Cross-border fund flow risk assessment method and device

Abstract

The invention provides a cross-border fund flow risk assessment method which can be applied to the technical field of artificial intelligence. The method comprises the following steps: acquiring a standardized event stream; for the standardized events in the time window, constructing an incremental graph structure used for representing fund link flow characteristics; in the incremental graph structure, node fission strength is calculated for an initial edge in the current time window, a node with the node fission strength exceeding a first preset threshold value serves as a fission starting point to execute three-hop breadth-first search, and a search result is obtained; performing dual-channel gating convolution processing on the transaction sequence and the regional feature sequence represented by the candidate sub-graph determined based on the target path to obtain a sub-graph embedded vector; and splicing the sub-graph embedding vector with the predicted merging residual duration, the node fission strength and the cross-regional hop count into a state vector, inputting the state vector into a game reinforcement learning model to output the freezing probability of a candidate sub-graph, and determining a risk assessment result of the standardized event according to the freezing probability.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, and more particularly to a cross-border fund flow risk assessment method, device, equipment, storage medium and program product. BACKGROUND

[0002] With the rapid development of information technology worldwide, the continuous development of global financial markets and the expansion of financial transaction scale, the concealment and complexity of abnormal fund transfer transactions that disrupt the order of financial markets are also increasing, posing a serious challenge to the compliance management of financial institutions. The risk scoring model for fund supervision is mainly offline training, which is difficult to process abnormal transactions in a timely manner according to the dynamic process of transactions. SUMMARY

[0003] In view of the above problems, the present application provides a cross-border fund flow risk assessment method, device, equipment, medium and program product.

[0004] According to a first aspect of the present application, a cross-border fund flow risk assessment method is provided, comprising: obtaining a standardized event stream representing the state of cross-border fund flow, wherein the standardized event in the standardized event stream carries at least a timestamp, a payment account identifier, a receiving account identifier and a transfer amount, and the standardized event is used to represent a single fund flow relationship; for the standardized events in a time window, taking the payment account identifier and the time window serial number as nodes, taking the fund flow relationship as an initial edge, embedding the regional risk weight corresponding to the payment account in the node, and embedding the currency conversion relationship in the initial edge, to construct an incremental graph structure for representing the fund link flow characteristics, wherein the time window represents a time length that is inversely proportional to the number of standardized events of the standardized event stream in a preset period; in the incremental graph structure, calculating the node fission intensity of the initial edge in the current time window, taking the node whose node fission intensity exceeds a first preset threshold as a fission starting point to perform a three-hop breadth-first search, obtaining a search result, wherein the search result is used to filter a target path from the incremental graph structure that meets the transaction residence time constraint and the regional risk condition constraint; performing double-channel gated convolution processing on the transaction sequence and the regional feature sequence represented by the candidate subgraph determined based on the target path, to obtain a subgraph embedding vector, wherein the subgraph embedding vector is used to represent the fund convergence trajectory feature and the cross-region risk distribution feature; and concatenating the subgraph embedding vector with the predicted remaining time, the node fission intensity and the cross-region hop number into a state vector, inputting the state vector into a game reinforcement learning model to output a freezing probability of the candidate subgraph, and determining a risk assessment result of the standardized event according to the freezing probability.

[0005] The second aspect of the present application provides a cross-border fund flow risk assessment device, comprising: an acquisition module configured to acquire a standardized event stream representing a cross-border fund flow state, wherein a standardized event in the standardized event stream carries at least a timestamp, a payment account identifier, a payee account identifier, and a transfer amount, and the standardized event is used to represent a single fund flow relationship; an incremental graph construction module configured to, for a standardized event in a time window, construct an incremental graph structure representing fund link flow characteristics by taking the payment account identifier and a time window serial number as nodes, taking a fund flow relationship as an initial edge, embedding a regional risk weight corresponding to the payment account in the nodes, and embedding a currency conversion relationship in the initial edge, wherein the time window represents a time length that is inversely proportional to the number of standardized events of the standardized event stream in a preset period; a search module configured to, in the incremental graph structure, calculate a node fission intensity of an initial edge in a current time window, perform a three-hop breadth-first search on a node with a node fission intensity exceeding a first preset threshold as a fission starting point to obtain a search result, wherein the search result is used to filter a target path meeting a transaction residence time length constraint and a regional risk condition constraint from the incremental graph structure; a feature extraction module configured to perform double-channel gated convolution processing on a transaction sequence and a regional feature sequence represented by a candidate subgraph determined based on the target path to obtain a subgraph embedding vector, wherein the subgraph embedding vector is used to represent fund convergence trajectory features and cross-region risk distribution features; and a risk assessment module configured to concatenate the subgraph embedding vector with a predicted remaining time length, a node fission intensity, and a cross-region hop number into a state vector, input the state vector into a game reinforcement learning model to output a freezing probability of the candidate subgraph, and determine a risk assessment result of the standardized event according to the freezing probability.

[0006] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0007] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, wherein the computer program or instructions are executed by a processor to implement the steps of the above method.

[0008] The fifth aspect of the present application further provides a computer program product comprising a computer program or instructions, wherein the computer program or instructions are executed by a processor to implement the steps of the above method. BRIEF DESCRIPTION OF DRAWINGS

[0009] The above content of the present application and other purposes, features and advantages will be more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0010] Figure 1 An application scenario diagram of the cross-border fund flow risk assessment method according to an embodiment of the present application is schematically shown;

[0011] Figure 2 A flowchart of the cross-border fund flow risk assessment method according to an embodiment of the present application is schematically shown;

[0012] Figure 3 A flowchart of the three-hop breadth-first search method based on a fission starting point according to an embodiment of the present application is schematically shown;

[0013] Figure 4 A game reinforcement learning model optimization flowchart according to an embodiment of the present application is schematically shown;

[0014] Figure 5 A structural block diagram of the cross-border fund flow risk assessment device according to an embodiment of the present application is schematically shown; and

[0015] Figure 6 A block diagram of an electronic device suitable for implementing the cross-border fund flow risk assessment method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0016] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. It should be understood, however, that the description which follows is merely exemplary and is not intended to limit the scope of the application. In the following detailed description of the embodiments of the present application, numerous specific details are set forth in order to provide a thorough understanding of the present application. However, it will be apparent to one skilled in the art that one or more embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and functions have not been described in detail in order to avoid obscuring aspects of the present application.

[0017] The terms used herein are merely used to describe specific embodiments and are not intended to limit the present application. The terms "include", "comprise" and the like used herein indicate the presence of the described features, steps, operations and / or components, but do not exclude the presence or addition of one or more other features, steps, operations or components.

[0018] All terms used herein, including technical and scientific terms, have meanings commonly understood by one of ordinary skill in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having meanings consistent with the context of the present specification, and should not be interpreted in an idealized or overly formal manner.

[0019] In the case of using expressions similar to "at least one of A, B, and C, etc.", it should generally be interpreted that the meaning is the same as "at least one of A or B; at least one of A or C; at least one of B or C; at least one of A, B, and C; etc."

[0020] In the technical solutions of the present application, the user information (including but not limited to user personal information, user image information, user equipment information, such as location information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved are information and data authorized by the user or authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of related data comply with relevant laws, regulations and standards, necessary security measures are taken, do not violate public order and good customs, and provide corresponding operation portal for user to choose authorization or refusal.

[0021] In the scenario of using personal information for automated decision-making, the method, device and system provided by the embodiments of the present application all provide corresponding operation portal for the user to choose to agree or refuse the automated decision-making result; if the user chooses to refuse, the expert decision-making process is entered. The expression "automated decision-making" here refers to the activity of automatically analyzing, evaluating the behavior habits, interests and hobbies or economic, health, credit status of individuals, etc. by computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by personnel who are engaged in a certain field of work, have special experience, knowledge and skills, and have reached a certain professional level.

