D under the two perspectives is |0.75-0.62|=0.13. The smaller the difference, the higher the consistency of the viewpoint; the larger the difference, the more inconsistent the viewpoints.

[0060] The mutual information between the reconstructed transaction flow features and cross-community transaction features is calculated to obtain the perspective importance. Mutual information measures the degree of interdependence between two random variables, reflecting the amount of shared information contained in the two feature representations. The calculation method is to estimate the mutual information based on the feature distribution, using kernel density estimation or nearest neighbor estimation methods. For example, the estimated mutual information value between the transaction flow features of the account group and the cross-community transaction features is 0.65. Perspective importance represents the contribution weight of different perspectives in anomaly detection, and is usually calculated based on mutual information and perspective variance. For example, the perspective importance of transaction flow is 0.6, and the perspective importance of cross-community transactions is 0.4. A fuzzy clustering objective function is constructed based on perspective importance and perspective consistency constraints. The fuzzy clustering objective function comprehensively considers feature similarity, perspective weights, and consistency constraints, and is expressed as a weighted sum of feature similarity terms, consistency constraint terms, and regularization terms. The fuzzy clustering objective function is solved by using an alternating optimization strategy to iteratively update the cluster centers and membership matrices until convergence. Finally, K fuzzy cluster centers are obtained, each center representing a typical transaction pattern. For example, setting K=5 yields 5 fuzzy cluster centers, representing normal consumption, stable business, high-frequency transaction, suspicious cyclical, and abnormally dispersed transaction patterns, respectively.

[0061] Anomaly scores are obtained by calculating the minimum distance between each trading community and its fuzzy cluster center. The feature vector of each trading community is extracted, and its Euclidean distance with each fuzzy cluster center is calculated; the minimum value is taken as the anomaly score. For example, if the distances between trading community E and its five fuzzy cluster centers are 0.85, 0.72, 0.93, 0.68, and 0.79, then E's anomaly score is 0.68. Anomaly-prone trading communities are identified based on these scores. The method involves setting an anomaly threshold; when a community's anomaly score exceeds the threshold, it is considered an abnormal trading community. The threshold can be set based on historical data distribution or expert experience, or it can be dynamically adjusted according to the score distribution using an adaptive method. For example, if the anomaly threshold is set to 0.7, and trading community F's anomaly score is 0.83, exceeding the threshold, it is considered an abnormal community. Warning information is output for detected abnormal trading communities, including the abnormal community ID, community members, anomaly type, anomaly score, and risk level.

[0062] In this embodiment, by extracting transaction flow features from the account transaction flow graph and constructing a dual-view feature representation together with cross-community transaction features for feature learning, it is possible to simultaneously retain the directional features of transaction paths and cross-community interaction features, thereby improving the comprehensiveness and diversity of transaction network feature expression. By performing hidden layer representation and reconstruction on the dual-view features respectively and calculating the difference between the corresponding similarity matrices of the two to obtain view consistency constraints, it is possible to ensure the consistency of feature expression under different views and avoid the influence of single view bias on the analysis results. By calculating the mutual information between transaction flow features and cross-community transaction features to obtain view importance, and combining the view consistency constraints to construct a fuzzy clustering objective function, it is possible to consider the weight and consistency of views simultaneously during the clustering process, improve the rationality of cluster centers and the stability of clustering results. By calculating the anomaly score of transaction communities based on fuzzy cluster centers and performing abnormal community identification and early warning, it is possible to achieve accurate detection of abnormal transaction groups.

[0063] A second aspect of the present invention provides a system comprising: The first unit is used to collect transaction data submitted by users, construct a financial transaction graph network based on the transaction data, construct a transaction sequence feature map for each account node in the financial transaction graph network based on transaction time sequence information, extract local transaction patterns through causal convolution to obtain time sequence feature vectors, construct transaction relationship propagation paths based on the neighbor nodes of each account node and calculate risk propagation probability to obtain risk propagation feature vectors. The second unit is used to concatenate the time-series feature vector and the risk propagation feature vector, combine them with a graph neural network to determine the initial node embedding vector, calculate the node correlation matrix based on the initial node embedding vector, and calculate the context-aware node vector by combining the relative position of each account node and stack them to obtain the fused node vector. The third unit is used to construct an account transaction flow graph based on the fused node vector and determine the transaction behavior pattern of each transaction node, divide the transaction objects of each transaction node into communities and calculate cross-community transaction features, extract transaction flow features and combine them with the cross-community transaction features, determine abnormal transaction communities through fuzzy clustering and output early warning information.

[0064] A third aspect of the present invention provides an electronic device, comprising: A processor and a memory for storing processor-executable instructions, wherein the processor is configured to invoke instructions stored in the memory to perform the aforementioned method.

