Abnormal behavior recognition method and device, equipment, medium and program product

Abstract

The invention provides an abnormal behavior recognition method which can be applied to the technical field of artificial intelligence. The method comprises the following steps: under the condition of user authorization, acquiring account data of a user, taking an account of the user as a node and transaction data as an edge to construct a graph structure relationship, learning structural features of the graph structure relationship by using a graph neural network, and outputting a first abnormal probability score; analyzing the deviation degree of the time sequence feature, the geographic feature and the amount feature of the transaction data relative to the group general reference, and outputting a second abnormal probability score; comparing the transaction data of the user with a dynamic baseline formed based on historical transaction data of the user, and outputting a third abnormal probability score; and performing comprehensive judgment based on the first abnormal probability score, the second abnormal probability score and the third abnormal probability score, and identifying an abnormal transaction behavior of the user. The invention further provides an abnormal behavior recognition device and equipment, a storage medium and a program product.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of artificial intelligence, in particular to an abnormal behavior recognition method, device, equipment, medium and program product. BACKGROUND

[0002] In recent years, with the rapid development of big data, artificial intelligence and deep learning technology, anti-money laundering monitoring methods based on deep learning have gradually become the research focus. Such methods use multi-layer neural networks to model massive transaction data, which can automatically mine complex nonlinear patterns and hidden features in the data, thus showing strong potential in fraud detection and risk management tasks. However, existing deep learning solutions still face many challenges in practical applications: first, most models use offline batch processing, which makes it difficult to achieve real-time monitoring and response to transaction behavior; second, model training is highly dependent on large amounts of high-quality labeled data, and the generalization ability is limited in scenarios where new money laundering behavior samples are scarce or data labeling costs are high; finally, when dealing with money laundering behaviors with strong spatio-temporal correlation, complex capital flow and multi-entity interaction, traditional deep learning methods still have deficiencies in relationship modeling and dynamic pattern capturing.

[0003] In order to overcome the lag and high false alarm problem of traditional rule-based methods, and further improve the performance of deep learning in real-time and complex multi-dimensional data analysis, it is necessary to develop new anti-money laundering technologies that integrate real-time data processing, spatio-temporal feature modeling and complex relationship mining. SUMMARY

[0004] In view of the above problems, the present disclosure provides an abnormal behavior recognition method, device, equipment, medium and program product for improving recognition efficiency.

[0005] A first aspect of the present disclosure provides an abnormal behavior recognition method, the method comprising: obtaining account data of a user under authorization of the user, the account data comprising account basic information and transaction data; constructing a graph structure relationship by taking the user's account as a node and the transaction data as an edge, learning the structural features of the graph structure relationship using a graph neural network, and outputting a first abnormal probability score representing account structural abnormalities; analyzing the deviation of the transaction data from the general baseline in terms of time sequence features, geographical features and amount features, and outputting a second abnormal probability score representing user behavior deviation from the general pattern; comparing the transaction data of the user with a dynamic baseline formed based on the user's own historical transaction data, and outputting a third abnormal probability score representing individual behavior mutation of the user; and comprehensively judging based on the first abnormal probability score, the second abnormal probability score and the third abnormal probability score to identify abnormal transaction behavior of the user.

[0006] In this embodiment of the disclosure, the step of constructing a graph structure relationship by treating user accounts as nodes and transaction data as edges, and using a graph neural network to learn the structural features of the graph structure relationship to output a first anomaly probability score representing structural anomalies of accounts includes: constructing the graph structure relationship by treating multiple accounts related to the user's account as nodes and transaction data between accounts as edges; iteratively aggregating the feature information of each account node and its neighboring nodes in the graph structure relationship through multi-layer graph convolution operations to generate a node embedding vector that incorporates the local network context; and inputting the node embedding vector representing the user's account into a classifier to calculate the first anomaly probability score.

[0007] In this embodiment of the disclosure, the step of analyzing the deviation of the temporal, geographical, and monetary features of the transaction data from a general benchmark for the group, and outputting a second anomaly probability score representing the deviation of user behavior from a general pattern, includes: extracting the temporal, geographical, and monetary features of the transaction data to form a multidimensional feature vector; calculating the deviation distance between the multidimensional feature vector and the general benchmark feature vector, wherein the general benchmark feature vector is generated based on historical transaction data of a normal user group; and mapping the deviation distance to a probability value as the second anomaly probability score.

[0008] In this embodiment of the disclosure, comparing the user's transaction data with a dynamic baseline formed based on the user's own historical transaction data and outputting a third anomaly probability score characterizing a sudden change in the user's individual behavior includes: periodically calculating a dynamic baseline of the user's behavioral characteristics using a sliding time window based on the user's historical transaction data, wherein the behavioral characteristics include at least a moving average of transaction frequency, a moving percentile of transaction amount, and a probability distribution of transaction time; extracting the actual behavioral characteristics corresponding to the dynamic baseline based on the transaction data; calculating the instantaneous deviation between the real-time behavioral characteristics and the personalized dynamic baseline, wherein the deviation reflects the magnitude and speed of change in the user's current behavior relative to their personal historical habits; and using the instantaneous deviation as the third anomaly probability score.