[0022] Most cross-border fund monitoring systems in related technologies rely on fixed-window aggregation and offline snapshot analysis. When data enters a unified object model, it is abstracted into a few common fields, weakening channel-specific transaction details and millisecond-level sequence information. This makes it difficult to capture fine-grained fund splitting and rapid repatriation within a short period. Streaming layers typically use preset window lengths ranging from one minute to one hour, unable to dynamically shrink or expand the window based on real-time traffic. This leads to node bloat during peak trading periods and sparse connections during off-peak periods, resulting in discontinuities in the overall graph structure as time slices change. Meanwhile, updates to sanctions lists and high-risk customer tags are usually done in daily or hourly batches. The inherent time lag between list snapshots and real-time events allows high-risk accounts to be merged or withdrawn within the update interval. Existing graph database solutions often run query rules by generating static snapshots daily or hourly. Continuous paths are split across different snapshots, requiring additional merging or manual verification to restore the complete chain, causing alarm delays and error accumulation. The risk scoring model primarily uses offline trained node or edge embeddings. During the inference phase, it can only provide results based on static thresholds, making it difficult to dynamically adjust the freezing probability as the link evolves. Computing power allocation relies on a fixed GPU queue, with real-time inference and batch training competing for resources, requiring manual intervention during peak periods. When the number of risky links surges, the system may proactively downsample or delay analysis, further increasing the probability of missed detections.

[0023] Embodiments of this application provide a method for assessing the risk of cross-border capital flows, comprising: splitting transaction data into multiple sub-transaction data in response to a transaction instruction type representing aggregated payment; constructing an incremental graph based on the multiple sub-transaction data whose timestamps are within a target time slice; determining candidate subgraphs based on the incremental graph; calculating a reward based on the transaction data, misjudgment loss, and risk score corresponding to the embedding vector of the candidate subgraph; calculating the expected long-term cumulative reward corresponding to the embedding vector of the subgraph based on the reward; and calculating the risk probability of the sub-transaction data corresponding to the embedding vector of the subgraph based on the expected long-term cumulative reward and the merging time point of the sub-transaction data corresponding to the embedding vector of the subgraph.

[0024] Figure 1 The diagram illustrates an application scenario of the cross-border capital flow risk assessment method according to an embodiment of this application.

[0025] like Figure 1As shown, the application scenario 100 according to this embodiment can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or fiber optic cables, and the like.

[0026] A user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, and the like. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as web browser applications, instant messaging tools, email clients, social platform software, and the like (only as examples).

[0027] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smartphones, tablet computers, laptop computers, desktop computers, and the like.

[0028] The server 105 can be a server providing various services, such as a background management server providing support for a website browsed by a user using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (only as an example). The background management server can analyze and process received user requests and the like, and feed back the processing results (such as web pages, information, or data, and the like obtained or generated according to user requests) to the terminal device.

[0029] It should be noted that the cross-border fund flow risk assessment method provided by the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the cross-border fund flow risk assessment device provided by the embodiments of the present disclosure can generally be arranged in the server 105. The cross-border fund flow risk assessment method provided by the embodiments of the present disclosure can also be executed by a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105. Accordingly, the cross-border fund flow risk assessment device provided by the embodiments of the present disclosure can also be arranged in a server or a server cluster different from the server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or the server 105.

[0030] It should be understood that, Figure 1The number of terminal devices, networks and servers in the above-mentioned scenario is only illustrative. Any number of terminal devices, networks and servers can be provided according to implementation needs.

[0031] The following will be based on Figure 1 the described scenario, by Figures 2-6 the cross-border fund flow risk assessment method according to the embodiments of the application is described in detail.

[0032] Figure 2 The flowchart of the cross-border fund flow risk assessment method according to the embodiments of the application is schematically shown.

[0033] As Figure 2 shown, the cross-border fund flow risk assessment method of this embodiment includes operations S210-S260, and the transaction processing method can be executed by a server or a terminal device.

[0034] In operation S210, a standardized event stream representing the state of cross-border fund flow is acquired.

[0035] According to the embodiments of the application, the standardized events in the standardized event stream at least carry a timestamp, a payment account identifier, a payee account identifier and a transfer amount, and the standardized events are used to represent a single fund flow relationship.

[0036] In an example, the system deploys a multi-path data listener to continuously receive four types of raw data from SWIFT international messages, domestic core bank account transaction logs, foreign correspondent bank logs, and international sanctions list updates. For each raw record, the system first identifies its data source channel, then calls the field mapping configuration table corresponding to the channel to perform position rearrangement, currency symbol unification, and amount precision normalization on the original fields, while converting the timestamp to UTC (Coordinated Universal Time, UTC) standard millisecond format. When the system detects that the transaction type is "multilateral settlement" or "batch payment instruction", it automatically disassembles the collective payment into multiple single-pen fund flow records with minimum granularity, ensuring that the original total amount is completely conserved during disassembly, and each disassembled amount does not exceed the upper limit set by the system. For each fund flow, the system extracts the clearing bank code, payer account identifier, and source sequence number, and generates a globally unique event number through a hash algorithm, which is used for subsequent repeated data filtering and time sequence sorting in all processing links. The system queries the customer information database in real time to obtain the account type, registered region, industry risk level, and number of historical risk events in the past year of the payer and the payee, and attaches these static attributes to the event record. At the same time, the account information in the event is quickly hashed and compared with the sanctions list and political public figure database. If a match is found, the account is marked as high-risk, and a compliance tag group is formed by adding the currency code and transaction channel identifier. After all events are sorted in ascending order of timestamp, they are routed to different partitions of the message middleware message queue according to the hash value of the payer account identifier, ensuring that events for the same account always enter a fixed partition and maintain a strict time sequence relationship, and finally forming a standardized, de-duplicated, and ordered event stream.

[0037] In operation S220, for the standardized events within the time window, the payment account identifier and the time window sequence number are taken as nodes, the fund flow relationship is taken as an initial edge, the regional risk weight corresponding to the payment account is embedded in the node, and the currency conversion relationship is embedded in the initial edge, to construct an incremental graph structure representing the fund link flow characteristics.

[0038] According to an embodiment of the present application, the time window represents a time length in inverse proportion to the number of standardized events in the standardized event stream within a preset period.

[0039] In one example, the stream processing engine continuously reads events from the message middleware partition, and maintains a sequence of time intervals of the most recently arrived events. The system adopts an exponential smoothing mechanism to dynamically calculate the length of the next time window by integrating the historical time window length and the average interval of the current event arrival. The window length is inversely proportional to the event density: when the transaction flow surges, the window is automatically shortened to the order of seconds to prevent the number of nodes in the graph from exploding; when the flow is sparse, the window is extended to the order of minutes to avoid the graph structure from breaking. The system creates an empty account index table in memory for the current time window. For each fund flow event falling within the window, the system uses the combination of the payer account identifier and the time window sequence number as a composite key to find or create the source node, and uses the payee account identifier and the time window sequence number to find or create the target node. This mechanism ensures that the same account corresponds to only one node in the same time window, effectively controlling the growth of the graph size. A directed edge is established between the source node and the target node to record the transfer amount and update the in-degree and out-degree counts of the two nodes in real time. When the source node and the target node involve different currencies, the system records the currency conversion information in the edge attribute, marked as a cross-currency jump. At the same time, the system queries the pre-configured judicial domain risk coefficient table according to the registered region of the payer account, obtains the risk weight value of the region and writes it into the node attribute, and the weight value of a high-risk region is significantly higher than that of a low-risk region. All nodes, edges and their attributes are stored as an incremental graph structure, and the system maintains a weighted adjacency matrix, where the weight of the edge is determined by adjusting the transfer amount by a cross-currency amplification factor, providing optimization support for subsequent fast subgraph scanning.

[0040] In operation S230, in the incremental graph structure, the node fission strength of the initial edge in the current time window is calculated, and a three-hop breadth-first search is performed on the nodes whose node fission strength exceeds a first preset threshold value as fission starting points to obtain a search result.

[0041] According to an embodiment of the present application, the search result is used to screen a target path meeting a transaction residence time constraint and a regional risk condition constraint from the incremental graph structure.

