A Fraud Prevention Early Warning Method and System Based on Cross-Modal Behavioral Consistency Test

Abstract

This invention belongs to the field of network information security technology, specifically a method and system for anti-fraud early warning based on cross-modal behavior consistency testing. The method includes: collecting user cross-modal behavior sequences and extracting their semantic representations; constructing a cross-modal behavior consistency testing model to quantify the temporal probability of cross-modal behavior consistency between any two behavior modalities; constructing a user behavior association network based on the cross-modal behavior consistency probability matrix; identifying potential fraudulent behavior clusters on this network using a deep graph clustering algorithm that considers both node attributes and edge weights; extracting cross-modal consistency violation patterns for each behavior cluster and mapping them to risk element events; constructing a dynamic risk propagation graph based on the temporal and logical relationships between risk element events to identify risk sources, propagation paths, and current threat levels; and generating interpretable early-level warnings based on the graph analysis results. This invention achieves early detection and precise strikes against novel collaborative fraud.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to an anti-fraud early warning method and system based on cross-modal behavior consistency verification. Background Technology

[0002] With the acceleration of digitalization, online fraud has exhibited new characteristics of being organized, intelligent, and cross-platform. Fraud teams use multiple accounts, devices, and identities to coordinate their crimes, and meticulously disguise themselves across multiple behavioral dimensions such as transactions, social interactions, and communications to evade detection by traditional risk control systems. Existing anti-fraud technologies have shown significant shortcomings in the face of these new threats.

[0003] Specifically, existing technologies mainly suffer from the following bottlenecks:

[0004] First, the feature analysis dimensions are either too narrow or too superficial. Chinese patent CN112866192B discloses a method and apparatus for identifying abnormal clustering behavior, but it relies solely on location trajectory clustering, rendering it ineffective against online fraud without spatial clustering. Chinese patent application CN120892896A discloses a big data anti-fraud method based on multimodal behavioral features. While it integrates multiple modalities, its core idea is to suppress intermodal inconsistencies as noise, failing to recognize that such "inconsistencies" can be key attack signals in coordinated fraud. For example, a fraud team might use a device in location A to log into an account but induce the victim to transfer funds to an account in location B. This cross-modal "geographical inconsistency" is precisely important evidence of fraud, rather than noise that should be suppressed.

[0005] Second, pattern discovery relies on historically known information. Chinese patent CN111915468B discloses a proactive inspection and early warning system for online fraud, which heavily relies on a pre-built fraud topology model library and lacks the ability to proactively discover completely new fraud patterns not in the library (i.e., "zero-day fraud"). Its system is essentially "memory" rather than "discovery."

[0006] Third, there is a lack of characterization and early warning of the dynamic evolution of risks. Existing methods mostly output static "risk scores" or "labels." For example, Chinese patent application CN119383256A discloses an anti-fraud method, system, device, and storage medium based on the behavioral characteristics of the elderly, which only outputs suspicious phone numbers. These methods cannot answer key questions such as where the risk originates, how it spreads, or what stage of the attack chain it is currently in. This results in a lack of context in early warning decisions, making it difficult to implement precise and timely interventions (e.g., should users be alerted during the fraudulent inducement stage, or should funds be intercepted just before they are transferred).

[0007] Fourth, the warning results are unexplainable. The system usually provides a black-box score, which is difficult for risk control personnel to understand the basis for, making it difficult to adjust for false alarms and missed alarms, and also preventing the formation of effective countermeasure strategies.

[0008] Therefore, the industry urgently needs a highly intelligent anti-fraud technology solution that can deeply understand cross-modal behavioral semantics, proactively discover unknown collaborative patterns, dynamically characterize risk evolution paths, and provide explainable early warnings. Summary of the Invention

[0009] This invention proposes an anti-fraud early warning method and system based on cross-modal behavior consistency testing. It aims to solve the technical problem that existing anti-fraud technologies are unable to effectively obtain the dynamic interaction topology of user groups, resulting in the inability to proactively and accurately discover unknown fraud clues from large-scale, multi-source, heterogeneous interaction data, and thus have poor robustness.