[0009] In this embodiment of the disclosure, the dynamic baseline for periodically statistically analyzing the user's behavioral characteristics based on the user's historical transaction data in a sliding time window manner includes: periodically extracting behavioral feature sequences from the user's historical transaction data in a sliding time window manner; statistically modeling the behavioral feature sequences within each sliding window to generate baseline feature values ​​for that time period; and fusing the newly generated baseline feature values ​​with historical baseline feature values ​​to update the personalized dynamic baseline.

[0010] In this embodiment of the disclosure, the step of identifying the user's abnormal transaction behavior by comprehensively judging based on the first abnormal probability score, the second abnormal probability score, and the third abnormal probability score includes: weighting and fusing the first abnormal probability score, the second abnormal probability score, and the third abnormal probability score to generate a comprehensive probability of abnormal behavior; and determining that the user has abnormal transaction behavior when the comprehensive probability of abnormal behavior is greater than a preset threshold.

[0011] A second aspect of this disclosure provides an abnormal behavior identification device, comprising: a data acquisition module for acquiring user account data, including basic account information and transaction data, with user authorization; a structural anomaly identification module for constructing a graph structure relationship by treating the user's account as nodes and transaction data as edges, learning the structural features of the graph structure relationship using a graph neural network, and outputting a first anomaly probability score characterizing structural anomalies in the account; a general pattern analysis module for analyzing the degree of deviation of the temporal, geographical, and monetary features of the transaction data from a general benchmark for the group, and outputting a second anomaly probability score characterizing deviations of user behavior from a general pattern; an individual behavior analysis module for comparing the user's transaction data with a dynamic baseline formed based on the user's own historical transaction data, and outputting a third anomaly probability score characterizing a sudden change in the user's individual behavior; and a score fusion module for making a comprehensive judgment based on the first anomaly probability score, the second anomaly probability score, and the third anomaly probability score to identify the user's abnormal transaction behavior.

[0012] A third aspect of this disclosure provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of the first aspects.

[0013] A fourth aspect of this disclosure provides a computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, when the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of the first aspects.

[0014] A fifth aspect of this disclosure provides a computer program product including a computer program or instructions, characterized in that, when the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of the first aspects. Attached Figure Description

[0015] The foregoing contents, as well as other objects, features, and advantages of this disclosure, will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0016] Figure 1 This diagram illustrates an application scenario of the abnormal behavior identification method and apparatus according to embodiments of the present disclosure.

[0017] Figure 2 A flowchart illustrating an abnormal behavior identification method according to an embodiment of the present disclosure is shown schematically.

[0018] Figure 3 A schematic diagram illustrating the structure of an abnormal behavior recognition device according to an embodiment of the present disclosure is shown; and

[0019] Figure 4 A block diagram of an electronic device suitable for implementing an abnormal behavior recognition method according to an embodiment of the present disclosure is shown schematically. Detailed Implementation

[0020] The embodiments of the present disclosure will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the disclosure. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of the present disclosure for ease of explanation. However, it will be apparent that one or more embodiments may be practiced without these specific details. Furthermore, descriptions of well-known structures and techniques are omitted in the following description to avoid unnecessarily obscuring the concepts of the present disclosure.

[0021] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit this disclosure. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0022] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0023] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0024] It should be noted that the abnormal behavior identification method and device provided in this disclosure can be used in scenarios of detecting abnormal user behavior in the financial field, and can also be used in any field other than the financial field to identify abnormal user behavior. The application field of the abnormal behavior identification method and device in this disclosure is not limited.

[0025] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0026] In the technical solution disclosed herein, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, and necessary measures have been taken to ensure that they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse.

[0027] Embodiments of this disclosure provide an abnormal behavior identification method, which includes: acquiring user account data, including basic account information and transaction data, with user authorization; constructing a graph structure relationship by treating the user's account as nodes and transaction data as edges, learning the structural features of the graph structure relationship using a graph neural network, and outputting a first anomaly probability score representing structural anomalies in the account; analyzing the deviation of the temporal, geographical, and monetary features of the transaction data from a general benchmark for the group, and outputting a second anomaly probability score representing deviations of user behavior from a general pattern; comparing the user's transaction data with a dynamic baseline formed based on the user's own historical transaction data, and outputting a third anomaly probability score representing a sudden change in the user's individual behavior; and making a comprehensive judgment based on the first, second, and third anomaly probability scores to identify the user's abnormal transaction behavior.

