Cross-regional business risk detection method based on GNN and HFL

Abstract

The invention relates to the technical field of business risk detection, in particular to a cross-regional business risk detection method based on GNN and HFL. The cross-regional business risk detection method comprises the following steps: generating a cross-regional business association graph and calculating a dynamic edge weight; carrying out cross-regional feature alignment and compression; optimizing a hierarchical graph neural network; constructing a federated learning framework for privacy protection; and designing a local and global two-layer joint training loss function. According to the invention, the access control strategy can be dynamically optimized, and the risk detection capability in a financial service scene is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of business risk detection, and particularly relates to a cross-region business risk detection method based on GNN and HFL. BACKGROUND

[0002] In the financial industry, especially in the banking system, business systems are usually divided into multiple logical regions (such as business region one, business region two, etc.) to achieve data isolation and security control. With the increasing complexity of business, the demand for cross-region access control is increasingly urgent, but the existing technology has significant deficiencies in cross-region business risk detection.

[0003] (1) Limitations of static access control strategies

[0004] Traditional access control methods rely on preset rules, such as role-based access control (RBAC), IP whitelist restrictions on sensitive interfaces, time window and access frequency threshold management, etc. When a user's transaction operation exceeds the preset threshold, the system will trigger an alarm. Although this method has strong rule explainability, its static strategy is difficult to cope with changing attack patterns, which can lead to rule rigidity. For example, a fixed frequency threshold cannot adapt to normal high-frequency operations during peak business hours, and lacks sensitivity to new attack patterns, resulting in high false positive rates. In addition, the update of static strategies relies on manual maintenance, which has a response lag problem, and may lead to high-risk operations not being intercepted in time before strategy adjustment.

[0005] (2) Data silos and insufficient cross-region risk control

[0006] The data of different business regions is usually stored independently, lacking the ability of collaborative analysis. For example, abnormal login behavior of a device in business region one may not be associated with abnormal transaction behavior in business region two, leading to missed risk detection. In addition, directly sharing raw data poses a risk of privacy leakage, which violates laws and regulations such as the Data Security Law and the Personal Information Protection Law.

[0007] (3) Challenges of Graph Neural Networks (GNN) in cross-region risk control

[0008] Although GNN has been used to construct user-transaction graphs, most existing solutions are based on data from a single business region. The implicit associations between cross-region entities (such as users, devices, interfaces) are not fully explored, so potential risks across regions cannot be efficiently captured.

[0009] (4) Limitations of existing federated learning solutions

[0010] Although existing horizontal federated learning and vertical federated learning (VFL) are applied to solve the problem of data silos, they fail to effectively utilize the relevance of graph structure data. For example, the traditional HFL model cannot effectively model the access path between users, devices, and interfaces, resulting in limited identification of cross-region association risks.

[0011] Therefore, it is necessary to provide a cross-region business risk detection method based on GNN and HFL to dynamically optimize access control strategies and improve risk detection capabilities in financial business scenarios. SUMMARY

[0012] The purpose of the present application is to provide a cross-region business risk detection method based on GNN and HFL to dynamically optimize access control strategies and improve risk detection capabilities in financial business scenarios.

[0013] In order to solve the problems existing in the prior art, the present application provides a cross-region business risk detection method based on GNN and HFL, comprising the following steps:

[0014] S1: Based on the business logs and audit data of each business region, a plurality of local business association subgraphs are constructed, and the plurality of local business association subgraphs are merged into a cross-region business association graph through dynamic edge weight calculation and cross-region edge supplement mechanism;

[0015] Wherein, the dynamic edge weight calculation method is as follows:

[0016] The edge weight of the same business region is dynamically calculated based on three types of factors:

[0017] ;

[0018] Wherein, is the edge weight of the same business region, i and j represent business entities; is the access frequency normalization, representing the interaction frequency of business entities i and j; is the risk score based on historical fraud events; is the time distribution deviation, 、 and are risk factor weight coefficients, and + + =1;

[0019] The edge weight between cross-region entities is calculated by combining the similarity function and the co-occurrence frequency function:

[0020] ;

[0021] Wherein, is the edge weight between cross-regional entities, i and j represent business entities; is the business entity similarity function; is the co-occurrence frequency of the representative business entity in different regions; and is the balance coefficient;

[0022] S2: Cross-regional feature alignment and compression;

[0023] S3: Optimization of hierarchical graph neural network;

[0024] S4: Construction of privacy-protected federated learning framework;

[0025] S5: Risk scoring and dynamic strategy optimization;

[0026] S6: Combining cross-regional graph structure modeling and dynamic edge weight calculation, cross-regional feature alignment and compression, optimization of hierarchical graph neural network, construction of privacy-protected federated learning framework, and risk scoring and dynamic strategy optimization, design of local and global two-layer joint training loss function.

[0027] Optionally, in the cross-regional business risk detection method based on GNN and HFL, a joint mechanism of regional independent projection, contrastive learning alignment, and attention feature compression is adopted for cross-regional feature alignment and compression.