[0010] In a first aspect, embodiments of the present invention provide an anti-fraud early warning method based on cross-modal behavioral consistency testing, including:

[0011] S1 collects real-time multimodal behavioral time-series data of the target user group, including transaction modality, device modality, social modality and location modality;

[0012] S2, semantically enhance the encoding of the behavioral temporal data for each modality to obtain a cross-modal alignable semantic feature vector for each behavioral instance;

[0013] S3. Construct a cross-modal behavior consistency test model. Based on the semantic feature vector of a single user, calculate the cross-modal behavior consistency probability of any two different modal behavior instances occurring within the same time window.

[0014] S4. Based on the cross-modal behavior consistency probability of all users in the target user group across all time windows, construct a three-dimensional cross-modal behavior consistency probability matrix of user-behavior-time, and generate a weighted dynamic user behavior association network.

[0015] S5. A deep clustering algorithm based on graph neural networks is used to perform clustering analysis on the dynamic user behavior association network to identify potential risk behavior clusters with abnormal cross-modal consistency patterns.

[0016] S6. For each cluster of potential risk behaviors, extract cross-modal consistency violation patterns and abstract them into reusable risk meta-events;

[0017] S7 constructs and updates a dynamic risk propagation map in real time based on the temporal correlation and causal reasoning between risk meta-events;

[0018] S8. Based on the analysis results of the dynamic risk propagation map, generate a graded early warning instruction that includes an explanation of the causes of the risk.

[0019] The technical effect of the anti-fraud early warning method based on cross-modal behavioral consistency test disclosed in this invention is that the method realizes the proactive discovery of new and collaborative fraud patterns from group behavior by quantifying cross-modal behavioral consistency and constructing a dynamic network, and can track the risk evolution path to achieve early and explainable early warning.

[0020] Furthermore, the semantic enhancement encoding in S2 specifically includes:

[0021] For the transaction modality, a Transformer-based sequence model is used to encode the sequence consisting of transaction amount, counterparty, and product category, and outputs a transaction intent vector;

[0022] For device modalities, device fingerprints, sensor data, and application lists are compressed into device state vectors using an autoencoder.

[0023] For social modalities, a graph attention network is used to encode short-term interaction features in the user's social relationship graph and output social behavior vectors.

[0024] For location modalities, latitude and longitude sequences are fused with semantic location information, and a location semantic vector is output through a spatiotemporal coding network;

[0025] Furthermore, by contrastive learning alignment, vectors from different modalities are mapped to the same semantic metric space.

[0026] Furthermore, the cross-modal behavior consistency verification model in S3 specifically includes:

[0027] Construct a consistency discriminator based on a multilayer perceptron. The input vector of the consistency discriminator is composed of the following concatenations:

[0028] (a) The first line is instance M i semantic feature vector f i The mode is A;

[0029] (b) The second line is instance M j semantic feature vector f j The mode is B;

[0030] (c) Normalized time difference characteristics Δt norm Its value is the time difference between the occurrence of the two rows of instances divided by the preset maximum time window length;

[0031] (d) Modality pair baseline vector C t(A, B) represents the modality A behavioral feature vector f generated by all users within the preset time period type of the current time window t, based on historical normal behavior data. A With the behavioral feature vector f of mode B B The concatenated vector [f A ;f B The mean vector of ];

[0032] The input vector is input into the multilayer perceptron, and the output layer of the multilayer perceptron uses the sigmoid activation function. The output value is the cross-modal behavior consistency probability P(M). i M j |t).

[0033] Furthermore, the generation of a weighted dynamic user behavior association network in S4 specifically includes:

[0034] Users are designated as primary nodes, and behavioral instances belonging to different modalities that occur within the same time window are designated as secondary nodes.

[0035] If the cross-modal behavior consistency probability between two user instances generated within the same time window is lower than the first threshold θ1, then an edge is established between the two user nodes, with the edge weight being the average of all corresponding cross-modal behavior consistency probabilities within that time window.

[0036] If the cross-modal behavior consistency probability between different modal behavior instances generated by a single user is lower than the second threshold θ2, then an edge marked as a violation is established between the user node and its corresponding behavior instance node.