[0028] Figure 1 The illustration shows an application scenario of the abnormal behavior recognition method and apparatus according to embodiments of the present disclosure.

[0029] like Figure 1As shown, the application scenario 100 according to this embodiment may include applications such as anti-money laundering in banks. Network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. Network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0030] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0031] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0032] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0033] It should be noted that the abnormal behavior identification method provided in this embodiment can generally be executed by server 105. Correspondingly, the abnormal behavior identification device provided in this embodiment can generally be located in server 105. The abnormal behavior identification method provided in this embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the abnormal behavior identification device provided in this embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0034] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0035] The following will be based on Figure 1 The described scene, through Figure 2 The abnormal behavior identification method of the disclosed embodiments is described in detail.

[0036] Figure 2 A flowchart illustrating an abnormal behavior identification method according to an embodiment of the present disclosure is shown schematically.

[0037] like Figure 2 As shown, the abnormal behavior identification method of this embodiment includes operations S210 to S250, and the transaction processing method can be executed sequentially.

[0038] When operating S210, with user authorization, the user's account data is obtained, including basic account information and transaction data.

[0039] In embodiments of this disclosure, user consent or authorization may be obtained before acquiring user information. For example, a request to acquire user information may be sent to the user before operation S210. If the user consents or authorizes the acquisition of user information, operation S210 is performed.

[0040] In this embodiment, provided that compliance with relevant laws and regulations is ensured and explicit authorization from the user is obtained, the system retrieves the account data of the user to be monitored from the database of the financial institution or related data sources. This data forms the basis for subsequent analysis of abnormal behaviors such as anti-money laundering. Basic account information is used to construct a basic profile and static relationships of the user, mainly including customer identification (such as customer number, ID card number), account type (such as savings account, corporate account, credit card account), account opening date, account status (such as normal, frozen, closed, etc.), occupation, industry, permanent address, contact information, and other customers associated with the account (such as joint account holders, actual controllers of corporate accounts, beneficial owners, etc.). Transaction data is the core of analyzing fund flows and behavioral patterns, recording the dynamic activities of the account, mainly including transaction serial number, transaction timestamp, transaction amount and currency, transaction type (such as deposit, withdrawal, transfer, remittance, consumer payment, currency exchange, etc.), counterparty information (including counterparty's name, account number, affiliated financial institution, etc.), transaction location / channel, and transaction remarks / summary, etc.

[0041] After obtaining the above data, in order to ensure that the data meets the input requirements of the subsequent deep learning model, the data is first preprocessed by data cleaning, missing value imputation, outlier detection, data normalization, feature extraction and encoding.

[0042] In the embodiments of this disclosure, before further processing of the data, a corresponding operation entry can be provided to the user, allowing the user to choose to agree to or reject the automated decision-making result. That is, before performing operations S220-S250 on the user information, the user's instruction to agree to or reject processing / decision-making can be obtained through the corresponding operation entry. If the user agrees to processing / decision-making, operations S220-S250 are performed on the user information. If the user refuses to process / decision-making, the expert decision-making process is initiated.

[0043] In operation S220, user accounts are treated as nodes and transaction data as edges to construct a graph structure relationship. The graph neural network is used to learn the structural features of the graph structure relationship and output the first anomaly probability score that represents the structural anomaly of the account.

[0044] Each user's account is defined as a node. The initial characteristics of a node can embed basic account information (such as account type and duration) or derived statistical characteristics (such as total historical transaction amount). Any fund transfer between accounts (such as transfers or remittances) is defined as an edge. The characteristics of an edge can include data from one or more transactions, such as total transaction amount, transaction frequency, and time distribution. The direction of the edge represents the direction of fund flow.

[0045] Graph neural networks operate through a mechanism called "message passing" or "neighborhood aggregation." In this mechanism, each node (account) receives information from its directly connected neighbor nodes through the edges (transactions) it connects to.

[0046] This process involves multiple iterations, allowing each node to eventually acquire topological information about its multi-hop neighbors (e.g., friends of friends, and even more distant relationships). In this way, GNNs can learn the local and global structural context of each node in the network, thereby capturing complex patterns that are difficult to detect using traditional methods. This leads to a first anomaly probability score for identifying abnormalities in the current user account.

[0047] In operation S230, the time-series characteristics, geographical characteristics, and monetary characteristics of transaction data are analyzed to determine the degree of deviation from the general benchmark of the group, and a second anomaly probability score representing the deviation of user behavior from the general pattern is output.

[0048] Time-series characteristics reflect the distribution pattern of user transactions over time, including transaction frequency, regularity of transaction time (such as the ratio of transactions during working hours to those during non-working hours), and stability of transaction intervals. Compared to the group benchmark, anomalies in time-series characteristics may manifest as sudden and drastic changes in transaction frequency (such as a sudden shift from low-frequency to high-frequency transactions), large transactions occurring at atypical times (such as late at night), or irregular, machine-like bursts of transactions.