[0028] Optionally, in the cross-regional business risk detection method based on GNN and HFL,

[0029] S21: The regional independent projection is as follows:

[0030] Regional independent projection is used to map local features to a unified hidden space, and a lightweight projection head is trained for each business region to project local high-dimensional features to a shared latent space, and the formula is as follows:

[0031] ;

[0032] where i represents a business entity, is the local high-dimensional feature of business entity i; is the projection head parameter of business entity i; is the low-dimensional vector after projection;

[0033] S22: The contrastive learning alignment is as follows:

[0034] Contrastive learning alignment is used to minimize the embedding difference of the same entity in different regions to ensure cross-regional consistency, and the loss function formula is as follows:

[0035] ;

[0036] in, This is a vector similarity function; For temperature parameters; and These are mutually positive sample sets, representing the representation vectors of the same entity in different business regions; and These are mutually negative sample sets, representing the representation vectors of different entities in different business areas;

[0037] S23: Attention feature compression is performed as follows:

[0038] Attention feature compression refers to introducing an attention mechanism into high-dimensional features to extract the most relevant features, thereby reducing communication overhead. The compression formula is as follows:

[0039] ;

[0040] in, For the local high-dimensional features of business entity i, This represents the feature value of the local high-dimensional feature in the d-th dimension. This represents the compressed feature vector. This represents attention weight.

[0041] Optionally, in the cross-regional business risk detection method based on GNN and HFL, the hierarchical graph neural network is optimized as follows:

[0042] S31: Design a two-layer GNN structure and perform representation learning based on the characteristics of business data;

[0043] S32: The local GNN layer is used to learn entity relationships within the business region. The learning method is as follows:

[0044] ;

[0045] in, Representation results of local GNN layers; It is a non-linear activation function; This represents the set of neighboring entities of business entity i in the local business association subgraph corresponding to its business region. This indicates the number of connections of business entity i in the local business association subgraph; The dynamic edge weights for the same business area calculated in S1; This is the parameter matrix that can be learned by the local layer; It is the business feature vector of the neighboring business entity j;

[0046] S33: Cross-region GNN layers are used to capture implicit relationships between different regions, and the capture method is as follows:

[0047] ;

[0048] wherein, represents the representation result of business entity i in the cross-regional GNN layer; is a nonlinear activation function; represents a set of entities that have similarity or co-occurrence relationship with business entity i in different business regions; is a cross-regional dynamic edge weight calculated based on the node similarity function and the cross-regional co-occurrence frequency function in S1; is a cross-regional learnable parameter matrix; is the representation result of neighbor business entity j in the local layer;

[0049] S34: A gating fusion mechanism is used to combine the local and cross-regional representations, and the combination method is as follows:

[0050] ;

[0051] ;

[0052] wherein, represents the fusion representation of business entity i, represents the representation result of the local GNN layer; represents the representation result of business entity i in the cross-regional GNN layer; g represents a gating coefficient, and the value range is [0, 1], is an activation function that maps the linear combination result to between 0 and 1, represents a learnable parameter matrix of the gating mechanism, represents a local and cross-regional feature concatenation vector;

[0053] For the risk probability output, the formula is as follows:

[0054] ;

[0055] wherein, refers to the risk probability predicted by the model, when is greater than a specified threshold, it is marked as a high-risk entity, is a classification layer parameter matrix; represents the fusion representation of business entity i, is a bias term; is an activation function.

[0056] Optionally, in the cross-regional business risk detection method based on GNN and HFL, a privacy-protected federated learning framework is constructed, and the method is as follows:

[0057] S41: Each participating region adopts a gradient difference strategy and only uploads the update gradient difference value of the model parameter;

[0058] Each business region as a participating node of federated learning uploads only the parameter change amount after local training to obtain model parameter updates, rather than complete model parameters, which is in the form of:

[0059] ;

[0060] Where: r represents the rth business region; represents the local model parameter of business region r after the tth training; represents the global model parameter of the previous round; represents the update gradient difference value of the model parameter uploaded by business region r;

[0061] S42: Differential privacy protection is performed in the following manner:

[0062] A risk-aware differential privacy mechanism is set, and the noise intensity is dynamically mapped with the region risk level through a continuous function, and the formula is as follows:

[0063] ;

[0064] Where, represents the privacy budget of business region r; represents the risk score normalized value of business region r; represents the balance factor; represents the basic privacy budget set by the system;

[0065] S43: Partial homomorphic encryption is used for uploaded gradients, so that the server can complete parameter aggregation in a ciphertext state, and the formula is as follows:

[0066] ;

[0067] Where, represents the update gradient difference value of the model parameter uploaded by business region r; represents a homomorphic encryption function supporting addition operation; represents that the server completes aggregation in a ciphertext state without decryption to obtain equivalent encryption sum;

[0068] S44: A risk-aware weighting mechanism is introduced when aggregating on the server side, and the formula is as follows:

[0069] , , ;

[0070] Where, represents the updated global model parameter; an update gradient difference representing model parameters uploaded by the business area r; a real-time risk score representing the business area r; a weight of the business area r in aggregation, k represents the kth business area, is a risk mapping function, and the update weight of a high-risk area is greater.