[0042] In one example, at the end of each time window, the system only extracts the newly added edge set within the window to avoid repeated scanning of the full graph. For each payee node, the system calculates the average transfer amount to all payee nodes within the current window and compares it with the average amount of the previous window. When the average amount decreases by more than a preset threshold, it is determined that the node has a significant fund splitting behavior, and it is marked as a fission starting point and added to the monitoring set. Starting from each fission starting point, the system performs a breadth-first search with a depth limit of three layers to explore possible fund transfer paths. During the search process, the system continuously accumulates the amount sequence and currency sequence of each transaction on the path, and calculates the change of the jurisdiction risk weight between adjacent nodes, only retaining the path with a monotonically increasing or unchanged risk weight. The system also checks the time interval between adjacent transactions and eliminates paths that do not meet the characteristics of abnormal fund flow behavior due to short or long residence time. All paths that meet the three constraints of fission intensity, jurisdictional increase, and residence time are considered target paths, and the target paths are combined to form a candidate subgraph, which records the starting timestamp and batch identification of the trigger monitoring as input units for subsequent in-depth analysis.

[0043] In operation S240, the transaction sequence and regional feature sequence represented by the candidate subgraph determined based on the target path are subjected to double-channel gated convolution processing to obtain a subgraph embedding vector.

[0044] According to an embodiment of the present application, the subgraph embedding vector is used to represent the fund convergence trajectory feature and the cross-region risk distribution feature.

[0045] In one example, for all transaction records within a candidate subgraph, the system first reorders them in chronological order. Considering the time gaps caused by the account period differences in cross-currency transactions, the system inserts placeholders at positions where the adjacent transaction intervals exceed the minimum time resolution, constructing an equidistant dense time series. The system traverses the series to identify currency switching nodes, marking the switching nodes and their adjacent nodes before and after as exchange segments, and setting special labels in the node attributes. The first processing channel performs gated convolution operations on the transaction amount sequence, with the gating mechanism dynamically adjusting the weights of the convolution kernel according to the hidden state at the previous time and the current amount value, strengthening the feature extraction of the convergence trajectory of funds to the merging end. The second processing channel performs gated convolution on the judicial domain risk weight sequence, using the cross-currency information in the edge and the regional risk weight in the node as the gating signal to highlight patterns of cross-border capital reflux or cycling jumps in the same high-risk area. The feature tensors output by the two channels are sent to the self-consistent fusion layer together with the static attribute matrix of the nodes (including KYC level, industry category, etc.). The layer uses trainable temperature coefficients and weight matrices to fuse the three information elements at the level, and applies constraints to ensure the semantic consistency of the amount channel and the judicial domain channel. Finally, a fixed-dimensional subgraph embedding vector is generated, which condenses the amount dynamic features and regional risk distribution features of the capital link.

[0046] In operation S250, the subgraph embedding vector is concatenated with the predicted remaining merging time, node fission intensity, and cross-region jump number to form a state vector, which is input into a game reinforcement learning model to output the freezing probability of the candidate subgraph, and the risk assessment result of the standardization event is determined according to the freezing probability.

[0047] In one example, the subgraph embedding vector is written into a millisecond-level ring queue, and three real-time calculated scalars are merged to build a state vector: the predicted remaining merging time (estimated according to historical statistics), the current fission intensity value, and the cumulative cross-judicial domain jump number. The system also obtains the real-time risk exposure balance of all accounts on the link and the complaint frequency of customers in the past 30 days as supplementary information. After the state vector is converted into a discrete state index through hash mapping, it is input into the game reinforcement learning model. The model uses a temperature-adaptive Q-learning algorithm, and in the training phase, it learns the state-action value function using confirmed historical cases as samples. The model outputs the probability distribution of the "observe", "label", and "freeze" actions, with the freeze probability being the core decision basis. The reward function of the model considers three factors: the positive income from the recovered amount after successful freezing, the economic loss and reputation risk caused by mistakenly harming compliant customers, and the risk reduction brought by blocking the evolving risk link in advance. The temperature parameter is dynamically decayed according to the predicted remaining time and the link hierarchy depth, reducing the exploration probability and increasing the decision certainty in the later stage of capital chain evolution.

[0048] By constructing an adaptive time window mechanism dynamically proportional to the standardized event flow density, the technical defects of node explosive growth or link sparse fracture easily caused by traditional fixed window in high concurrency transaction scenarios are significantly solved, and the millisecond-level incremental capture of the evolution process of cross-border fund splitting and merging chain is realized. The dynamic graph structure constructed by account-time binary key, embedding regional risk weight in nodes and currency conversion relationship in edges, enables the graph topology to simultaneously carry the triple semantic information of fund flow direction, regional risk gradient and cross-currency arbitrage characteristics, providing a high-resolution structured representation basis for subsequent risk identification. Through the mechanism of three-hop breadth-first search triggered by fission intensity threshold, the fund splitting starting point is accurately located and the search depth is automatically truncated, which greatly reduces the real-time computing load on the premise of ensuring the recall rate of suspicious links. The dual-channel gated convolution architecture breaks through the parallel processing of transaction amount sequence and geographical feature sequence, dynamically enhances the fund trajectory converging to the merging end and the jump mode across high-risk areas through the gating mechanism, and improves the feature discrimination. The state space constructed by fusing subgraph embedding vectors with remaining merging duration, fission intensity and cross-jurisdiction hop number is input into the game reinforcement learning model, and through the temperature adaptive Q learning mechanism, the frozen strategy is dynamically optimized online, so that the system can output accurate freezing probability in the early stage before the fund chain is finally merged, and the risk interception response time is compressed from the traditional T+1 batch mode to seconds.

[0049] The specific processing process of the standardized event is expanded on operation 210, and operation S210 specifically includes operation S211 to operation S219.

[0050] In operation S211, the initial data of cross-border payment messages, domestic account logs, overseas account logs and compliance risk lists is obtained. In operation S212, for each initial data, the field mapping relationship table and the time zone offset are determined according to the channel identifier. In operation S213, the first element of the standardized event is generated based on the field mapping relationship table and the time zone offset.

[0051] In one example, SWIFTMQ, domestic account logs, overseas account logs and sanction list CSV are real-time monitored as four input channels. For any original record , the field mapping matrix and the time zone correction amount are selected according to the channel identifier , and the unified conversion formula (1) is executed:

[0052] (1)

[0053] Among them, is a standardized JSON field vector, the first element has been converted into a UTC millisecond timestamp, a channel native business field vector, a zero vector for dimension matching. Matrix At the same time, the field position rearrangement, currency symbol unification and amount precision normalization are completed to eliminate heterogeneous message differences from the source.

[0054] In operation S214, in response to the specified instruction, the corresponding transaction data is disassembled according to the payee list to generate a minimum fund flow set.

[0055] In one example, when the instruction type tag is "multi-lateral settlement" or "batch instruction", the collective payment is disassembled into a minimum fund flow. Assuming that the payee list , the original total amount is . By looping through , the minimum fund flow set is generated as shown in equation (2):

[0056] (2)

[0057] In equation (2), is the payer internal account ID, is the payee internal account ID, is the single amount after splitting, is the system configured upper limit of the single amount. It ensures the amount conservation and each only describes a one-way fund movement, providing accurate granularity for the graph model.

[0058] In operation S215, a unique event identifier is generated for each minimum fund flow according to the clearing bank identifier, the payer account identifier and the source sequence number. In operation S216, idempotent filtering is performed according to the unique event identifier to eliminate duplicate events.

[0059] In one example, for each , first query the payer, payee and currency in the internal mapping table to obtain and . Then, concatenate the clearing bank ID ( ), the payer ID and the source sequence number to form a string, and calculate the event number using SHA-256. The unique primary key serves as a reference for idempotent filtering and graph time sequence sorting.

[0060] In operation S217, the account type, registration country, high-risk industry identifier, and risk event count within a preset time period are obtained based on the payment account identifier and written into the static attribute field of the standardized event. In operation S218, the standardized event is hash-compared with the compliance risk list. If they match, the account risk is marked and a compliance tag group is formed by attaching a currency identifier and transaction channel number. In operation S219, the standardized events are sorted in ascending order by timestamp and routed to a preset message queue partition based on the account identifier hash value to construct a standardized event stream.