[0049] Geographic features reflect the reasonableness of the geographical location or IP address where the transaction occurred. This includes the stability of frequently used locations and the reasonableness of the physical distance between different transaction locations. Compared to the group benchmark, geographic anomalies may manifest as transactions with extremely large and illogical geographical spans occurring within a very short period of time (e.g., POS transactions occurring in country A and country B within one hour), or frequent transaction activities that are completely unrelated to the customer's registered location or place of residence.

[0050] Amount characteristics reflect the distribution pattern of transaction amounts, including the size of individual transactions, cumulative amounts, dispersion of transaction amounts, and the degree of matching with counterparty transaction amounts (such as salary income, the normal range of daily consumption). Anomalies in amount characteristics relative to the group benchmark may manifest as transaction amounts significantly higher or lower than the normal levels of their respective customer segments (e.g., a student account suddenly showing fund flows comparable to those of a corporate client), transaction amounts deliberately avoiding reporting thresholds (e.g., structured transactions), or fund inflows and outflows that are severely inconsistent with the user's background.

[0051] In this embodiment, the "general benchmark" is not a fixed threshold, but a dynamic, fine-grained statistical model. It is constructed by learning from the historical behavior of all users through machine learning models (such as clustering algorithms). The benchmark categorizes users into different "similar groups" based on their basic attributes (such as occupation, age, and asset size) and behavioral patterns. The behavior of the target user is compared with the typical behavioral patterns of its most similar "similar group" to ensure the fairness and accuracy of the assessment. The feature vectors of the target user in the three dimensions of time series, geography, and amount are compared with the benchmark feature vectors of its corresponding similar group to obtain a second anomaly probability score that quantifies the degree of deviation.

[0052] In operation S240, the user's transaction data is compared with a dynamic baseline formed based on the user's own historical transaction data, and a third anomaly probability score is output to characterize the sudden change in the user's individual behavior.

[0053] A dynamic baseline is a model of "normal behavior" that automatically adjusts over time based on the latest user behavior data. The baseline is updated periodically to reflect the user's latest behavioral habits. A sudden change in individual user behavior refers to a statistically significant deviation between the user's current behavioral pattern and the normal pattern described by the dynamic baseline. This deviation is quantified to obtain a third anomaly probability score.

[0054] When operating the S250, a comprehensive judgment is made based on the first abnormal probability score, the second abnormal probability score, and the third abnormal probability score to identify the user's abnormal transaction behavior.

[0055] In this embodiment, a multi-dimensional, three-dimensional risk control system, ranging from "broad-area screening" to "individual insight," is constructed by calculating a first anomaly probability score, a second anomaly probability score, and a third anomaly probability score. The first anomaly probability score is the result of a rapid initial screening based on the global structure; the second anomaly probability score is obtained by horizontally comparing users with their respective groups, effectively identifying new or group-based fraud patterns; and the third anomaly probability score accurately identifies individual behavioral mutations and account theft risks by vertically comparing users with their own history. Ultimately, integrating these three scores enables information complementarity and cross-validation, thereby capturing complex and ever-changing risks with extremely high accuracy while significantly reducing false positives for legitimate users, achieving an optimal balance between security and user experience.

[0056] According to the method provided in this disclosure, a comprehensive and high-precision intelligent anti-money laundering monitoring system is constructed by introducing graph neural networks and a spatiotemporal three-dimensional dynamic modeling mechanism. Specifically, the graph neural network is used to mine the complex topological structure between multiple accounts, accurately detecting cross-account and cross-border organized money laundering activities that are difficult to detect using traditional methods. By integrating temporal and spatial constraints, the real-time perception and prediction accuracy of fund flow trajectories are improved, enhancing sensitivity to temporal anomaly patterns. The graph neural network reveals a static relational network, while the spatiotemporal model captures dynamic fund behavior; the two work together to achieve multi-level monitoring from micro-accounts to the global network, significantly reducing false positives and false negatives. This model has continuous learning and optimization capabilities, can cope with constantly evolving money laundering methods, and ensures the long-term effectiveness of the system.

[0057] In some embodiments, operation S220 includes S221 to S223.

[0058] In operation S221, multiple accounts associated with the user's account are treated as nodes, and transaction data between accounts are treated as edges to construct a graph structure.

[0059] The graph structure transforms discrete account and transaction data into a structured graph model, where accounts are nodes and transaction relationships are edges, thus visually representing the flow network of funds.

[0060] In operation S222, feature information of each account node and its neighboring nodes in the graph structure relationship is iteratively aggregated through multi-layer graph convolution operations to generate node embedding vectors that incorporate the local network context.