[0071] Optionally, in the cross-regional business risk detection method based on GNN and HFL, the risk score and dynamic strategy optimization are performed in the following manner:

[0072] The risk score is determined by the model prediction result and the business rule signal, and the formula is as follows:

[0073] ;

[0074] wherein R is a risk score, is a risk probability predicted by the hierarchical GNN model, BusinessRuleScore represents a static score based on a predefined business rule, and TimeRiskFactor represents a risk factor based on a time distribution, is a GNN output weight, ω is a business rule score weight, and ρ is a time risk factor weight.

[0075] Optionally, in the cross-regional business risk detection method based on GNN and HFL,

[0076] The local loss function is as follows:

[0077] In the kth business area, the loss function of the local model is defined as:

[0078] ;

[0079] wherein k represents the kth business area, represents a task loss, is a feature alignment loss weight, represents a cross-regional feature alignment loss, is a feature compression loss weight, represents an attention compression regular, is a federated constraint loss weight, represents a local model parameter of the business area r, represents a model parameter after global aggregation;

[0080] The global loss function is as follows:

[0081] On the server side, the global goal is to minimize the weighted local loss of all business areas:

[0082] ;

[0083] Wherein, N represents the number of participating business areas; The aggregation weight of the kth business area is determined by its risk score .

[0084] Compared with the prior art, the present application has the following advantages:

[0085] (1) The present application introduces a cross-area graph structure modeling and dynamic edge weight calculation mechanism, unifies the modeling of multiple types of entities such as users, devices, interfaces, and business operations, and combines factors such as interaction frequency, risk score, and time distribution deviation to construct a dynamically updated cross-area graph structure, effectively depicting potential cross-area risk propagation patterns.

[0086] (2) The present application solves the problem of heterogeneous feature space in different business areas through a regional independent projection head and a contrastive learning mechanism; at the same time, an attention compression module is introduced to focus on key risk features, reduce communication overhead, and improve model efficiency.

[0087] (3) The present application designs a local GNN layer, a cross-area GNN layer, and a gating fusion mechanism, realizes the joint modeling of regional internal risk patterns and cross-area implicit risks, and significantly improves the recognition ability of the model for "jumping attacks" and "multi-point coordinated risks".

[0088] (4) During the model training process, combined with incremental upload, hierarchical differential privacy, homomorphic encryption, and risk weighted aggregation, the unity of security, communication efficiency, and business sensitivity is realized, which not only guarantees the privacy of financial data, but also ensures the priority of high-risk areas in model updating.

[0089] (5) The present application introduces a risk score feedback mechanism in the model inference stage, combines the GNN output with business rules and time distribution-based risk factors, realizes adaptive parameter adjustment, and generates real-time access control strategies, which has strong business landing value. BRIEF DESCRIPTION OF DRAWINGS

[0090] Figure 1 The flowchart of the cross-area business risk detection method provided by the embodiment of the present application;

[0091] Figure 2 The flowchart of cross-area feature alignment and compression provided by the embodiment of the present application. DETAILED DESCRIPTION

[0092] The specific embodiments of the present application will be described in more detail below with reference to the accompanying drawings. The advantages and features of the present application will be more apparent from the following description. It should be noted that the drawings are very simplified and are not drawn to scale, and are only used to facilitate, clarify and assist in the description of the embodiments of the present application.

[0093] In the following, if the method described herein comprises a series of steps, the order of the steps presented herein is not necessarily the only order in which the steps can be performed, and some of the described steps can be omitted and / or some other steps not described herein can be added to the method.

[0094] In the prior art financial industry, especially in the banking system, the business system is usually divided into multiple logical areas (such as business area 1, business area 2, etc.) to achieve data isolation and security control. With the increase of business complexity, the demand for cross-area access control is increasingly urgent, but the prior art has significant deficiencies in cross-area business risk detection.

[0095] In order to solve the problems existing in the prior art, the present application provides a cross-area business risk detection method based on GNN (full name: Graph Neural Network, Chinese meaning: graph neural network) and HFL (full name: Horizontal Federated Learning, Chinese meaning: horizontal federated learning). As Figure 1 The cross-area business risk detection method comprises the following steps:

[0096] S1: In the model training phase, based on the business logs and audit data of each business area, a plurality of local business association sub-graphs are constructed (wherein the nodes represent business entities and the edges represent the interaction relationship between business entities), and through dynamic edge weight calculation and cross-area edge supplement mechanism, the plurality of local business association sub-graphs are merged to generate a cross-area business association graph; the local business association sub-graph is used to depict the entity interaction relationship within the same business area; the cross-area business association graph is used to depict the potential association and risk migration relationship between different business areas. Wherein, the local business association sub-graph is used to represent the interaction relationship between business entities within the same business area, and the cross-area business association graph is used to represent the entity association and risk migration path between different business areas.

[0097] For example, the cross-area business association graph is used to depict the explicit and implicit relationship between users, devices, interfaces and business operations, so the node types of the cross-area business association graph include users, devices, interfaces, business operations, etc., the edge types include user access to device, device call interface, user trigger operation, etc., and the cross-area business association graph is used to provide time sequence perception and risk sensitive graph input for subsequent hierarchical GNN training.