[0061] In one example, according to and The system retrieves the KYC data warehouse and writes back the customer type, country of registration, high-risk industry code, and risk event count for the past year. These fields are stored together with the native business fields. The extended field ensures that compliance labels and risk calculation placeholders are complete. This section describes the extended... The sanctions list is compared with the PEP database hash. If either match is found, the account's risk level is immediately adjusted. Set to 1, and add the city type ID and transaction channel number. Attributes are used to form compliance label groups. These label groups, as static features of graph vertices, provide supervisory signals for amplifying convolutions on high-risk paths. Based on event numbers... Perform idempotent filtering; for the same account, all events that pass the filter are... Write to account queue in ascending order The sorting strategy ensures the temporal consistency of edge connections in subsequent graph construction, avoiding cross-city accounting period misalignment caused by out-of-order processing. Finally, an account hash is calculated for each sorted event. Write to the corresponding message middleware partition The Schema version number is synchronously written to the event header. Build a low-latency, horizontally scalable standard event stream.

[0062] By unifying the conversion between field mapping matrix and time zone correction, millisecond-level standardization of heterogeneous messages is achieved, significantly reducing data access latency. The minimum fund flow decomposition and SHA-256 event number generation mechanism ensure the atomicity and idempotency of graph edges in batch payment scenarios, completely eliminating the problem of redundant calculations. The real-time injection of KYC information and compliance tags enables the alignment of static attributes and dynamic transaction behaviors in the graph modeling stage, avoiding repeated calls to external systems during subsequent model inference and greatly improving overall inference efficiency.

[0063] Operation S220 includes operations S221 to S226. The incremental graph structure construction process is introduced in conjunction with operations S221 to S226.

[0064] In operation S221, the arrival time sequence of the standardized events in the time window is obtained, the weighted average value of the adjacent event interval is calculated by using the exponential smoothing algorithm, and the next time window is dynamically adjusted.

[0065] In one example, the recent UTC arrival time of the event is continuously read , the adjacent message interval is calculated, and the first time slice length is obtained by using exponential smoothing See formula (3):

[0066] (3)

[0067] wherein, is a smoothing coefficient, is the length of the previous time slice. The window is dynamically adjusted in real time through traffic feedback to avoid node sparseness or expansion caused by a fixed window. Then, a blank account index table is newly created in the memory , providing a search entry for subsequent node mounting.

[0068] In operation S222, for each standardized event, the source node is searched according to the payment account identifier and the time window sequence as a binary key, and the target node is searched according to the payment account identifier and the time window sequence. If it is not hit, a corresponding node is newly created in the graph cache.

[0069] In one example, for the arrival time of each event located in the current time slice , the target node is searched in according to the account ID + time slice binary key; if it is not hit, a node is newly created in the graph cache , wherein represents an account, represents a time slice sequence number. The strategy ensures that the same account in the same time slice corresponds to only a single node, which controls the graph granularity and suppresses the explosion of the number of nodes.

[0070] In operation S223, a directed edge is generated between the source node and the target node according to the fund flow relationship, the transfer amount is recorded, and the in-degree and out-degree of the two nodes are updated.

[0071] In one example, for the fund flow , the source node and the target node are queried in the graph cache, the directed edge is written according to the actual flow direction, and the absolute value of the amount is recorded. After the edge is generated, the in-degree and out-degree of the node are immediately updated, providing connectivity basis for subsequent three-hop tracking.

[0072] In operation S224, when the currency identifiers of the source node and the target node are different, a cross-currency jump vector is written in the edge attribute.

[0073] In one example, when a cross-currency jump vector is written in the edge attribute . The vector is used as a convolution kernel shared weight in the graph convolution stage to produce explicit feature amplification for the cross-currency split-merge segment.

[0074] In operation S225, the regional risk weight is extracted from the regional risk weight table according to the registered country of the payment account and written in the node attribute. In operation S226, the incremental graph structure is constructed based on the source node, the target node, the edge attribute, and the node information.

[0075] In one example, the regional risk weight table is accessed through the registered country field of the account, and the regional risk weight (judicial domain risk weight) coefficient is extracted and written in the node additional dimension to realize the injection of geopolitical sensitivity. Unlike the traditional undifferentiated node weight, the weight will directly affect the risk gradient of the subsequent local subgraph. After the above operations are completed, the time T, the account U, the amount A, and the risk W are written into the distributed graph storage to form an incremental graph . At the same time, the weighted adjacency matrix is constructed as shown in equation (4):

[0076] (4)

[0077] wherein, is the fund amount of the node to the node in the time slice , is an indicator function, is a cross-currency amplification factor. The matrix is released together with the graph handle to provide a high-resolution snapshot for incremental scanning.

[0078] Through the dynamic window adjustment mechanism driven by the exponential smoothing algorithm, the time slice length can be automatically scaled with the fluctuation of transaction flow. In the business peak period, the window is compressed to the second level to capture high-frequency fission, and in the trough period, it is expanded to the minute level to reduce calculation redundancy and improve overall CPU utilization. Through the joint design of embedding the cross-currency jump vector in the edge attribute and the judicial domain risk weight in the node attribute, the graph structure unified modeling of heterogeneous financial data is realized, thereby reducing the information loss in the data preprocessing stage.

[0079] Figure 3 A flowchart of a three-hop breadth-first search method based on fission starting point is shown schematically according to an embodiment of the application.

[0080] According to the embodiment of the application, the three-hop breadth-first search method based on the fission starting point specifically comprises: marking a node with a fission intensity exceeding a first preset threshold as a fission starting point, and performing a breadth-first search with a depth limit of three layers from the fission starting point. In the search process, a sum of forward difference values of regional risk weights of adjacent nodes in a search path is calculated as a regional risk gradient cumulative value, and a transaction residence duration of an adjacent transaction node is calculated. A path with the regional risk gradient cumulative value equal to zero and the transaction residence duration in a preset interval is taken as a target path.

[0081] As shown in Figure 3 , only the newly added directed edge set is read at the end of the time slice , forming a to-be-inspected edge pool, avoiding introducing real-time delay by traversing the historical full graph. Each edge carries an amount , a currency type vector , and a jurisdiction weight . For all outgoing edges of a homologous node , the previous time slice average amount and the current average amount are calculated, and the fission intensity is calculated based on the following formula (5):

[0082] (5)

[0083] In the formula, is a zero-prevention constant. When , the node is marked as a fission starting point and written into a set .

[0084] Three-hop tracking, i.e., performing a breadth-first search from each fission starting point with a depth limit of three layers, obtains a path . The system synchronously accumulates an amount sequence and a currency type sequence during expansion, reserving continuous features for subsequent cross-currency type convolution. For any path with a radius less than or equal to 3, the regional risk gradient cumulative value (jurisdiction-increasing default amount) is calculated according to formula (6):

[0085] (6)

[0086] In the formula, is the jurisdiction domain risk coefficient of the node . When , it is determined that the path jurisdiction risk is monotonically non-decreasing, which meets the cross-high-risk jurisdiction circulation feature; otherwise, the path is discarded. ​​​​​

[0087] In one example, the adjacent transaction residence duration set is calculated for the reserved path . Only when the typical abnormal fund flow residence upper and lower thresholds configured by the system, the path enters the next link to eliminate both transient jumps and long-term deposits. All paths that meet the fission strength, judicial increment and residence duration constraints are combined to form an independent subgraph , and the trigger timestamp is written at the head of the subgraph . If multiple paths share a node, node merging is performed to ensure subgraph connectivity and information integrity. Finally, is written into the candidate pool and the current scanning batch label is attached . The candidate pool exposes the subgraph handle to the outside, providing a linkable and reusable data entry for heterogeneous convolutional networks and policy makers, and realizing early and accurate risk interception of cross-border fund splitting-merging chains.

[0088] By limiting the dual constraints of regional risk gradient accumulation value and transaction residence duration in the three-hop search process, accurate pattern matching of typical risk fund transfer patterns (such as “divergent transfer-in and convergent transfer-out”) is realized, improving search recall rate; The zero value judgment condition of the regional risk gradient accumulation value effectively filters out cross-border transfer paths with monotonically increasing risks, eliminating invalid search branches and improving the efficiency of candidate subgraph generation.

[0089] Operation S240 includes operations S241-S245. The subgraph embedding vector generation process is introduced in combination with operations S241-S245.

[0090] In operation S241, the transaction records in the candidate subgraph are sorted by time, and a resampling time series is constructed based on a fixed granularity null placeholder. In operation S242, the nodes are traversed along the resampling time series, the currency switching nodes in the transaction records are identified, and the exchange segment feature vector is constructed based on the currency switching nodes.