[0037] Furthermore, the deep clustering algorithm in S5 is specifically as follows:

[0038] A graph convolutional neural network (GCN) is used to process dynamic user behavior association networks, aggregating the features of nodes and their neighbors.

[0039] A clustering auxiliary loss function is introduced, which simultaneously minimizes the feature distance between nodes within the same cluster and maximizes the feature distance between nodes in different clusters, and imposes additional separation constraints on nodes that violate the connection edge.

[0040] By jointly optimizing the parameters of the graph convolutional neural network (GCN) and cluster centers, node embedding and cluster assignment are learned synchronously, and finally the risk behavior cluster label to which the node belongs is output.

[0041] Furthermore, in S6, extracting cross-modal consistency violation modes specifically includes:

[0042] Low cross-modal behavior consistency probability mode pairs appearing within statistical risk behavior clusters;

[0043] Extract the feature difference dimensions that lead to low cross-modal behavior consistency probability;

[0044] The combination of low crossmodal behavior consistency probability mode pairs and feature difference dimensions is formalized as [(M a M b ),(Dim k Triples of the structure [,Divergence)] are used as risk element events;

[0045] Among them, M a M b For different modes, Dim k is the feature dimension, and Divergence is the difference measure.

[0046] Furthermore, the construction process of the dynamic risk propagation map in S7 is as follows:

[0047] Each risk event is treated as a node in the graph;

[0048] If two risk events occur consecutively in the same user or related user in time sequence, and Granger causality is determined by the causal discovery algorithm, then a directed edge is established between the two nodes, with the edge weight being the causal strength.

[0049] The graph is set with virtual risk source nodes and risk convergence nodes, which connect the initial occurrence and high-frequency convergence of risk meta-events, respectively.

[0050] Real-time calculation of global risk indicators of the graph, including average risk path length, node betweenness centrality, and the size of currently active risk clusters, and assessment of threat level.

[0051] Furthermore, the causal discovery algorithm employs an improved method based on the time-series Granger causality test, specifically including:

[0052] Stationarity tests and differencing are performed on the time series of risk element events.

[0053] Construct a vector autoregressive model and use the Bayesian information criterion to determine the optimal lag order;

[0054] Calculate the F-statistic of the Granger causality test and combine it with the causality strength threshold to determine whether a significant causal relationship exists.

[0055] Secondly, embodiments of the present invention provide an anti-fraud early warning system based on cross-modal behavioral consistency verification for implementing the method, the system being configured to execute the method, the system comprising:

[0056] A multi-source heterogeneous data acquisition module is used to acquire raw behavior logs of transaction modalities, device modalities, social modalities, and location modalities in real time;

[0057] A cross-modal semantic encoding module is used to encode the raw behavior log into cross-modal alignable semantic feature vectors;

[0058] The behavior consistency verification module is used to calculate the cross-modal behavior consistency probability between any two-modal behavior instances;

[0059] The dynamic association network construction module is used to build and update a dynamic user behavior association network based on cross-modal behavior consistency probability.

[0060] The depth graph clustering analysis module is used to identify clusters of potential risky behaviors in dynamic user behavior association networks;

[0061] The risk pattern abstraction module is used to extract risk meta-events from clusters of risk behaviors;

[0062] A dynamic risk graph engine for building, visualizing, and analyzing dynamic risk propagation graphs;

[0063] An interpretable early warning generation module is used to output tiered early warnings and interpretive reports.

[0064] The technical effect of the system disclosed in this invention is that by constructing a closed loop from data encoding, consistency verification, dynamic graph generation to attack simulation, the system achieves automated and adaptive detection and situational awareness of unknown fraud teams, significantly improving the proactive defense capability and decision support level of the anti-fraud system.

[0065] Furthermore, the dynamic risk graph engine also includes a simulated attack module for:

[0066] Receive abstracted risk meta-events;

[0067] Based on the principles of generative adversarial networks, this study simulates how fraudsters can use known risk patterns to construct new and more covert collaborative attack sequences.

[0068] The generated simulated attack sequences are injected into the consistency verification module for testing, in order to verify the system's defense capabilities and trigger enhanced learning updates to the risk meta-event library. Attached Figure Description

[0069] Figure 1 This is a flowchart illustrating an anti-fraud early warning method based on cross-modal behavioral consistency testing proposed in an embodiment of the present invention.