[0098] Each edge of the cross-region business association graph carries a basic feature vector (such as access frequency, last access time, device fingerprint difference, historical risk label, etc.), and a dynamic weight is calculated based on these features. The dynamic edge weight calculation method is as follows:

[0099] The edge weight of the same business region is dynamically calculated based on three types of factors:

[0100] ;

[0101] wherein, is the edge weight of the same business region, and i and j represent business entities (such as users, devices, interfaces, business operations, etc.); is the access frequency normalization, representing the interaction frequency of business entities i and j; is the risk score based on historical fraud events, for example, the same device has participated in abnormal transactions; is the time distribution deviation, used to measure the deviation of behavior occurrence time from the normal business period, for example, the weight can be increased when accessing at night or during holidays, , and are risk factor weight coefficients, which are dynamically set by business strategies, used to balance the contribution of access frequency, historical risk, and time anomaly in edge weight calculation. And + + =1, , and are non-negative real numbers;

[0102] The edge weight between cross-region entities is calculated by combining the similarity function and the co-occurrence frequency function:

[0103] ;

[0104] wherein, is the edge weight between cross-region entities, and i and j represent business entities; represents the business entity similarity function (such as device fingerprint similarity, interface function similarity); represents the co-occurrence frequency of business entities in different regions; and are balance coefficients, used to adjust the contribution of similarity and co-occurrence frequency, so as to realize the merging of different region graphs and global modeling. The dynamic weight update of this part belongs to the cross-region business association graph modeling in the training stage, used to improve the perception ability of the model to potential risk patterns.

[0105] The step realizes unified modeling of the local business correlation subgraph to the cross-region business correlation graph, and provides a structural basis for subsequent cross-region feature alignment, hierarchical graph neural network training.

[0106] S2: cross-region feature alignment and compression is performed:

[0107] Specifically, in the modeling process of the cross-region business correlation graph, the data distribution, feature dimension and semantic space of different regions are significantly different (such as log format, field difference). If directly spliced or simply aligned, model bias and semantic conflict are easy to cause. Therefore, the application adopts a joint mechanism of region independent projection, contrastive learning alignment and attention feature compression to perform cross-region feature alignment and compression to realize efficient cross-region feature unified representation.

[0108] Reference Figure 2 The main process of cross-region feature alignment and compression is as follows: region original feature input, local encoder encoding, region independent projection head, latent vector representation, contrastive learning alignment module is used for contrast respectively, contrast loss is obtained, attention feature compression model is used for compression, compressed feature representation is obtained, based on the joint optimization target of contrast loss and compressed feature representation, finally cross-region unified representation is provided for GNN layer.

[0109] Further, S21: the region independent projection is as follows:

[0110] The region independent projection is used to map the local feature to a unified hidden space, and a lightweight projection head is trained for each business region to project the local high-dimensional feature to a shared latent space, and the formula is as follows:

[0111] ;

[0112] Where, i represents a business entity, is the local high-dimensional feature of the business entity i; is the projection head parameter of the business entity i; is the low-dimensional vector after projection; this mechanism allows each region to optimize independently according to its own feature distribution, while ensuring that the features after cross-region projection have comparability.

[0113] S22: the contrastive learning alignment is as follows:

[0114] The contrastive learning alignment is used to minimize the embedding difference of the same entity in different regions to ensure cross-region consistency, and the loss function formula is as follows:

[0115] ;

[0116] Where, is a vector similarity function (cosine similarity). is a temperature parameter; and are positive sample sets, representing the same entity in different business areas; and are negative sample sets, representing different entities in different business areas; this mechanism ensures that the same entity is close across regions, and different entities are separated, thereby achieving feature alignment.

[0117] S23: The attention feature compression method is as follows:

[0118] Attention feature compression refers to introducing an attention mechanism to high-dimensional features to extract the most relevant features to reduce communication overhead, and its compression formula is as follows:

[0119] ;

[0120] wherein, is the local high-dimensional feature of the business entity i. represents the feature value of the local high-dimensional feature in the dth dimension, indicating a specific business feature, such as user historical transaction frequency, device fingerprint similarity, interface access frequency, and operation time distribution deviation. represents the compressed feature vector, which retains the most critical risk-related information. represents the attention weight, indicating the importance coefficient of the dth feature dimension, which reflects the importance of the dimension and is automatically learned by the model.

[0121] Further, satisfies the following conditions:

[0122] ; ; ;

[0123] wherein, represents the learnable importance score of feature dimension d, represents mapping the score value to a non-negative weight for normalization, and using the exponential function is to highlight the difference in high dimension, so that the model focuses more on key features. then is used to normalize all feature dimensions, and this operation ensures that the attention weights of all dimensions form a probability distribution, so that the importance of each dimension is interpretable and comparable.

[0124] The loss function formula is as follows:

[0125] ;

[0126] wherein, Local high-dimensional features of the business entity i. represent the feature representation after attention compression, represent the importance coefficient of the dth feature dimension, represent the entropy regularization coefficient, which is used to prevent the attention weight from being too extreme. This mechanism automatically focuses on key features such as device fingerprint anomalies and sensitive interface calls, and weakens irrelevant information such as regular low-risk access, thereby improving the training efficiency and risk identification accuracy of subsequent graph neural network models while reducing feature dimension and communication overhead.