[0091] In one example, all transaction records in the candidate subgraph are reordered in ascending order of occurrence time , and then a fixed granularity null placeholder is introduced for adjacent intervals to construct a resampling time series , where is a null placeholder label, is the minimum time resolution set by the system, is the maximum transaction interval of the subgraph. By inserting null placeholders at the gaps, the time misalignment caused by cross-currency account period differences is eliminated, providing a dense and ordered index space for subsequent convolution kernels.

[0092] along the resampling sequence traverse the nodes, locate the currency switching nodes at the positions where currency switching nodes appear . Then push back one hop and stretch forward two hops, mark the window as the exchange segment, and write the label in the node attribute . Ensure that the subsequent shared convolution weights can accurately identify potential arbitrage splitting chains. Attach the currency type label to the exchange segment node, write the jurisdiction transition label at all cross-jurisdiction edges, and complete the spatiotemporal heterogeneous graph definition. The node type now contains (account-time-currency), and the edge type contains (funds-jurisdiction transition).

[0093] In operation S243, the first channel performs a gated convolution along the transaction sequence. The gating function receives the convolution output state of the previous time step and the current amount, dynamically updates the convolution weights, and outputs a sequence feature tensor.

[0094] In one example, the first channel performs a gated amount convolution along the transaction sequence. The gating function receives the hidden state of the previous layer and the current amount , dynamically updates the weights, and explicitly amplifies the convergence trajectory of the funds to the merged end. After convolution, a sequence feature tensor is output.

[0095] In operation S244, the second channel performs a gated convolution along the geographical feature sequence, using the cross-currency jump vector in the edge and the regional risk weight as the gating signal. The exchange segment feature vector is processed by gated convolution to output a geographical feature tensor. In operation S245, the sequence feature tensor, the geographical feature tensor, and the static node attribute matrix are tensor fused in a self-consistent fusion layer to generate a subgraph embedding vector.

[0096] In one example, the second channel performs an isomorphic gated convolution along the jurisdiction sequence, using the edge label jurisdiction transition as the weight gate to strengthen the representation strength of cross-border reflux or same-domain loop jump points, and obtains a geographical feature tensor . The system sends and the static node attribute matrix to the self-consistent fusion layer, constructs the following formula (7) using a trainable coefficient matrix and a temperature coefficient :

[0097] (7)

[0098] where is the output subgraph embedding, is the element-level hyperbolic tangent activation, ​corresponding to the amount, geography and static channel weight matrix respectively, Control fusion temperature. From a consistent layer through joint regularization term constraint Ensure semantic consistency of two channels, and the final output Directly called by the decision maker, it realizes the accurate identification and strategy feedback of the cross-border fund splitting-merging chain.

[0099] Through the dual-channel gated convolution and subgraph embedding architecture of the embodiment of the present application, the high-fidelity extraction and semantic consistent fusion of the cross-currency and cross-jurisdiction fund flow features are realized. The first channel dynamically strengthens the amount trajectory converging to the merging end through the gating mechanism, effectively capturing the extremely subtle gradient changes in the fund splitting and hierarchical process; the second channel uses the jurisdiction transition label as the gating signal, significantly amplifying the representation strength of high-risk patterns such as cross-border reflux and same-domain circulation. The self-consistent fusion layer is constrained by a trainable temperature coefficient and channel weight, ensuring that the amount dynamic features and regional risk features are conflict-free fused in the multi-dimensional tensor space, and the generated subgraph embedding vector not only compactly represents the overall evolution of the fund chain, but also retains the fine-grained discrimination information required for decision freezing, providing a state basis with both temporal and spatial resolution and risk discrimination for subsequent game reinforcement learning.

[0100] Figure 4 The game reinforcement learning model optimization flowchart according to an embodiment of the present application is schematically shown.

[0101] According to the embodiment of the present application, the game reinforcement learning model takes observation, labeling, and freezing as the action space, takes interception net income as the reward, dynamically updates the policy network through temperature decay Q learning, and outputs the freezing probability.

[0102] As Figure 4 shown, the timestamp sequence is read in ascending order to obtain a high-resolution subgraph embedding , and written into a millisecond-level ring queue . The queue node is attached with three runtime scalars: the predicted remaining window of the merger; the current fission intensity ; and the cumulative cross-jurisdiction jump count . The three scalars are directly involved in the risk reward characterization later, ensuring that the decision rhythm and chain evolution phase are real-time bound. When dequeue, the system pulls the following in one time: the exposure vector of the associated account set ; the near-thirty-day complaint frequency vector of the same set; and the real-time structural features of the link. The split ratio is ; the hierarchical depth is ; and the early merger coefficient is .

[0103] Final observation vector Mapped to discrete state index , where hash function Based on high-dimensional locality-sensitive coding, homomorphic equivalence and irreversibility are guaranteed. A database of closed case trajectories is used. Generate prior knowledge of the opponent's strategy. For each record of the trajectory... Transformed into a dynamic risk score before the merger is completed Distribution of fission-stratification-merging residence time Bayesian smoothing on the initial value table Inject virtual counters to ensure that templates for high-incidence abnormal fund flows are covered during the cold start of online gambling.

[0104] Reward characterization, that is, for each real-time action The system calculates synchronously: (1) the amount recovered. (2) Losses due to accidental injury (3) Evolutionary blocking contribution ,in This is a dynamic risk score.

[0105] Therefore, the scenario-coupled linear differential reward is adopted as follows (8):

[0106] (8)

[0107] in, Given by the risk preference matrix.

[0108] Based on the above formula (8), the potential risk of prematurely blocking the split-merge chain that has not yet been completed is reduced. Direct quantification, taking into account both recourse and collateral damage.

[0109] Observe the new state after performing the action. Combined with instant rewards With fission remaining window For the temperature adaptive Q update, please refer to the following formula (9):

[0110] (9)

[0111] in, Update the formula for Q value. The state is represented at time step t. Take action Expected returns For learning rate, As the discount factor, This is the initial temperature. The formula for calculating the policy probability represents the probability in the state. Take action The probability of taking action. The temperature parameter controls the smoothness of the probability distribution. This formula uses the softmax function to convert Q values into a probability distribution, and the temperature parameter Adjusts the sharpness of the distribution. Lower temperature values make the distribution more sharp, i.e. the agent is more inclined to choose actions with high Q values; higher temperature values make the distribution more smooth, increasing the diversity of exploration. The link has been coupled with the remaining merging window by a depth decay function: when the chain evolves into the middle and later stages , the strategy is automatically reduced, and the policy is more deterministic. After updating, write the high-yield low-loss path nodes to the frozen priority list to ensure that the next round of decisions take effect immediately. Read the frozen probability in the policy distribution. According to the value of the fund in the unmerged stage , the threshold value of the merging critical stage , execute segmented decision: : freeze immediately; : mark high risk; otherwise, continue to observe. The threshold group is adjusted by the regulatory department on a quarterly basis to ensure that the model output is synchronized with the compliance risk tolerance.

[0112] Closed-loop write-back, asynchronous reception of three types of external feedback: judicial confirmation of successful recovery amount ; judicial veto of compensation for mistaken injury ; customer arbitration success rate . After the feedback is mapped to the transaction by the link event hash, the reward is recalculated and corrected , triggering batch offline retraining of S55; at the same time, dynamically adjust , achieve continuous self-adaptation to the regulatory environment and customer experience, and ultimately strengthen the accuracy and robustness of the dynamic risk score of the splitting-merging chain that is still evolving.

[0113] The following embodiments describe how to dynamically schedule computing resources according to the risk level of the candidate subgraph to achieve efficient assessment and processing of cross-border capital flow risks.

[0114] According to the embodiments of the present application, the risk level of the candidate subgraph is determined according to the frozen probability, the second preset threshold and the third preset threshold; and the computing resources are dynamically scheduled based on the risk level.

[0115] ​According to an embodiment of the present application, the dynamic scheduling of the computing resource based on the risk level comprises: assigning the candidate sub-graph to a corresponding processing queue according to the risk level, the processing queue being pre-mapped to a corresponding resource configuration parameter based on the risk level, the resource configuration parameter comprising a time window length, a network structure depth, and a number of GPU cores; and periodically counting a historical risk hit number and a resource consumption ratio of the processing queue, and dynamically adjusting a GPU quota allocation weight of the processing queue in a next processing period based on the ratio.