[0061] Core information aggregation is achieved through multi-layer graph convolutions. Each convolutional layer allows an account node to obtain information from its direct neighbors. As the number of layers increases, nodes can receive information from multi-hop neighbors, thereby generating a powerful feature representation (i.e., node embedding vector) that incorporates information from its local network structure context. This allows the model to see not only an account itself, but also information related to it.

[0062] In operation S223, the node embedding vector representing the user's account is input into the classifier to calculate the first anomaly probability score.

[0063] Anomaly scoring is achieved by generating and utilizing node embedding vectors through a graph neural network, specifically as follows: First, the node embedding vectors corresponding to the target user account, rich in its local network context, are input into a pre-trained classifier (e.g., a multilayer perceptron MLP). The pre-trained classifier quantifies the anomaly probability of the node embedding vectors. Based on decision boundaries learned from historically known anomalous accounts and their associated networks, the classifier performs deep analysis and nonlinear transformation on the input node embedding vectors, ultimately outputting a quantitative score representing the degree of structural anomaly of the account in the graph structure relationship, i.e., the first anomaly probability score.

[0064] In some embodiments, operation S230 includes S231 to S233.

[0065] In operation S231, the time-series features, geographical features, and monetary features of the transaction data are extracted to form a multi-dimensional feature vector.

[0066] In this embodiment, time-series features may include transaction frequency, transaction time entropy, and the proportion of nighttime transactions. Geographical features include transaction geographic dispersion and cross-border transaction indicators. Amount features include transaction amount and the proportion of large transactions. These features are standardized and concatenated in a predetermined order to obtain a multi-dimensional feature vector for subsequent processing.

[0067] In operation S232, the deviation distance between the multidimensional feature vector and the general benchmark feature vector is calculated. The general benchmark feature vector is generated based on the historical transaction data of the normal user group.

[0068] In this embodiment, a massive amount of verified historical transaction data from normal users is collected. A principal component analysis (PCA) model is used to train the multidimensional feature vectors of these normal users. After training, the feature vectors of the PCA model and the mean and covariance matrix of the training set are retained. The multidimensional feature vectors of the target user are input into the trained PCA model and projected onto the principal component space. In the principal component space, the Mahalanobis distance between the projected vector and the baseline distribution center (mean vector) is calculated. This distance is the "deviation distance," which considers the correlation between features and can more accurately measure the degree to which the target user's behavior deviates from the overall behavior of the normal group.

[0069] In operation S233, the deviation distance is mapped to a probability value, which serves as the second anomaly probability score.

[0070] In this embodiment of the disclosure, it is assumed that the deviation distance of normal user behavior follows a specific distribution, such as a chi-square distribution or an empirical distribution fitted from historical data. If the deviation distance is assumed to follow a chi-square distribution, the second anomaly probability score can be obtained by calculating the complement of its cumulative distribution function. This probability value directly reflects the rarity of observing the current or larger deviation distance under the assumption of "normal user behavior". Finally, this probability value is output as the second anomaly probability score.

[0071] In some embodiments, operation S240 includes S241 to S243.

[0072] In operation S241, based on the user's historical transaction data, the dynamic baseline of the user's behavioral characteristics is periodically calculated in the form of a sliding time window. The behavioral characteristics include at least the moving average of transaction frequency, the moving percentile of transaction amount, and the probability distribution of transaction time.

[0073] In some embodiments, behavioral feature sequences are periodically extracted from the user's historical transaction data using a sliding time window approach; statistical modeling is performed on the behavioral feature sequences within each sliding window to generate baseline feature values ​​for that time period; and the newly generated baseline feature values ​​are fused with historical baseline feature values ​​to update the personalized dynamic baseline.

[0074] In this embodiment, an overlapping sliding window mechanism is used to periodically collect user behavior characteristics. Specifically, a window sequence is slid forward each time, with a period of 24 hours. Each window contains transaction data for 30 consecutive days. For each sampling period, the system extracts the behavior feature sequence of the most recent N overlapping windows (e.g., 7 windows), including the daily moving average sequence of transaction frequency, the P50 / P90 / P99 percentile sequence of transaction amount, and the transaction probability distribution sequence for each time period.

[0075] Statistical modeling is performed on the sequences of each feature dimension: an outlier filtering algorithm based on Gaussian distribution is used to remove outlier windows that deviate from the mean by more than 2 standard deviations; a weighted average is calculated on the filtered feature sequences, and the window weights are positively correlated with their time freshness; the denoised candidate baseline feature values ​​are output.

[0076] Historical baselines are fused using an adaptive weighting strategy: New baseline = λ × candidate value + (1-λ) × old baseline. The smoothing factor λ is dynamically adjusted: when the difference between the candidate value and the old baseline exceeds a threshold, a larger λ (e.g., 0.3) is used to accelerate adaptation; when the difference is small, a smaller λ (e.g., 0.1) is used to maintain stability. A maximum change limit is also set to prevent excessive drift in a single update.