[0070] Figure 2 This is a schematic diagram illustrating the linkage between consistency verification and network construction in an embodiment of the present invention.

[0071] Figure 3 This is a schematic diagram illustrating the construction and early warning generation of risk maps provided in an embodiment of the present invention. Detailed Implementation

[0072] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0073] To address the challenge mentioned in the background technology of how to provide early, accurate, and interpretable risk warnings against modern online fraud that is unknown, dynamic, and collaboratively disguised across multiple behavioral dimensions, this invention provides an anti-fraud early warning method based on cross-modal behavioral consistency testing. This method can be implemented on platforms such as finance, social media, and e-commerce. It utilizes the "consistency" and "inconsistency" between cross-modal behaviors as core detection signals, and on this basis, constructs a time-series graph that dynamically depicts the propagation and evolution of risk among users. This allows for the early identification of risk clusters and key attack paths before the fraud chain is completed. (Reference) Figures 1 to 3 As shown, the specific steps include:

[0074] S1 collects real-time multimodal behavioral time-series data of the target user group, including transaction modality, device modality, social modality and location modality.

[0075] Multi-modal behavioral time-series data of the target user group is collected in real time through a multi-source heterogeneous data acquisition module and deployed on the business backend. Taking a financial social application as an example, the real-time collected data is as follows:

[0076] Transaction modality data: sourced from payment system logs, with fields including: user ID, transaction timestamp, transaction amount, payee ID (anonymized), product category (e.g., "investment", "health products"), and payment method.

[0077] Device modal data: from the client SDK, fields include: device ID (generated from device fingerprint), IP address and proxy marker, GPS coordinates (with user authorization), sensor data (used to detect abnormal shaking patterns in automated scripts), and a list of currently foreground applications.

[0078] Social modality data: derived from the in-app social graph, with fields including: user ID, interaction object ID, interaction type (private chat, group chat @, like, share), interaction time, and conversation topic tags extracted by NLP (such as "investment", "rebate", "disease").

[0079] Location modal data: derived from GPS and Wi-Fi positioning and combined with geographic information systems to convert latitude and longitude into semantic locations (such as "residential area", "internet cafe", "commercial center").

[0080] It should be noted that the above data is data that has been anonymized and can be used normally by banks or public management agencies after obtaining user authorization.

[0081] S2 performs semantic augmentation encoding on the temporal data of behavior for each modality to obtain cross-modal alignable semantic feature vectors for each behavior instance.

[0082] The multimodal behavioral time-series data collected in step S1 is the raw data. This step receives the raw data through the cross-modal semantic coding module. Its core task is to map data of different forms to the same semantic metric space, making "intent" comparable. Behavioral time series include transaction sequences, device state sequences, social interaction sequences, and location sequences, corresponding to the easy modality, device modality, social modality, and location modality, respectively.

[0083] For the transaction sequence, a Transformer encoder is used; a lightweight Transformer encoder will suffice. The input consists of transaction records sorted by time over the past hour, with each record containing a sequence of amount, counterparty type hash, and product category. The output is a transaction intent vector for that time period (e.g., a 128-dimensional vector). By pre-training on a proxy task of predicting the next transaction on large-scale normal transaction data, this vector can capture users' short-term consumption preferences and risk appetite.

[0084] For the device state sequence, a denoising autoencoder is used. The input is a snapshot of device features (including IP address range, screen brightness, battery status, etc.) sampled every 5 minutes. The output is a stable device state vector. The training objective is to reconstruct the input and make its vector more similar to the vectors of different devices at different time points on the same device.

[0085] For a sequence of social interactions, a temporary social subgraph is constructed on a daily basis. A two-layer graph attention network is used to aggregate features of neighbors (interaction objects) (such as the other party's risk history labels). The output is the user's social behavior vector for the day, reflecting the dynamic risk exposure level of their social circle.

[0086] For location sequences, a spatiotemporal coding network is employed. The input consists of continuous geographic coordinates and semantic locations obtained through inverse geocoding (e.g., "a securities brokerage" or "a hospital"). The network learns to output a location semantic vector, which not only represents the movement trajectory but also the potential purpose of the location sequence (e.g., "movement from home to multiple financial institutions").