[0116] In one example, after receiving the output action probability distribution, the target sub-graph is immediately read frozen probability To take differentiated computing power strategies for split-merge chains before the funds have completed the final consolidation, this sub-step adopts a double threshold and

[0117] The risk is divided into three levels: high, medium, and low.

[0118] The specific bucketing rule is given by equation (10):

[0119] (10)

[0120] wherein, wherein is an indicator function. When it represents a high-risk link and needs to be deeply analyzed in the shortest time; is medium risk, maintaining a regular analysis rhythm; is low risk, performing lazy analysis.

[0121] The system then writes the index triplets at the head of the priority queue, providing an ordered pointer for subsequent scheduling. The scheduling manager calls the configuration bin function to complete the mapping of gears to computing power and algorithm parameters. represents the number of layers of the heterogeneous consistent network, is an incremental edge extraction time window, is the number of allocated GPU cores. The high-risk gear corresponds to a larger and a smaller to amplify fine-grained clues early in the split-merge process; the low-risk gear uses the minimum GPU quota and the default network depth to save computing power budget. The mapping result is persisted to the running metadata area with sub-graph meta information, ensuring that the subsequent execution phase can be directly read and avoiding parameter drift. The scheduler maintains three independent parallel channels: an acceleration channel serving sub-graphs, a regular channel serving subgraphs of the graph, inert channels service subgraphs of the graph. Guaranteed within a fixed computational power limit high-risk splitting-pooling chains are always in a computing acceleration state before merging, while low-risk links are subject to delays and downgrades to avoid unnecessary resource occupation. For example: high-risk subgraph: time window length of 5 seconds, network structure depth of 5 layers, allocation of 4 GPU cores. Medium-risk subgraph: time window length of 10 seconds, network structure depth of 3 layers, allocation of 2 GPU cores. Low-risk subgraph: time window length of 60 seconds, network structure depth of 1 layer, allocation of 1 GPU core.

[0122] The system assigns candidate subgraphs to corresponding processing queues according to risk levels. Each processing queue is pre-configured with corresponding resource parameters according to its risk level. For example, the high-risk queue is configured with a shorter time window and a deeper network structure to achieve fast response and in-depth analysis of high-risk fund flows. When processing queues execute tasks, they periodically count their historical risk hits and resource consumption ratios. The system dynamically adjusts the GPU quota allocation weights of each processing queue in the next processing period based on these statistical data. For example, if a processing queue shows a high risk hit number and a low resource consumption ratio in the current period, the system will increase the GPU quota of this queue in the next period to further improve its processing capacity. Specifically, for high-risk subgraphs, the time window is immediately contracted to to capture the latest fission transfer with finer granularity; the network depth is increased to and all attention routing and gating mechanisms are activated to increase the perception ability of rare cross-domain transitions. Analysis amplification triggers gradient accumulation and explicit residual channel at the same time, ensuring that high-risk links can generate higher resolution dynamic risk scores and security feature identifiers before merging. For low-risk subgraphs, the default time window is restored, skipping high-frequency edge sampling of the early splitting-layering stage; the first layer of amount convolution and static feature fusion is retained, and the remaining deep convolution and attention routing are logically shielded. The number of GPU cores is limited to a single card range, further combining gradient early stopping and batch merging strategies to reduce computation time while still ensuring necessary dynamic monitoring.

[0123] After completing each round of computation window, the system collects three-channel hit rate (the number of high-risk chains confirmed by the judiciary) and corresponding GPU seconds Channel yield density is defined as , is a regularization constant. Based on this the GPU quota vector of the next window is dynamically updated The relative size of the yield density automatically amplifies the resource proportion of the efficient channel and compresses the computing power of the inefficient channel, and the result is written into the configuration bin and takes effect in the next round of mapping and scheduling process. Ensure that the computing power is tilted to the split-merge chain that has not been merged but is high-risk in real time.

[0124] In one example, in the actual operation summary, the system first calculates the freezing probability of each candidate subgraph and determines its risk level according to the preset threshold. Then, the system assigns the subgraph to the corresponding processing queue and starts the corresponding risk assessment process according to the resource configuration parameters of the queue. For example, for high-risk subgraphs, the system will immediately allocate 4 GPU cores and start a network structure with a depth of 5 layers for rapid analysis with a time window of 5 seconds. For medium-risk and low-risk subgraphs, the system will allocate fewer GPU cores and shallower network structures, respectively, to achieve risk assessment with lower resource consumption. At the end of each processing cycle, the system will collect statistical data of each processing queue, including the number of risk hits and the resource consumption ratio. Based on these data, the system dynamically adjusts the GPU quota allocation weight of each queue to optimize resource utilization efficiency.

[0125] Through the risk level-based computing power resource dynamic scheduling mechanism, the system can flexibly adjust resource allocation according to the actual risk situation of capital flow, realizing rapid response to high-risk capital flow and resource saving for low-risk capital flow. This mechanism not only improves the accuracy and real-time performance of risk assessment, but also optimizes the utilization efficiency of computing power resources and reduces operating costs. In addition, the mechanism of dynamically adjusting the GPU quota allocation weight enables the system to adaptively respond to changes in risk assessment tasks, further improving the flexibility and scalability of the system.

[0126] The method for determining the risk assessment result of the standardized event according to the freezing probability is introduced in combination with the following operations S310~operations S360.

[0127] In operation S310, the sub-graphs are synchronized from the parallel processing queue, and the sub-graphs are spliced in sequence according to the time stamp and the fund flow direction to obtain a target fund link. In operation S320, the amount weight of each transaction edge in the target fund link is calculated, and the amount weight includes a cross-region jump penalty, a currency conversion penalty, and a hierarchical depth penalty. In operation S330, the freezing probability of each transaction edge is weighted and averaged based on the amount weight to obtain an initial risk score of the target fund link. In operation S340, the historical freezing hit rate is called to calculate a temperature parameter, and the initial risk score is calibrated to generate a risk assessment value through a probabilistic function with the historical risk score mean as the offset center and the temperature parameter as the scaling scale. In operation S350, a target decision action is determined according to the risk assessment value, a fourth preset threshold, and a fifth preset threshold, and the transaction edge with the highest contribution degree is selected as a main contribution transaction and is pushed to the monitoring end with an additional reason code. In operation S360, the reward parameter and the threshold are updated according to the risk confirmation result.

[0128] In one example, the latest sub-graphs are synchronized from the three parallel channels described above . The scheduler first sorts the trigger time stamps in ascending order, and then splices the sub-graphs of the same split-hierarchical-merged chain in sequence according to the fund flow direction key to form a continuous link flow . The splicing process ensures that the fragmented information in different channels is complete in the chain level dimension, laying a consistent time sequence semantics for risk accumulation. For each chain , the system traverses the transaction edge set , extracts the single amount , the corresponding freezing probability , the cross-jurisdiction index , the cross-city index , and the hierarchical depth proportion .

[0129] To reflect the amplification risk of cross-domain and cross-city jumps on unmerged funds, the amount weight

[0130]

[0131] , wherein is a penalty coefficient.

[0132] The link-level original risk score is calculated by the following formula , which maps the single freezing probability through the amount and structure penalty to the chain scale through weighted average, realizing the overall perceptibility of the risk before merging. The system calls the real freezing hit rate in the past month to calculate the temperature , wherein is a scale factor, is a regular constant. The average of all chain raw scores in the same month is denoted as The calibration function adopts temperature scaling Sigmoid: The risk value is compressed to the interval [0, 1] to align the high segment with the actual hit rate, and the accuracy of threshold triggering is improved.