[0127] S3: Optimize the hierarchical graph neural network in the following way:

[0128] S31: Design a double-layer GNN structure to learn the characteristics of business data;

[0129] S32: The local GNN layer is used to learn the entity relationships within the business area, and the learning method is as follows:

[0130] ;

[0131] The input features include user historical transaction times, device fingerprint similarity, interface access frequency, operation time distribution deviation, and other business features. Among them, represent the representation results of the local GNN layer; is a nonlinear activation function; represents the neighbor entity set of business entity i in the local business association subgraph corresponding to its business area, represents the number of connections of business entity i in the local business association subgraph, which is used to scale the neighbor aggregation results to avoid high connection node weights, thereby avoiding the bias caused by high connection entities to the model training; is the same business area dynamic edge weight calculated in S1, which is dynamically calculated by access frequency, historical risk score, and time distribution deviation to dynamically reflect the business risk trend; is a locally learnable parameter matrix; is the business feature vector of neighbor business entity j (such as transaction times, device fingerprint similarity, etc.). Through this method, the model can learn the abnormal access patterns between users and devices, interfaces within the same area, such as "single-device short-time high-frequency access to multiple interfaces".

[0132] S33: The cross-area GNN layer is used to capture the implicit associations between different areas, and the capture method is as follows:

[0133] ;

[0134] The input features include cross-region entity association, such as "a user frequently fails to log in in a business area I, and then makes a large payment in a business area II". Among them, represents the representation result of the business entity i in the cross-region GNN layer; is a nonlinear activation function; represents a set of entities that have similarity or co-occurrence relationship with the business entity i in different business areas; is a cross-region dynamic edge weight calculated based on the node similarity function and the cross-region co-occurrence frequency function in S1, which ensures that risk information can be transmitted between different business areas; is a cross-region learnable parameter matrix; is the representation result of the neighbor business entity j in the local layer; in this way, it can be achieved to timely discover the "jump attack" or "account sharing" risk between regions.

[0135] S34: The gating fusion mechanism is used to combine the local and cross-region representations, and the combination method is as follows:

[0136] ;

[0137] ;

[0138] Among them, represents the fusion representation of the business entity i, which has both the intra-regional fine-grained risk detection capability (such as abnormal calls between users and interfaces) and the inter-regional macro risk migration detection capability (such as cross-region attack chain behavior). The fusion representation is then input into the task layer for risk identification and access control policy generation, thereby realizing end-to-end modeling of complex business risks. represents the representation result of the local GNN layer; represents the representation result of the business entity i in the cross-region GNN layer; g represents the gating coefficient, which is in the range of [0, 1], dynamically controls the fusion ratio of the local and cross-region information, and can be regarded as a "risk attention weight" for quantifying the dependence of the model on the risk source at different business levels, which has practical value in model explainable analysis. The gating coefficient g is controlled by business features. If the cross-region risk index is higher, the gating tends to amplify , is an activation function that maps the linear combination result to between 0 and 1, represents a learnable parameter matrix of the gating mechanism, represents the concatenation vector of the local and cross-region features; this formula can finally achieve dynamic amplification of a certain type of feature according to the business risk level.

[0139] For the risk probability output, the formula is as follows:

[0140] ;

[0141] where, is the model predicted risk probability (between 0 and 1, the larger the risk is higher), when is greater than a specified threshold, then it is marked as a high-risk entity, is the classification layer parameter matrix; represents the fused representation of business entity i, is the bias term; is the activation function.

[0142] Finally, the classification loss of the GNN uses the cross-entropy loss formula, the formula of which is as follows:

[0143] ;

[0144] where, represents the true risk label of the i-th business entity (1 represents high risk, and 0 represents normal); represents the risk prediction probability output by the GNN. Therefore, this formula ensures that the model can correctly distinguish between "risk access" and "normal access".

[0145] S4: Construct a privacy-protected federated learning framework; in cross-regional model training, the present application adopts a privacy-protected federated learning mechanism, which guarantees data security while improving the detection ability of the global model on high-risk regions.

[0146] The privacy-protected federated learning framework is constructed in the following manner:

[0147] S41: Incremental upload: each participating region adopts a gradient difference strategy and only uploads the update gradient difference value of the model parameters, rather than the complete parameters. On this basis, the present application further combines Top-k sparsification and low-precision quantization. The implementation manners are respectively to retain only the top (k%) large gradients, discard redundant updates, and compress the gradients into low-precision quantization representations.

[0148] Specifically, each business region serves as a participating node of federated learning, and after obtaining the model parameter updates through local training, only the parameter change amount is uploaded, rather than the complete model parameters, which is in the form of:

[0149] ;

[0150] where: r represents the r-th business region; represents the local model parameters of the business region r after the t-th round of training; represents the global model parameters of the previous round; represents the update gradient difference value of the model parameters uploaded by the business region r. By uploading only the increment, the communication amount can be reduced and the risk of model leakage can be reduced.

[0151] In the financial risk control scenario, the frequency of risk events varies significantly in different regions: the first-tier cities have large transaction volumes and many risks, while remote areas have small business volumes and stable fluctuations. This mechanism effectively avoids "ineffective communication" by identifying and filtering small gradient changes in low-risk areas.