[0087] Key Step – Contrastive Learning Alignment: To ensure that the four vector spaces – transaction intent vector, device state vector, social behavior vector, and location semantic vector – can be compared, a shared contrastive learning layer is introduced. Specifically, a large amount of data from normal users is collected to construct positive and negative sample pairs. For example, the transaction intent vector and device state vector of the same user within a similar time period constitute a positive sample pair; random vectors from different users constitute negative sample pairs. The InfoNCE loss function forces vectors from different modalities but belonging to the same normal context to move closer together in the shared space, while unrelated vectors move further apart.

[0088] After this step, the cosine similarity between the transaction intent vector of "transfer purchase" and the device state vector of "device located in internet cafe" can be directly calculated. This similarity has an interpretable semantic meaning - that is, the degree of commonality of "conducting such transactions in this scenario".

[0089] S3. Construct a cross-modal behavior consistency test model. Based on the semantic feature vector, calculate the cross-modal behavior consistency probability of any two different modal behavior instances occurring within the same time window.

[0090] The goal of cross-modal behavioral consistency testing is to quantify whether a user's different behaviors within a certain time period are "normally coordinated" or "suspiciously divergent".

[0091] Taking the cross-modal behavior consistency test between transaction modality T and device modality D as an example, the system predefines a time period type library. For the current time window t (e.g., "Wednesday - Weekday - 2:00 PM to 2:30 PM"), the following steps are performed:

[0092] S31, Time Period Type Classification and Identification: A pre-defined time period type classification system is established. For example, based on three dimensions—"whether it is a holiday," "day of the week," and "time period within a day (e.g., 0-6:00, 6-12:00, 12-18:00, 18-24:00)"—time is divided into several types (e.g., 7 days × 2 types of dates × 4 time periods = 56 types). For the current time window t to be examined, its time period type is first determined based on its timestamp (e.g., "weekday - Wednesday - afternoon").

[0093] Among them, the time difference feature Δt norm The time difference between the transaction occurrence time and the device login time is normalized. For example, if the transaction occurs at 14:05:00 and the device logs in at 14:10:30, the time difference Δt = 330 seconds. The system's preset maximum time window length is 1800 seconds. Normalized time difference: Δt norm =330 / 1800≈0.1833.

[0094] S32, Historical Data Retrieval and Filtering: Retrieve all historical time window data tagged with the same time period type as t (i.e., "Weekday-Wednesday-Afternoon") from the database storing historical normal behavior data. Then, for each historical window, further filter out data entries under the same user ID within that window that simultaneously contain transaction behavior records and device behavior records. This ensures that the statistical f... T and f D They are related in terms of the actor and the time.

[0095] S33, Feature Vector Extraction and Concatenation: For each valid data record selected in step S2, extract its semantic feature vector f representing the transaction behavior. T (e.g., 128 dimensions) and semantic feature vector f of device behavior D (For example, 64 dimensions). Concatenate these two vectors in order to form a longer joint feature vector V=[f T ;f D (The dimensions are 128 + 64 = 192).

[0096] S34, Modality to baseline vector C t (A, B) Acquisition: Suppose a total of N valid records are retrieved, resulting in N concatenated 192-dimensional vectors V1, V2, ..., V N Calculating their arithmetic mean yields the mean vector, which is the baseline vector C of the modality pair representing the normal group behavior of the "transaction-device" modality pair in the current time period. t (A, B). It quantifies the average joint state of transaction behavior and device behavior of a normal user group in the semantic feature space during time periods such as "weekday-Wednesday-afternoon".

[0097] The baseline vector can be cached for direct access when a time window of the same time period type arrives. The system can set an update cycle (e.g., weekly) to recalculate the baseline vectors for all time period types and modality pairs based on historical normal data from the most recent period (e.g., 90 days) to adapt to the natural drift of group behavior patterns.