[0065] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0066] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0067] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A financial risk control and anomaly detection method based on graph neural networks, characterized in that, include: Collect user-submitted transaction data, construct a financial transaction graph network based on the transaction data, construct a transaction sequence feature map for each account node in the financial transaction graph network based on transaction time sequence information, extract local transaction patterns through causal convolution to obtain time sequence feature vectors, construct transaction relationship propagation paths based on the neighbor nodes of each account node and calculate risk propagation probability to obtain risk propagation feature vectors; The temporal feature vector and the risk propagation feature vector are concatenated, and an initial node embedding vector is determined by combining the graph neural network. The node correlation matrix is ​​calculated based on the initial node embedding vector. The context-aware node vector is calculated by combining the relative position of each account node and stacked to obtain the fused node vector. Based on the fused node vector, an account transaction flow graph is constructed and the transaction behavior pattern of each transaction node is determined. The transaction objects of each transaction node are divided into communities and cross-community transaction features are calculated. Transaction flow features are extracted and combined with the cross-community transaction features. Abnormal transaction communities are identified through fuzzy clustering and warning information is output.

2. The method according to claim 1, characterized in that, A financial transaction graph network is constructed based on the transaction data. For each account node in the financial transaction graph network, a transaction sequence feature map is constructed based on transaction time-series information. The time-series feature vector is obtained by extracting local transaction patterns through causal convolution, including: Based on the transaction data, the source node and target node of the transaction are taken as account nodes, the transaction edges are determined based on the transaction relationship between the account nodes, and the edge weights are determined based on the transaction amount, thus obtaining a financial transaction graph network. The transaction sequence data corresponding to each account node in the financial transaction graph network is extracted. The transaction mutation degree is determined by calculating the mean and standard deviation of the transaction amount of the transaction sequence data within a unit time. Based on the transaction mutation degree, key event points are determined and resampling is performed based on the key event points to obtain a transaction sequence feature map. The transaction sequence feature map is added to a pre-set variational causal convolutional network, and feature extraction is performed in combination with a pre-set information bottleneck constraint. Forward and reverse verification are performed on the extracted causal features respectively. The difference between the verification results is calculated and a bidirectional causal consistency loss is constructed. The temporal feature vector corresponding to the local transaction pattern is obtained based on the bidirectional causal consistency loss and the information bottleneck constraint.

3. The method according to claim 1, characterized in that, Based on the neighbor nodes of each account node, a transaction relationship propagation path is constructed and the risk propagation probability is calculated, resulting in a risk propagation feature vector including: For each account node, extract the set of neighbor nodes corresponding to the current account node, and calculate the transaction strength between the current account node and each neighbor node based on the pre-acquired transaction amount and transaction frequency, combined with the pre-set time decay coefficient, and construct a transaction relationship matrix; Historical risk events between account nodes and each neighbor node are extracted separately, a historical risk time set is constructed, and the risk correlation coefficient is calculated by determining the number of intersections and unions. Based on the transaction relationship matrix and the risk correlation coefficient, the risk propagation probability between different node pairs in the financial transaction graph network is obtained. Based on the risk propagation probability, a propagation path containing multiple account nodes is constructed. The initial risk probability corresponding to the starting node on the propagation path is calculated. The joint path probability is calculated in combination with the risk propagation probability. The distance decay rate is initialized based on the transaction intensity and the length of each propagation path, and the decay center point is set. The path propagation probability is calculated in combination with the joint path probability. The statistical features of the path propagation probability are extracted to obtain the risk propagation feature vector.

4. The method according to claim 1, characterized in that, The temporal feature vector and the risk propagation feature vector are concatenated, and an initial node embedding vector is determined using a graph neural network. A node correlation matrix is ​​calculated based on the initial node embedding vector. A context-aware node vector is then calculated by combining the relative position of each account node and stacked to obtain a fused node vector, including: The fused feature vector is obtained by sequentially combining each dimension value of the time series feature vector and each dimension value of the risk propagation feature vector according to a pre-set dimension order. The fused feature vector is then added to a pre-set graph neural network, and the initial node embedding vector is obtained through feature transformation. The feature similarity between the account node and its neighboring nodes is calculated based on the initial node embedding vector. The feature similarity is then non-linearly mapped, and a node association matrix is ​​constructed based on the mapping result. The relative position code is determined based on the shortest path distance between different account nodes in the financial transaction graph network. The relative position code is fused with the initial node embedding vector, and the context-aware node vector is obtained by combining the node correlation matrix. The context-aware node vectors corresponding to different time sequences are stacked to obtain the fused node vector.