[0077] In operation S242, based on transaction data, implementation behavior features corresponding to the dynamic baseline are extracted.

[0078] In operation S243, the instantaneous deviation between real-time behavioral characteristics and personalized dynamic baseline is calculated. The deviation reflects the magnitude and speed of change of the user's current behavior relative to personal historical habits.

[0079] In operation S244, the instantaneous deviation is used as the third anomaly probability score.

[0080] In this embodiment, the system establishes an independent dynamic baseline profile for each user. Specifically, a 30-day sliding time window is used to automatically update baseline data daily. The system calculates the exponentially weighted moving average of daily transaction counts to obtain the transaction frequency baseline. Three key percentiles of the transaction amount distribution are recorded: P50 reflects normal transaction levels, P90 identifies large transaction thresholds, and P99 captures extreme transaction behavior. These three key percentages constitute the transaction amount baseline. The 24-hour period is divided into four time slots (0-6 AM, 6-12 AM, 12-6 PM, and 6-12 AM), and the transaction probability distribution for each time slot is statistically analyzed to obtain the transaction time baseline. User transaction behavior is monitored in real-time, and features corresponding to the baseline are extracted, including real-time transaction frequency, transaction amount, and transaction time distribution. Frequency deviation can be obtained by calculating relative error, amount deviation by calculating the maximum relative rate of change of the three percentiles, and time distribution deviation by using Jensen-Shannon divergence to quantify distribution differences. A comprehensive instantaneous deviation is obtained by combining these three deviations. The instantaneous deviation is mapped to a probability score to obtain a third anomaly probability score.

[0081] In some embodiments, operation S250 includes operations S251-252.

[0082] In operation S251, the first abnormal probability score, the second abnormal probability score, and the third abnormal probability score are weighted and fused to generate a comprehensive probability of abnormal behavior.

[0083] In this embodiment, score fusion can be achieved through linear weighted fusion, nonlinear weighted fusion, and fusion based on machine learning models; the weights of each anomaly probability score can be determined based on financial risk control knowledge, user profiles, scenario profiles, or machine learning. Many options are available, and no specific method is limited here.

[0084] In operation S252, if the overall probability of abnormal behavior is greater than a preset threshold, it is determined that the user has engaged in abnormal transaction behavior.

[0085] In one embodiment of this disclosure, a multi-level threshold judgment mechanism can be designed, such as a three-level threshold judgment mechanism. When the overall probability of abnormal behavior is > 0.7, it is judged as a low-risk abnormality, and the system records the abnormality log and continuously monitors it; when the overall probability of abnormal behavior is > 0.85, it is judged as a medium-risk abnormality, triggering an enhanced verification process and requiring the user to perform secondary identity authentication; when the overall probability of abnormal behavior is > 0.95, it is judged as a high-risk abnormality, and the system automatically intercepts the current transaction and temporarily freezes the account, while immediately pushing an alarm to the risk control manual review queue.

[0086] In another embodiment of this disclosure, a dynamic threshold adjustment strategy can be employed. The preset threshold is not a fixed value. The preset threshold can be adaptively adjusted according to time periods; for example, during the nighttime trading hours of 22:00-06:00, thresholds at all levels are automatically lowered by 0.05 to improve monitoring sensitivity. The preset threshold can also be adapted to user value; for example, for high-net-worth users, the first-level threshold is raised by 0.05 to avoid false alarms, and the second-level threshold is lowered by 0.03 to enhance protection. The preset threshold can also be attenuated based on continuous abnormal triggers; for example, if a user triggers abnormal alarms continuously within 24 hours, the subsequent thresholds will decrease in increments of 0.02, improving the system's sensitivity to continuous attacks.

[0087] In this embodiment of the disclosure, the system outputs a structured judgment result, including anomaly level, confidence probability, main contribution dimension, and handling suggestions.

[0088] The abnormal behavior identification method provided in this disclosure utilizes graph neural networks to analyze account relationships, enabling the identification of abnormal group operations. By comparing user behavior with a normal group benchmark, it identifies user deviation patterns. Based on an individual's historical baseline, it can capture behavioral mutations. By dynamically fusing the three detection results, a comprehensive anomaly probability is generated, and a multi-level threshold mechanism is employed to achieve tiered risk warnings. This method represents a leap from single-rule detection to multi-dimensional intelligent analysis, providing reliable protection for financial security. Combining deep learning, graph neural networks (GNNs), and real-time data stream processing technology, this method can analyze transaction data in real time, significantly improving the real-time performance of anti-money laundering monitoring. Through the automatic learning of deep learning models, this method reduces the high false alarm rate caused by rule lag, lowers the need for manual intervention, and improves monitoring efficiency.

[0089] Based on the above-described abnormal behavior identification method, this disclosure also provides an abnormal behavior identification device. The following will be combined with... Figure 3 The device is described in detail.