[0098] Example: A user makes a small money transfer or purchase to a familiar contact using their familiar home device. The predicted probability values ​​for these transaction-device, transaction-social, and device-location modalities will be high (e.g., 0.9 calculated using the formula above). Conversely, a user makes a large money transfer to an investment platform recommended by a "mentor" they just met in a social group using a brand-new device in an unfamiliar internet cafe. The predicted probability values ​​for these transaction-device, transaction-location, and device-social modalities will be low (e.g., 0.2).

[0099] S4 constructs a three-dimensional cross-modal behavior consistency probability matrix based on the cross-modal behavior consistency probability of all users in the target user group across all time windows, and generates a weighted dynamic user behavior association network.

[0100] Among these, dynamic correlation network construction is performed based on the aforementioned probabilities. This is divided into two cases:

[0101] In the first scenario, the edge between users is established only when the consistency probability between the two users' behavior instances is lower than θ1 (i.e., abnormally low), indicating that they may be colluding. θ1 is used to determine whether users are colluding abnormally (the lower the probability, the more suspicious). This value is dynamically adjusted based on the cross-modal consistency probability distribution of users' historical behavior data, and is generally empirically set to 0.3.

[0102] The second scenario involves user-behavior violation edges: A "violation" edge is established only when the consistency probability between different modal behaviors of the same user is lower than θ2, indicating that the user's behavior is abnormal. θ2 is used to determine whether a user's behavior is inconsistent (the lower the probability, the more abnormal). This value is dynamically adjusted based on the cross-modal consistency probability distribution of the user's historical behavior data, and is typically taken as 0.6.

[0103] The dynamic adjustment formula is as follows:

[0104] Where θ is the first threshold θ1 or the second threshold θ2, μ is the mean of the historical consistency probability, σ is the standard deviation, and α is the adjustable sensitivity coefficient.

[0105] For example: User U1 has a transaction M in time window T1. t1 and device behavior M d1 Its cross-modal behavior consistency probability P(M) t1 M d1 = 0.2 (less than θ2). Meanwhile, user U2 has social behavior M in T1. s2 And with U1's M t1 There is an indirect connection (e.g., U2's comments in social groups guiding investment). Calculate M. t1 With M s2 The cross-user, cross-modal behavior consistency probability (calculated through their feature vectors) is assumed to be 0.15 (also very low and less than θ1).

[0106] Since U1 and U2 exhibited behaviors with low cross-modal consistency probability within the same time window, and these behaviors may be semantically related, an edge is established between the nodes of users U1 and U2, with a weight w = (0.2 + 0.15) / 2 = 0.175. The lower the weight, the more suspicious the connection, i.e., the weaker the correlation.

[0107] Meanwhile, in user U1 node and its own low-probability behavior node (M) t1 M d1 Establish a connection marked as a violation between ).

[0108] This step transforms abstract probability calculations into a concrete graph structure with rich attributes. This network not only connects users, but more importantly, it connects specific abnormal behaviors, laying the foundation for subsequent refined clustering and pattern extraction.

[0109] A further step, the detailed process of step S4 is as follows:

[0110] S41 uses users as primary nodes and instances of behaviors belonging to different modalities that occur within the same time window as secondary nodes.

[0111] First-level nodes are users, and each user corresponds to a unique node. The node ID can be a hash value of the user ID. Node attributes can include static or statistical characteristics such as user registration time, historical risk tags, and active time period preferences. It is represented as NodeU(u), where u is the user identifier.

[0112] Second-level nodes are behavior instance nodes, with each behavior instance corresponding to one node, uniquely identified by "user identifier U + time window + modality type + behavior sequence ID". Node attributes are their corresponding semantic feature vectors (from S2 output), such as: transaction behavior node, device behavior node, social behavior node, location behavior node, ultimately represented as: NodeB(u,t,m,ID), where u is the user identifier, ID is the behavior sequence, t is the time window number, and m is the modality type.

[0113] Time window partitioning mechanism: A sliding time window is adopted, with a window length t that can be set to 30 minutes and a sliding step size that can be set to 5 minutes. Within each window, the same user and the same modality may generate multiple behavior instances, and each instance is independently a secondary node.

[0114] S42, Inter-user Related Edges (Suspicious Cross-User Collaboration Links):

[0115] If the cross-modal behavior consistency probability between two user instances generated within the same time window is lower than the first threshold θ1, then an edge is established between the two user nodes, with the edge weight being the average of all corresponding cross-modal behavior consistency probabilities within that time window.