[0152] The measured data shows that this strategy can reduce the communication bandwidth consumption by 20%-30%, while the dynamic threshold control ensures that the update of high-risk areas will not be missed.

[0153] S42: Perform differential privacy protection. Before uploading the gradient in the business area r, introduce a privacy budget control mechanism related to the risk level of the area, as follows:

[0154] Set a risk-aware differential privacy mechanism that dynamically maps noise intensity to the risk level of the area through a continuous function. The formula is as follows:

[0155] ;

[0156] where, represents the privacy budget of the business area r; represents the normalized risk score of the business area r; represents the balance factor, which is used to control the difference in privacy strength between different risk levels; represents the basic privacy budget set by the system, and the high-risk area corresponds to a larger to reduce noise interference and preserve risk characteristics; low-risk areas inject stronger noise to enhance privacy protection; this invention dynamically adjusts the Laplace noise scale ( ) according to the risk level of the area, with a smaller noise disturbance ( ) of 0.1 to 0.5 in high-risk areas to maximize the sensitivity of the model to abnormal patterns, and a larger disturbance ( ) of 1 to 2 in low-risk areas to further reduce the risk of sensitive information leakage. This mechanism achieves a dynamic balance of "the higher the risk, the higher the fidelity; the lower the risk, the stricter the privacy protection" while ensuring the overall privacy budget. Even if an attacker intercepts the uploaded parameters, it is impossible to infer sensitive business information such as user identity and transaction amount distribution.

[0157] S43: Partial homomorphic encryption is used for the uploaded gradient, allowing the server to complete parameter aggregation in a ciphertext state, as follows:

[0158] ;

[0159] where, represents the update gradient difference value of the model parameters uploaded by the business area r; a homomorphic encryption function representing support for an addition operation, The representative server completes aggregation in a ciphertext state, and an equivalent encryption and can be obtained without decryption. The computing overhead of the scheme is significantly lower than that of full homomorphic encryption, while being sufficient to meet the needs of the federal training scene. During the aggregation process, neither the server nor the third party can obtain the business pattern (such as the distribution of abnormal transactions) of a certain region, effectively preventing privacy leakage during training.

[0160] S44: During server-side aggregation, a risk-aware weighting mechanism is introduced, and the formula is as follows:

[0161] , , ;

[0162] wherein, represent the updated global model parameters; represent the update gradient difference value of the model parameters uploaded by the business area r; represent the real-time risk score of the business area r; represent the weight of the business area r in aggregation, and k represents the kth business area, is a risk mapping function, so that the update weight of a high-risk area is greater. When aggregating on the server side, higher weights are given to high-risk business areas. This not only ensures data security, but also improves the detection capability of high-risk areas. When a certain area has a high incidence of risk events, its update weight is automatically increased, ensuring that the global model is more sensitive to high-risk areas, thereby improving the overall risk detection capability. Compared with the traditional linear weight, the present application avoids the problem of excessive "domination" of the global model by extremely high-risk areas, and realizes more smooth risk-driven aggregation.

[0163] S5: Risk scoring and dynamic strategy optimization are performed in the following manner:

[0164] The risk score is determined by the model prediction result and the business rule signal, and the formula is as follows:

[0165] ;

[0166] wherein R is the risk score, is the risk probability predicted by the hierarchical GNN model, reflecting the dynamic risk characteristics of entities such as users, devices, and interfaces. BusinessRuleScore represents a static score based on predefined business rules, such as accessing sensitive interfaces, transaction amounts exceeding thresholds, etc. TimeRiskFactor represents a risk factor based on time distribution, such as assigning higher risk weights when accessing at night or during non-working hours. is the GNN output weight, ω is the business rule score weight, and ρ is the time risk factor weight, , ω and ρ are adjustable parameters to dynamically balance the contribution of model prediction and rule signal. In the period of frequent new-type attacks, increase ω to enhance the dependence on GNN model prediction; in the regulatory compliance scenario, increase ω to ensure the priority of rule strategy; in the time risk sensitive scenario (such as cross-border payment, high-value transfer at night), increase ρ to highlight the influence of time risk factor. The risk score result will drive the dynamic generation of access control strategy: when R is below the threshold: normal release; when R is in the medium interval: trigger secondary verification (such as SMS verification, face recognition); when R exceeds the high-risk threshold: directly intercept access or freeze the account.

[0167] S6: Combine cross-regional graph structure modeling and dynamic edge weight calculation, cross-regional feature alignment and compression, optimize hierarchical graph neural network, construct privacy-protected federated learning framework, and risk scoring and dynamic strategy optimization, design local and global two-layer joint training loss function;

[0168] The local loss function is as follows:

[0169] In the kth business region, the loss function of the local model is defined as:

[0170] ;

[0171] Where k represents the kth business region, represents the task loss, which is supervised by the real business label of the region. is the feature alignment loss weight, used to control the balance between cross-regional feature consistency and task target. represents the cross-regional feature alignment loss, which ensures the feature consistency of the same entity in different regions through contrastive learning. is the feature compression loss weight, used to control the trade-off between compression accuracy and communication efficiency. represents attention compression regularization, which avoids excessive concentration or averaging of attention mechanism and improves feature compression effect. is the federated constraint loss weight, used to control the consistency between local model and global aggregation. represents the local model parameter of business region r, represents the model parameter after global aggregation.