5. The method according to claim 4, characterized in that, Based on the initial node embedding vector, the feature similarity between the account node and its neighboring nodes is calculated. A non-linear mapping is then performed on the feature similarity, and a node association matrix is ​​constructed based on the mapping result, including: The initial node embedding vector is transformed using a pre-set feature transformation matrix, and a bias vector is added to obtain the financial transaction features; Extract the inflow and outflow of funds between the account node and the neighbor node within a preset time window. Calculate the fund balance based on the inflow and outflow of funds. Combine the fund flow characteristics to obtain the fund flow similarity. Based on the fund flow similarity and the transaction strength between the account node and the neighbor node, combine the initial node embedding vector to obtain the feature similarity. Obtain the fund size between the account node and the neighbor node, calculate the ratio of the fund size to the preset standard fund size, initialize an adaptive factor based on the ratio, and perform sigmoid mapping on the feature similarity based on the adaptive factor to obtain the mapping result; A directional factor is determined based on the direction of fund flow between the account node and the neighbor node, and the node correlation matrix is ​​constructed based on the directional factor and the mapping result.

6. The method according to claim 1, characterized in that, Based on the fused node vectors, an account transaction flow graph is constructed, and the transaction behavior pattern of each transaction node is determined. The transaction objects of each transaction node are then divided into communities, and cross-community transaction characteristics are calculated, including: Obtain the constraint rules of financial transactions and construct the constraint-enhanced node vector by combining the fusion node vector. Extract the transaction direction information in the financial transaction graph network and map the account nodes in the financial transaction graph network to the transaction nodes in the account transaction flow graph. Construct the account transaction flow graph by combining the constraint-enhanced node vector. Calculate the constraint violation degree between different transaction nodes in the account transaction flow graph, construct a constraint propagation matrix based on the constraint violation degree and calculate the constraint propagation probability, and determine the transaction behavior pattern corresponding to each transaction node based on the constraint propagation probability. Calculate the community similarity between the transaction node and the pre-set community center based on the transaction behavior pattern, determine the community division criteria based on the community similarity, and divide the transaction objects of the transaction node into communities according to the community division criteria to obtain multiple transaction communities. Calculate the transaction volume within each trading community and the degree of constraint conflict between different trading communities, construct a relationship graph between communities, and analyze the cross-community transaction characteristics.

7. The method according to claim 1, characterized in that, Extracting transaction flow features and combining them with the cross-community transaction features, abnormal transaction communities are identified through fuzzy clustering, and early warning information is output, including: The transaction flow direction is extracted from the account transaction flow graph to obtain the transaction flow direction feature. The transaction flow direction feature and the cross-community transaction feature are respectively constructed as dual-view feature representations and feature learning is performed to obtain the hidden layer representation of the transaction flow feature and the hidden layer representation of the cross-community transaction feature and feature reconstruction is performed. Calculate the first similarity matrix corresponding to the reconstructed transaction flow characteristics and the second similarity matrix corresponding to the cross-community transaction characteristics, and calculate the difference between the first similarity matrix and the second similarity matrix to obtain the perspective consistency constraint; The mutual information between the reconstructed transaction flow characteristics and the cross-community transaction characteristics is calculated to obtain the perspective importance. Based on the perspective importance and the perspective consistency constraint, a fuzzy clustering objective function is constructed, and the fuzzy clustering center is obtained by solving the fuzzy clustering objective function. Anomaly score is obtained by calculating the minimum distance between each trading community and the fuzzy cluster center. Based on the anomaly score, abnormal trading communities are identified and warning information is output.

8. A financial risk control and anomaly detection system based on graph neural networks, used to implement the method of any one of claims 1-7, characterized in that, include: The first unit is used to collect transaction data submitted by users, construct a financial transaction graph network based on the transaction data, construct a transaction sequence feature map for each account node in the financial transaction graph network based on transaction time sequence information, extract local transaction patterns through causal convolution to obtain time sequence feature vectors, construct transaction relationship propagation paths based on the neighbor nodes of each account node and calculate risk propagation probability to obtain risk propagation feature vectors. The second unit is used to concatenate the time-series feature vector and the risk propagation feature vector, combine them with a graph neural network to determine the initial node embedding vector, calculate the node correlation matrix based on the initial node embedding vector, and calculate the context-aware node vector by combining the relative position of each account node and stack them to obtain the fused node vector. The third unit is used to construct an account transaction flow graph based on the fused node vector and determine the transaction behavior pattern of each transaction node, divide the transaction objects of each transaction node into communities and calculate cross-community transaction features, extract transaction flow features and combine them with the cross-community transaction features, determine abnormal transaction communities through fuzzy clustering and output early warning information.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images