[0133] Set three threshold values (fourth preset threshold value and fifth preset threshold value) If , the action is "frozen", if , the action is "marked as high risk", otherwise, "continue to observe". When the adjacent nodes in the chain have been frozen, the action of the chain is automatically raised by one level to prevent residual funds from bypassing. In the chain , the top three transactions are selected as the main contribution edges in descending order of one-sided contribution , and four types of reason identification, including amount surge code, cross-jurisdiction jump code, cross-city type jump code and hierarchical depth code, are attached respectively. The reason code and contribution value are output, supporting the rapid positioning of key transfers by audit. The link ID, calibrated risk score , recommended action, three main contribution transactions and reason code are packaged in a unified JSON format; the message is pushed to the monitoring large screen in real time through WebSocket, and is written into the case management system at the same time, triggering manual or automatic intervention process. After the disposal result of the compliance department and the judicial receipt arrive, the system writes back the hit identification and the amount of recovery according to the link ID; the hit rate , penalty coefficient and threshold value are updated accordingly. A continuous iterative closed loop is formed to further improve the accuracy and stability of risk judgment in the unmerged stage.

[0134] Based on the above cross-border capital flow risk assessment method, the application also provides a cross-border capital flow risk assessment device. The device will be described in detail below. Figure 5

[0135] Figure 5 The structure block diagram of the cross-border capital flow risk assessment device according to the embodiment of the application is schematically shown. As Figure 5 shown, the cross-border capital flow risk assessment device 900 of this embodiment includes an acquisition module 910, an incremental graph construction module 920, a search module 930, a feature extraction module 940 and a risk assessment module 950.

[0136] The acquisition module 910 is configured to acquire a standardized event stream representing the state of cross-border capital flow, wherein each standardized event in the standardized event stream carries at least a timestamp, a payment account identifier, a receiving account identifier and a transfer amount, and the standardized event is used to represent a single capital flow relationship. In an embodiment, the acquisition module 910 can be configured to perform the operation S210 described above, and details are not repeated here.​

[0137] The incremental graph construction module 920 is used to construct an incremental graph structure representing the flow characteristics of funds links for standardized events within a time window. This structure uses the payment account identifier and time window number as nodes, the fund flow relationship as initial edges, and embeds the regional risk weight corresponding to the payment account into the nodes and the currency conversion relationship into the initial edges. The duration represented by the time window is inversely proportional to the number of standardized events in the standardized event flow within a preset time period. In one embodiment, the incremental graph construction module 920 can be used to execute the operation S220 described above, which will not be repeated here.

[0138] The search module 930 is used to calculate the node fission intensity of the initial edge in the current time window in the incremental graph structure, and to perform a three-hop breadth-first search on the nodes whose fission intensity exceeds a first preset threshold as the fission starting point to obtain the search results. The search results are used to filter target paths from the incremental graph structure that meet the constraints of transaction dwell time and regional risk conditions. In one embodiment, the search module 930 can be used to perform the operation S230 described above, which will not be repeated here.

[0139] The feature extraction module 940 performs dual-channel gated convolution processing on the transaction sequence and regional feature sequence represented by the candidate subgraph determined based on the target path to obtain a subgraph embedding vector. The subgraph embedding vector is used to represent the capital convergence trajectory features and cross-regional risk distribution features. In one embodiment, the feature extraction module 940 can be used to perform the operation S240 described above, which will not be repeated here.

[0140] The risk assessment module 950 is used to concatenate the subgraph embedding vector with the predicted remaining time, node fission intensity, and cross-regional hop count to form a state vector, input it into the game-theoretic reinforcement learning model, and output the freezing probability of the candidate subgraph. Based on the freezing probability, the risk assessment result of the standardized event is determined. In one embodiment, the risk assessment module 950 can be used to perform the operation S250 described above, which will not be repeated here.

[0141] According to an embodiment of the present application, any of the modules of the obtaining module 910, the incremental graph construction module 920, the searching module 930, the feature extraction module 940 and the risk assessment module 950 can be combined in one module, or any of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of the modules can be combined with at least part of the functions of other modules, and implemented in one module. According to an embodiment of the present application, at least one of the obtaining module 910, the incremental graph construction module 920, the searching module 930, the feature extraction module 940 and the risk assessment module 950 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on board, a system on package, an application specific integrated circuit (ASIC), or any other reasonable manner of integrating or packaging a circuit, etc. in hardware or firmware, or implemented in any one of software, hardware and firmware or in a proper combination of any of them. Alternatively, at least one of the obtaining module 910, the incremental graph construction module 920, the searching module 930, the feature extraction module 940 and the risk assessment module 950 can be at least partially implemented as a computer program module which, when executed, can perform the corresponding functions.

[0142] Figure 6 According to an embodiment of the present application, a block diagram of an electronic device suitable for implementing the cross-border fund flow risk assessment method is schematically shown. As shown in Figure 6 The electronic device 1000 according to an embodiment of the present application includes a processor 1001 which can perform various appropriate actions and processes according to programs stored in a read only memory (ROM) 1002 or loaded from a storage portion 1008 into a random access memory (RAM) 1003. The processor 1001 can include, for example, a general purpose microprocessor (e.g. a CPU), an instruction set processor and / or a related chipset and / or a special purpose microprocessor (e.g. an application specific integrated circuit (ASIC)), etc. The processor 1001 can also include an on-board memory for cache use. The processor 1001 can include a single processing unit or multiple processing units for performing different actions of the method processes according to embodiments of the present application.

[0143] In the RAM 1003, various programs and data required by the electronic device 1000 to operate are stored. The processor 1001, the ROM 1002, and the RAM 1003 are connected to each other via the bus 1004. The processor 1001 performs various operations according to the method flow provided by the embodiments of the present application by executing the programs in the ROM 1002 and / or the RAM 1003. It should be noted that the programs can also be stored in one or more memories other than the ROM 1002 and the RAM 1003. The processor 1001 can also perform various operations according to the method flow provided by the embodiments of the present application by executing the programs stored in the one or more memories.

[0144] According to the embodiments of the present application, the electronic device 1000 can further include an input / output (I / O) interface 1005, which is also connected to the bus 1004. The electronic device 1000 can further include one or more of the following components connected to the input / output (I / O) interface 1005: an input part 1006 including a keyboard, a mouse, etc.; an output part 1007 including a display such as a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage part 1008 including a hard disk, etc.; and a communication part 1009 including a network interface card such as a LAN card, a modem, etc. The communication part 1009 performs communication processing via a network such as the Internet. A drive 1010 is also connected to the input / output (I / O) interface 1005 as necessary. A removable medium 1011 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 1010 as necessary, so that a computer program read out therefrom is installed in the storage part 1008 as necessary.

[0145] The present application also provides a computer readable storage medium, which can be included in the device / apparatus / system described in the above embodiments; or can exist separately without being assembled into the device / apparatus / system. The above computer readable storage medium carries one or more programs, which when executed, implement the method according to the embodiments of the present application.

[0146] The embodiments of the present application also include a computer program product, which includes a computer program containing program codes for executing the method shown in the flow chart. When the computer program product is run in a computer system, the program codes are used to make the computer system implement the cross-border fund flow risk assessment method provided by the embodiments of the present application.

[0147] In such embodiments, the computer program can be downloaded and installed from the network through the communication part 1009, and / or installed from the detachable medium 1011. When the computer program is executed by the processor 1001, the above-described functions defined in the system of the embodiments of the present application are performed. According to the embodiments of the present application, the system, device, apparatus, module, unit, and the like described above can be implemented by the computer program modules.

[0148] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowcharts or block diagrams can represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may be executed in the reverse order, depending on the functionality involved. It will also be noted that each block of the block diagrams or flowcharts, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0149] Those skilled in the art can understand that the features described in various embodiments of the present application can be combined and / or integrated in various combinations, even if such combinations are not explicitly described in the present application. In particular, the features described in various embodiments of the present application can be combined and / or integrated in various combinations without departing from the spirit and teachings of the present application. All such combinations and / or integrations fall within the scope of the present application.