[0172] The global loss function is as follows:

[0173] On the server side, the global goal is to minimize the weighted local loss of all business regions:

[0174] ;

[0175] Where N represents the number of participating business regions; aggregated weight representing the kth business area, by its risk score determined.

[0176] ;

[0177] The mechanism ensures that high-risk areas contribute more in global training, thereby improving the model's detection ability for risk-prone areas.

[0178] Therefore, the joint training target of the present application can be summarized as: on the local level, simultaneously optimizing business detection accuracy, cross-area consistency and feature compression effect; on the global level, through risk-weighted aggregation of federated learning, realizing cross-area knowledge sharing and ensuring that data does not leave the domain. Finally, the global loss function embodies both business-driven and the security and efficiency of federated learning, thereby forming an end-to-end, privacy-protected, risk-sensitive cross-area financial risk control model training framework.

[0179] In summary, compared with the prior art, the present application has the following advantages:

[0180] (1) The present application introduces a cross-area graph structure modeling and dynamic edge weight calculation mechanism, unifies the modeling of multiple types of entities such as users, devices, interfaces and business operations, and combines factors such as interaction frequency, risk score and time distribution deviation to construct a dynamically updated cross-area graph structure, effectively depicting potential cross-area risk propagation patterns.

[0181] (2) The present application solves the problem of feature space heterogeneity in different business areas through the mechanism of regional independent projection head and contrastive learning; at the same time, it introduces an attention compression module to focus on key risk features, reduce communication overhead and improve model efficiency.

[0182] (3) The present application designs a local GNN layer, a cross-area GNN layer and a gating fusion mechanism, realizes the joint modeling of regional internal risk patterns and cross-area implicit risks, and significantly improves the model's ability to identify "jump attacks" and "multi-point coordinated risks".

[0183] (4) During model training, combined with incremental upload, hierarchical differential privacy, homomorphic encryption and risk-weighted aggregation, the security, communication efficiency and business sensitivity are unified, which not only guarantees the privacy of financial data, but also ensures the priority of high-risk areas in model updating.

[0184] (5) The present application introduces a risk score feedback mechanism in the model inference stage, combines the GNN output with business rules and risk factors based on time distribution to realize adaptive parameter adjustment, thereby generating real-time access control strategies, and has strong business landing value.

[0185] The above merely describes the preferred embodiments of the present application and does not limit the present application in any way. Any person skilled in the art can make any form of equivalent replacement or modification to the technical solutions and technical contents disclosed by the present application without departing from the scope of the technical solutions of the present application, and such changes still belong to the protection scope of the present application.

Claims

1. A cross-regional business risk detection method based on GNN and HFL, characterized in that, Includes the following steps: S1: Construct multiple local business association subgraphs based on business logs and audit data from each business region. Through dynamic edge weight calculation and cross-regional edge supplementation mechanism, merge multiple local business association subgraphs into a cross-regional business association graph. The dynamic edge weights are calculated as follows: The edge weights for the same business region are dynamically calculated based on three types of factors: ； in, The edge weights are defined for the same business region, where i and j represent business entities. To normalize the access frequency, it represents the interaction frequency between business entities i and j; Risk scores are based on historical fraud incidents; The deviation of the time distribution. , and These are the risk factor weighting coefficients, and + + =1; The edge weights between entities across regions are calculated by combining the similarity function and the co-occurrence frequency function: ； in, The edge weights between cross-regional entities are defined, where i and j represent business entities. Represents the similarity function of business entities; This represents the co-occurrence frequency of business entities in different regions; and This is the balance coefficient; S2: Perform cross-region feature alignment and compression; S3: Optimize hierarchical graph neural networks; S4: Construct a privacy-preserving federated learning framework; S5: Conduct risk scoring and dynamic strategy optimization; S6: Combining cross-regional graph structure modeling and dynamic edge weight calculation, cross-regional feature alignment and compression, optimization of hierarchical graph neural networks, construction of a privacy-preserving federated learning framework, and risk scoring and dynamic policy optimization, a joint training loss function for local and global layers is designed.

2. The cross-regional business risk detection method based on GNN and HFL as described in claim 1, characterized in that, A joint mechanism of region-independent projection, contrastive learning alignment, and attention feature compression is adopted to perform cross-region feature alignment and compression.

3. The cross-regional business risk detection method based on GNN and HFL as described in claim 2, characterized in that, S21: The method of region-independent projection is as follows: Region-independent projection is used to map local features to a unified latent space. Each business region trains a lightweight projection head to project local high-dimensional features to a shared latent space, as shown in the following formula: ； Where i represents the business entity, For the local high-dimensional features of business entity i; For the projection head parameters of business entity i; This is the projected low-dimensional vector; S22: The method of contrastive learning alignment is as follows: Contrastive learning alignment is used to minimize the embedding differences of the same entity in different regions, ensuring cross-regional consistency. Its loss function formula is as follows: ； in, This is a vector similarity function; For temperature parameters; and These are mutually positive sample sets, representing the representation vectors of the same entity in different business regions; and These are mutually negative sample sets, representing the representation vectors of different entities in different business areas; S23: Attention feature compression is performed as follows: Attention feature compression refers to introducing an attention mechanism into high-dimensional features to extract the most relevant features, thereby reducing communication overhead. The compression formula is as follows: ； in, For the local high-dimensional features of business entity i, This represents the feature value of the local high-dimensional feature in the d-th dimension. This represents the compressed feature vector. This represents attention weight.