[0090] Figure 3 A schematic block diagram of an abnormal behavior recognition device according to an embodiment of the present disclosure is shown.

[0091] like Figure 3 As shown, the abnormal behavior recognition device 300 in this embodiment includes a data acquisition module 310, a structural anomaly recognition module 320, a general pattern analysis module 330, an individual behavior analysis module 340, and a scoring fusion module 350.

[0092] The data acquisition module 310 is used to acquire user account data, including basic account information and transaction data, with user authorization. In one embodiment, the data acquisition module 310 can be used to perform the operation S210 described above, which will not be repeated here.

[0093] The structural anomaly identification module 320 is used to construct a graph structure relationship by treating the user's account as a node and transaction data as an edge. It then uses a graph neural network to learn the structural features of the graph structure relationship and outputs a first anomaly probability score representing structural anomalies in the account. In one embodiment, the structural anomaly identification module 320 can be used to perform the operation S220 described above, which will not be repeated here.

[0094] The general pattern analysis module 330 is used to analyze the degree of deviation of the time-series characteristics, geographical characteristics, and monetary characteristics of transaction data from the general benchmark of the group, and outputs a second anomaly probability score representing the deviation of user behavior from the general pattern. In one embodiment, the general pattern analysis module 330 can be used to perform the operation S230 described above, which will not be repeated here.

[0095] The individual behavior analysis module 340 compares the user's transaction data with a dynamic baseline formed based on the user's own historical transaction data, and outputs a third anomaly probability score characterizing a sudden change in the user's individual behavior. In one embodiment, the individual behavior analysis module 340 can be used to perform the operation S230 described above, which will not be repeated here.

[0096] The scoring fusion module 350 is used to make a comprehensive judgment based on the first anomaly probability score, the second anomaly probability score, and the third anomaly probability score to identify abnormal transaction behavior of users. In one embodiment, the scoring fusion module 350 can be used to perform the operation S250 described above, which will not be repeated here.

[0097] According to embodiments of this disclosure, any multiple modules among the data acquisition module 310, structural anomaly identification module 320, general pattern analysis module 330, individual behavior analysis module 340, and scoring fusion module 350 can be combined into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this disclosure, at least one of the data acquisition module 310, structural anomaly identification module 320, general pattern analysis module 330, individual behavior analysis module 340, and scoring fusion module 350 can be at least partially implemented as hardware circuitry, such as a field-programmable gate array (FPGA), a programmable logic array (PLA), a system-on-a-chip, a system-on-a-substrate, a system-on-package, an application-specific integrated circuit (ASIC), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any suitable combination of any of these three implementation methods. Alternatively, at least one of the data acquisition module 310, the structural anomaly identification module 320, the general pattern analysis module 330, the individual behavior analysis module 340, and the scoring fusion module 350 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0098] Figure 4 A block diagram of an electronic device suitable for implementing an abnormal behavior recognition method according to an embodiment of the present disclosure is shown schematically.

[0099] like Figure 4As shown, an electronic device 400 according to an embodiment of the present disclosure includes a processor 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage portion 408 into a random access memory (RAM) 403. The processor 401 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 401 may also include onboard memory for caching purposes. The processor 401 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0100] RAM 403 stores various programs and data required for the operation of electronic device 400. Processor 401, ROM 402, and RAM 403 are interconnected via bus 404. Processor 401 performs various operations of the method flow according to embodiments of the present disclosure by executing programs in ROM 402 and / or RAM 403. It should be noted that the programs may also be stored in one or more memories other than ROM 402 and RAM 403. Processor 401 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in said one or more memories.

[0101] According to embodiments of this disclosure, the electronic device 400 may further include an input / output (I / O) interface 405, which is also connected to a bus 404. The electronic device 400 may also include one or more of the following components connected to the input / output (I / O) interface 405: an input section 406 including a keyboard, mouse, etc.; an output section 407 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 408 including a hard disk, etc.; and a communication section 409 including a network interface card such as a LAN card, modem, etc. The communication section 409 performs communication processing via a network such as the Internet. A drive 410 is also connected to the input / output (I / O) interface 405 as needed. A removable medium 411, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 410 as needed so that computer programs read from it can be installed into the storage section 408 as needed.

[0102] This disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs that, when executed, implement the method according to the embodiments of this disclosure.

[0103] According to embodiments of this disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, such as including, but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this disclosure, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this disclosure, the computer-readable storage medium may include ROM 402 and / or RAM 403 and / or one or more memories other than ROM 402 and RAM 403 described above.

[0104] Embodiments of this disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the abnormal behavior identification method provided in the embodiments of this disclosure.