[0116] For any two distinct users ua and ub within a time window t, if there exists at least one pair of behavior instances (b... a ,b b) belong to different modalities, and the probability of cross-modal behavioral consistency between them is P(b a ,b b If |t) is lower than the first threshold θ1, as calculated in step S3 above, then it is considered that the two users have suspicious collaborative behavior within the window, and an undirected edge is established between user nodes NodeU(ua) and NodeU(ub).

[0117] Weight calculation: the weight w of the edge connecting the users. ab Instead of using a single probability value, the consistency probabilities of all triggering behavior pairs within the time window are aggregated to comprehensively reflect the overall degree of collaborative anomaly between the two users' behaviors. The calculation formula is as follows:

[0118] ;

[0119] Where P ab For all satisfying P(b) a ,b b The set of mode pairs where |t)<θ1. Weight w ab The lower the value, the higher the degree of collaboration anomaly between UA and UB within that time window, and the higher the suspicion of association.

[0120] In addition, this weight also uses a network dynamic update mechanism:

[0121] (1) Each time a new time window is entered, only the nodes and edges of the user and behavior instances within that window are incrementally constructed.

[0122] (2) Edge weight decay: The weight of the edge connecting users can decay over time.

[0123] For example: To reflect the timeliness of the action.

[0124] S43, User-Behavior Violation Edge (User's Own Behavior Inconsistency): If the cross-modal behavior consistency probability between different modal behavior instances generated by a single user is lower than the second threshold θ2, then an edge marked as a violation is established between the user node and its corresponding behavior instance node.

[0125] Triggering condition: For any two different modal behavior instances b generated by user u within time window t. i and b j If its cross-modal behavior consistency probability P(b) i ,b j If |t) is lower than the second threshold θ2, then the user's behavior is considered to be inconsistent across modalities.

[0126] Edge establishment: Establish a directed edge between the user node NodeU and each instance node NodeB involved in the low consistency behavior, marked as the violation type.

[0127] For example: θ1=0.3, θ2=0.6, within the time window t:

[0128] User U1: Transaction behavior b t1 Device behavior b d1 , P(b t1 ,b d1 =0.25 (lower than θ2).

[0129] User U2: Social Behavior b s2 , P(b t1 ,b s2 =0.2 (lower than θ1).

[0130] Then construct:

[0131] In U1 and b t1 b d1 Establish a violation edge between them.

[0132] Establish a user association edge between U1 and U2 with a weight w = 1 − (0.25 + 0.2) / 2 = 0.775.

[0133] S5. A deep clustering algorithm based on graph convolutional neural network (GCN) is used to perform clustering analysis on the dynamic user behavior association network to identify potential risk behavior clusters with abnormal cross-modal consistency patterns.

[0134] Design a joint optimization objective. In addition to the conventional graph convolutional neural network (GCN) reconstruction loss, a clustering-specific loss function L is introduced. cluster :

[0135] L cluster =α∙L intra +β∙L inter +γ∙L violation ;

[0136] L intra Minimize the distance between node embeddings within the same cluster; L inter : Maximize the distance between node embeddings in different clusters; L violationLoss term. For user nodes and behavior nodes connected by a violation edge, even if they are close in the feature space, this loss term exerts a force trying to push them apart. This forces the model to find a more advanced clustering method that can explain this violation behavior. For example, it might cluster users who "use new devices for unusual transactions" and "engage in social inducements at unusual locations" into the same cluster because their "violation patterns" are similar, even though their specific behaviors are different.

[0137] Through iterative training, the GCN parameters and a set of learnable cluster centers are optimized simultaneously. Finally, a cluster label is assigned to each node. The output consists of several "potential fraud behavior clusters".

[0138] Unlike traditional clustering which only focuses on similarity, this step uses L... violation The loss term allows the clustering process to focus directly on the consistency of anomalous patterns, thus enabling more accurate identification of teams working together, even if their individual actions are disguised.