4. The cross-regional business risk detection method based on GNN and HFL as described in claim 1, characterized in that, The hierarchical graph neural network is optimized as follows: S31: Design a two-layer GNN structure and perform representation learning based on the characteristics of business data; S32: The local GNN layer is used to learn entity relationships within the business region. The learning method is as follows: ； in, Representation results of local GNN layers; It is a non-linear activation function; This represents the set of neighboring entities of business entity i in the local business association subgraph corresponding to its business region. This indicates the number of connections of business entity i in the local business association subgraph; The dynamic edge weights for the same business area calculated in S1; This is the parameter matrix that can be learned by the local layer; It is the business feature vector of the neighboring business entity j; S33: Cross-region GNN layers are used to capture implicit relationships between different regions, and the capture method is as follows: ； in, This represents the representation result of business entity i in the cross-region GNN layer; It is a non-linear activation function; This represents the set of entities that have similarity or co-occurrence relationships with business entity i in different business regions; The cross-regional dynamic edge weights are calculated in S1 based on the node similarity function and the cross-regional co-occurrence frequency function. A parameter matrix that can be learned across regions; The representation result of the neighboring business entity j at the local layer; S34: The gating fusion mechanism is used to combine local and cross-regional representations, and the combination method is as follows: ； ； in, This represents the fusion representation of business entity i. Representation results of local GNN layers; This represents the representation result of business entity i in the cross-region GNN layer; g represents the gating coefficient, with a value range of [0,1]. As an activation function, it maps the result of a linear combination to between 0 and 1. The learnable parameter matrix representing the gating mechanism. This represents a vector concatenated from local and cross-regional features; The formula for outputting the risk probability is as follows: ； in, This refers to the probability of risk predicted by the model, when If the value exceeds a specified threshold, it is marked as a high-risk entity. This is the classification layer parameter matrix; This represents the fusion representation of business entity i. For bias terms; This is the activation function.

5. The cross-regional business risk detection method based on GNN and HFL as described in claim 1, characterized in that, The following method is used to construct a privacy-preserving federated learning framework: S41: Each participating region adopts a gradient difference strategy, and only uploads the updated gradient difference values ​​of the model parameters; Each business region, acting as a participating node in federated learning, uploads only the parameter changes, not the complete model parameters, after obtaining model parameter updates through local training. The format is as follows: ； Where: r represents the r-th business area; This represents the local model parameters of the business region r after the t-th round of training; This represents the global model parameters from the previous round; This represents the difference in the update gradient of the model parameters uploaded to the business region r; S42: Implement differential privacy protection as follows: A differential privacy mechanism for risk perception is set up, which dynamically maps noise intensity to regional risk level through a continuous function, as shown in the following formula: ； in, The privacy budget for business region r; This represents the normalized risk score value for business region r; Represents the balance factor; This represents the basic privacy budget set by the system; S43: Partial homomorphic encryption is used for the uploaded gradient, enabling the server to complete parameter aggregation in ciphertext. The formula is as follows: ； in, This represents the difference in the update gradient of the model parameters uploaded to the business region r; This represents a homomorphic encryption function that supports addition operations; This means the server completes the aggregation in ciphertext, and the equivalent encrypted sum can be obtained without decryption; S44: When aggregating on the server side, a risk-aware weighting mechanism is introduced, with the following formula: ， ， ； in, Represents the updated global model parameters; This represents the difference in the update gradient of the model parameters uploaded to the business region r; Real-time risk score representing business area r; The value of business region r in the aggregation represents the weight of the business region r, and k represents the k-th business region. This is a risk mapping function that gives higher update weights to high-risk areas.

6. The cross-regional business risk detection method based on GNN and HFL as described in claim 5, characterized in that, Risk scoring and dynamic strategy optimization are performed as follows: The risk score is determined by both the model prediction results and business rule signals, and its formula is as follows: ； Where R represents the risk score. This refers to the risk probability predicted by the hierarchical GNN model. BusinessRuleScore represents a static score based on predefined business rules, and TimeRiskFactor represents a risk factor based on time distribution. The output weights of the GNN are ω, where ω is the business rule scoring weight and ρ is the time risk factor weight.

7. The cross-regional business risk detection method based on GNN and HFL as described in claim 6, characterized in that, The local loss function is as follows: In the k-th business region, the loss function of the local model is defined as: ； Where k represents the k-th business area, Represents mission loss. For feature alignment loss weights, Represents cross-region feature alignment loss. For feature compression loss weights, This represents an attention compression regularization. For federal constraint loss weight, This represents the local model parameters for the business region r. Represents the model parameters after global aggregation; The global loss function is as follows: On the server side, the global goal is to minimize the weighted local loss across all business regions: ； Where N represents the number of business regions involved; The aggregate weight representing the k-th business region is determined by its risk score. Decide.

Images