[0105] When the computer program is executed by the processor 401, it performs the functions defined in the system / apparatus of this disclosure embodiments. According to embodiments of this disclosure, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0106] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via communication section 409, and / or installed from removable medium 411. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0107] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 409, and / or installed from removable medium 411. When the computer program is executed by processor 401, it performs the functions defined in the system of this disclosure embodiment. According to embodiments of this disclosure, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0108] According to embodiments of this disclosure, program code for executing the computer programs provided in embodiments of this disclosure can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can execute entirely on a user's computing device, partially on a user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0109] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0110] Those skilled in the art will understand that the features described in the various embodiments of this disclosure can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments of this disclosure can be combined and / or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0111] The embodiments of this disclosure have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of this disclosure, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. An abnormal behavior recognition method characterized by comprising: The method comprises: obtaining account data of a user, including account basic information and transaction data, with authorization of the user; taking the account of the user as a node and the transaction data as an edge to construct a graph structure relationship, learning structural features of the graph structure relationship by using a graph neural network, and outputting a first abnormal probability score representing account structural abnormalities; analyzing the deviation of the time sequence features, geographical features and amount features of the transaction data from the general baseline, and outputting a second abnormal probability score representing the deviation of the user behavior from the general mode; comparing the transaction data of the user with a dynamic baseline formed based on the historical transaction data of the user, and outputting a third abnormal probability score representing the mutation of the individual behavior of the user; comprehensively judging based on the first abnormal probability score, the second abnormal probability score and the third abnormal probability score to identify abnormal transaction behavior of the user.

2. The method of claim 1, wherein, The method comprises: taking the account of the user as a node and the transaction data as an edge to construct a graph structure relationship, learning structural features of the graph structure relationship by using a graph neural network, and outputting a first abnormal probability score representing account structural abnormalities; taking the account of the user as a node and the transaction data as an edge to construct a graph structure relationship, learning structural features of the graph structure relationship by using a graph neural network, and outputting a first abnormal probability score representing account structural abnormalities; The method comprises:

3. The method of claim 1, wherein, extracting the time sequence features, geographical features and amount features of the transaction data to form a multi-dimensional feature vector; calculating the deviation distance between the multi-dimensional feature vector and the general baseline feature vector, the general baseline feature vector being generated based on the historical transaction data of the normal user group; mapping the deviation distance to a probability value as the second abnormal probability score. The method comprises:

4. The method of claim 1, wherein, periodically calculating the dynamic baseline of the behavior features of the user in a sliding time window based on the historical transaction data of the user, the behavior features including at least the moving average of transaction frequency, the moving percentile of transaction amount and the distribution probability of transaction time; extracting the implementation behavior features corresponding to the dynamic baseline based on the transaction data; calculating the instantaneous deviation degree of the real-time behavior features and the personalized dynamic baseline, the deviation degree reflecting the change amplitude and speed of the current behavior of the user relative to the personal historical habits; based on the instantaneous deviation degree, as the third abnormal probability score. ​ 5. The method of claim 4, wherein, The periodically calculating the dynamic baseline of the behavior features of the user in a sliding time window manner based on the historical transaction data of the user comprises: Periodically extracting a behavior feature sequence from the historical transaction data of the user in a sliding time window manner; Statistically modeling the behavior feature sequence in each sliding window to generate a baseline feature value in the time period; Fusing the newly generated baseline feature value with the historical baseline feature value to update the personalized dynamic baseline.

6. The method of claim 1, wherein, The comprehensive judgment based on the first, second and third anomaly probability scores to identify the abnormal transaction behavior of the user comprises: Weighted fusion of the first, second and third anomaly probability scores to generate an abnormal behavior comprehensive probability; In the case where the abnormal behavior comprehensive probability is greater than a preset threshold, it is determined that the user has an abnormal transaction behavior.

7. An abnormal behavior recognition apparatus characterized by comprising: The apparatus comprises: A data acquisition module configured to acquire account data of a user under authorization of the user, the account data comprising account basic information and transaction data; A structural anomaly identification module configured to construct a graph structure relationship by taking an account of the user as a node and transaction data as an edge, learn structural features of the graph structure relationship by using a graph neural network, and output a first anomaly probability score representing structural anomaly of the account; A general pattern analysis module configured to analyze deviation degrees of time sequence features, geographical features and amount features of the transaction data from a general baseline, and output a second anomaly probability score representing deviation of user behavior from a general pattern; An individual behavior analysis module configured to compare the transaction data of the user with a dynamic baseline formed based on historical transaction data of the user, and output a third anomaly probability score representing mutation of individual behavior of the user; A score fusion module configured to comprehensively judge based on the first, second and third anomaly probability scores to identify the abnormal transaction behavior of the user. 8.An electronic device comprising: one or more processors; a memory for storing one or more computer programs, characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1-6.

9. A computer readable storage medium having stored thereon a computer program or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-6.

10. A computer program product comprising computer programs or instructions, characterized in that, The computer program or instructions are executed by the processor to implement the steps of the method according to any one of claims 1-6.

Images