Claims

1. A method for assessing the risk of cross-border capital flows, characterized in that, include: Obtain a standardized event stream that represents the status of cross-border fund flows, wherein the standardized events in the standardized event stream carry at least a timestamp, a payment account identifier, a receiving account identifier, and a transfer amount, and the standardized events are used to represent a single fund flow relationship; For standardized events within a time window, the payment account identifier and time window number are used as nodes, the fund flow relationship is used as the initial edge, and the regional risk weight corresponding to the payment account is embedded in the node. The currency conversion relationship is embedded in the initial edge to construct an incremental graph structure to characterize the flow characteristics of the fund link. The duration of the time window is inversely proportional to the number of standardized events in the standardized event flow within the preset time period. In the incremental graph structure, the node fission intensity is calculated for the initial edge in the current time window. Nodes whose fission intensity exceeds a first preset threshold are used as fission starting points to perform a three-hop breadth-first search to obtain search results. The search results are used to filter target paths that meet the transaction dwell time constraint and regional risk condition constraint from the incremental graph structure. The transaction sequence and regional feature sequence represented by the candidate subgraph determined based on the target path are subjected to dual-channel gated convolution processing to obtain the subgraph embedding vector. The subgraph embedding vector is used to represent the capital convergence trajectory features and cross-regional risk distribution features. as well as The subgraph embedding vector is concatenated with the predicted remaining time, node fission intensity, and cross-regional hop count to form a state vector, which is then input into a game-theoretic reinforcement learning model to output the freezing probability of the candidate subgraph. The risk assessment result of the standardized event is then determined based on the freezing probability.

2. The method according to claim 1, characterized in that, The game-theoretic reinforcement learning model uses observation, labeling, and freezing as its action space, and interception net gain as its reward. It dynamically updates the policy network through temperature decay Q-learning and outputs the freezing probability.

3. The method according to claim 1, characterized in that, The node whose fission intensity exceeds a first preset threshold is used as the fission starting point to perform a three-hop breadth-first search, and the search results are as follows: Nodes whose fission intensity exceeds a first preset threshold are marked as fission starting points, and a breadth-first search with a depth limited to three layers is performed starting from the fission starting points. During the search process, the sum of the positive differences in the regional risk weights of adjacent nodes in the search path is calculated as the cumulative value of the regional risk gradient, and the transaction dwell time of adjacent transaction nodes is also calculated; and The path whose regional risk gradient cumulative value is equal to zero and whose transaction dwell time is within a preset range is taken as the target path.

4. The method according to claim 1, characterized in that, The process of performing dual-channel gated convolution on the transaction sequence and regional feature sequence represented by the candidate subgraph determined based on the target path to obtain the subgraph embedding vector includes: The transaction records within the candidate subgraph are sorted by time, and a resampled time series is constructed based on fixed-granularity window placeholders. Traverse the nodes along the resampled time series, identify currency switching nodes in the transaction records, and construct exchange segment feature vectors based on the currency switching nodes; The first channel performs gated convolution along the transaction sequence. The gate function receives the convolution output state from the previous time step and the current amount, and dynamically updates the convolution weights to output the sequence feature tensor. The second channel performs gated convolution along the regional feature sequence, using the cross-currency jump amount and regional risk weight in the edge as the gate signal to perform gated convolution processing on the feature vector of the exchange segment, so as to output the geographical feature tensor. The sequence feature tensor, the geographic feature tensor, and the static node attribute matrix are fused in a self-consistent fusion layer to generate a subgraph embedding vector.

5. The method according to claim 1, characterized in that, The construction of the incremental graph structure used to characterize the flow characteristics of the capital chain includes: Obtain the arrival time series of standardized events within the time window, calculate the weighted average of the intervals between adjacent events using an exponential smoothing algorithm, and dynamically adjust the next time window; For each standardized event, the source node is retrieved using the payment account identifier and time window number as the binary key, and the target node is retrieved using the receiving account identifier and time window number. If no match is found, the corresponding node is created in the graph cache. Based on the fund flow relationship, a directed edge is generated between the source node and the target node, the transfer amount is recorded, and the in-degree and out-degree of the two nodes are updated. When the source node and the target node have different currency identifiers, write a cross-currency jump statement in the edge attribute; Based on the country of registration of the payment account, query the regional risk coefficient table, extract the regional risk weight, and write it into the node attribute; and An incremental graph structure is constructed based on the source node, the target node, the edge attributes, and the node information.

6. The method according to claim 1, characterized in that, The standardized event flow representing the state of cross-border capital flows includes: Obtain initial data from cross-border payment messages, domestic transaction logs, overseas transaction logs, and compliance risk lists; For each initial data entry, determine the field mapping table and time zone offset based on the channel identifier; Based on the field mapping table and the time zone offset, generate a standardized event whose first element is a standardized timestamp; In response to a specified instruction, the corresponding transaction data is broken down into the minimum cash flow set based on the list of payees; A unique event identifier is generated for each minimum cash flow based on the clearing bank identifier, payment account identifier, and source sequence number; Perform idempotent filtering based on the unique event identifier to remove duplicate events; Based on the payment account identifier, obtain the account type, country of registration, high-risk industry identifier, and risk event count within a preset time period, and write them into the static attribute field of the standardized event; The standardized events are compared with the compliance risk list using hash. If they match, the account risk is marked and a compliance tag group is formed by adding a currency identifier and a transaction channel number. After arranging the standardized events in ascending order of timestamps, they are routed to preset message queue partitions based on account identifier hash values ​​to construct a standardized event stream.

7. The method according to claim 1, characterized in that, The method further includes: The risk level of the candidate subgraph is determined based on the freezing probability, the second preset threshold, and the third preset threshold; and Computing resources are dynamically allocated based on the aforementioned risk level.

8. The method according to claim 7, characterized in that, The dynamic scheduling of computing resources based on the risk level includes: The candidate subgraphs are assigned to corresponding processing queues based on the risk level. Each processing queue is pre-mapped with corresponding resource configuration parameters based on the risk level. These resource configuration parameters include time window length, network structure depth, and the number of graphics processor cores. The historical risk hit count and resource consumption ratio of the processing queue are periodically calculated, and the graphics processor quota allocation weight of the processing queue in the next processing cycle is dynamically adjusted based on the ratio.

9. The method according to claim 1, characterized in that, The risk assessment result for determining the standardized event based on the freezing probability includes: Subgraphs are synchronously captured from the parallel processing queue and sequentially pieced together according to timestamps and fund flows to obtain the target fund flow path; Calculate the amount weight for each transaction edge in the target funding chain. The amount weight includes cross-regional jump penalty, currency conversion penalty, and layering depth penalty. The initial risk score of the target funding link is obtained by weighting the freezing probability of each transaction side based on the amount weight. The temperature parameter is calculated by retrieving the historical freeze hit rate. The initial risk score is calibrated by a probabilistic function that uses the historical risk score mean as the offset center and the temperature parameter as the scaling scale to generate a risk assessment value. The target decision action is determined based on the risk assessment value, the fourth preset threshold, and the fifth preset threshold, and the transaction side with the highest contribution is selected as the main contributing transaction with an attached reason code and pushed to the monitoring end; and Update reward parameters and thresholds based on risk assessment results.

10. A cross-border capital flow risk assessment device, characterized in that, The device includes: The acquisition module is used to acquire a standardized event stream that represents the status of cross-border fund flows. The standardized events in the standardized event stream carry at least a timestamp, a payment account identifier, a receiving account identifier, and a transfer amount. The standardized events are used to represent a single fund flow relationship. The incremental graph construction module is used to construct an incremental graph structure to characterize the flow characteristics of funds links for standardized events within a time window, using the payment account identifier and time window number as nodes, the fund flow relationship as the initial edge, embedding the regional risk weight corresponding to the payment account in the node, and embedding the currency conversion relationship in the initial edge. The duration of the time window is inversely proportional to the number of standardized events in the standardized event flow within the preset time period. The search module is used to calculate the node fission intensity of the initial edge in the current time window in the incremental graph structure, and to perform a three-hop breadth-first search on the node whose node fission intensity exceeds a first preset threshold as the fission starting point to obtain the search results. The search results are used to filter target paths that meet the transaction dwell time constraints and regional risk conditions from the incremental graph structure. The feature extraction module performs dual-channel gated convolution processing on the transaction sequence and regional feature sequence represented by the candidate subgraphs determined based on the target path to obtain a subgraph embedding vector. This subgraph embedding vector is used to represent the characteristics of the capital convergence trajectory and the cross-regional risk distribution. The risk assessment module is used to concatenate the subgraph embedding vector with the predicted remaining time, node fission intensity, and cross-regional hop count to form a state vector, input it into the game reinforcement learning model, output the freezing probability of the candidate subgraph, and determine the risk assessment result of the standardized event based on the freezing probability.

11. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, It includes a computer program or instructions, characterized in that, when the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 9.

Images