[0139] The dynamic user behavior association network is input into a graph convolutional network (GCN). The GCN learns a new embedding representation for each node (user node and behavior node) that incorporates graph structure information by aggregating the features of each node and its neighbors. This network serves as the input graph structure for the GCN, where violation edges act as constraints in the clustering loss.

[0140] S6. For each cluster of potential risky behaviors, extract cross-modal consistency violation patterns and abstract them into reusable risk meta-events. Violation edges directly correspond to the "cross-modal consistency violation pattern" and are used to generate risk meta-events. Specifically, this includes:

[0141] S61, Statistically analyze low cross-modal behavior consistency probability mode pairs occurring within risk behavior clusters. For each risk behavior cluster C... k Calculate all cross-modal behavior pairs (b) within the cluster i ,b j The cross-modal behavior consistency probability distribution of the cluster is used. The lower quartile (one-quarter) of this distribution is taken as the local threshold for the cluster. If this threshold is higher than the global threshold. (e.g., 0.3), then a global threshold is used. The cross-modal behavior consistency probability P(b) in S4 i ,b j If the value of t is below the threshold, it is included in the statistics.

[0142] S62, extract the feature difference dimensions that lead to low consistency.

[0143] (1) The semantic feature vector of each modality consists of multiple semantic dimensions, for example:

[0144] Transaction modality: amount, unfamiliarity with the counterparty, risk level of the product, and abnormality of the transaction time;

[0145] Equipment modality: Equipment newness, IP risk level, sensor anomaly index, application list risk tags;

[0146] Social modality: Risk level of interaction objects, sensitivity of topics, and abnormal frequency of interaction;

[0147] Location modality: location movement speed, location type risk, and time-location mismatch.

[0148] (2) Gradient-based saliency analysis is used for low probability mode pairs (b i ,b j The following calculations were performed using the consistency test model (MLP):

[0149] ;

[0150] Where f is the input feature vector, and the dimension of gradient g that is greater than a preset value is the feature difference dimension d that leads to low consistency.

[0151] S63 formalizes the combination of low cross-modal behavioral consistency probability modal pairs and feature difference dimensions into structural triples as risk element events:

[0152] Risk Atom =[(M a M b ),(Dim k [Divergence]

[0153] Among them, M a M b For different modes, Dim k is the feature dimension, and Divergence is the difference measure, which is usually the average value and then normalized to the [0,1] interval.

[0154] S7 constructs and updates a dynamic risk propagation graph in real time based on the temporal correlation and causal reasoning between risk meta-events. Each risk meta-event serves as a node in the graph, and the node attributes contain all the information of the triple.

[0155] The dynamic risk propagation map enables the "visualization" and "deductive analysis" of risks. Specifically, it includes the following steps:

[0156] S71 adds all risk meta-events generated within the current time slice as new nodes to the graph.

[0157] S72, Relationship Mining:

[0158] (1) Temporal correlation: If Risk Atom1 (The risk event of user A's abnormal transaction) occurs at time t1, Risk Atom2 (The risk meta-event induced by user B in a social group) occurs at t2 (t2>t1), and users A and B are in the same cluster (there is an edge in the behavioral association network). Therefore, it is initially believed that there exists a path from Risk... Atom2 To Risk Atom1 The potential impact on the edge.

[0159] (2) Causal Verification: To rule out coincidence, Granger causality tests are performed on the time series of this pair of events (with an expanded window in the historical data). If the test results indicate that the type of event in Atom2 is statistically significantly preceding and helps predict Risk, then the test is considered successful. Atom1 For events of a certain type, a path is created in the graph from Risk. Atom2 Pointing to Risk Atom1 The directed causal edges are weighted by the F-statistic value of the causality test.

[0160] S73, the map is gradually taking shape. Multiple risks may be discovered. Atom2 (Social inducement) nodes point to a few Risks Atom1 Large transfer nodes form a "many-to-one" convergence structure, which strongly suggests a fraud team is simultaneously luring multiple victims. "Risk source" nodes are also set up to connect the earliest emerging risk events without obvious boundaries (such as a newly registered social media account adding a large number of friends). Simultaneously, "risk convergence" nodes are set up to connect the key events that will lead to financial losses (such as withdrawal transactions initiated to suspicious addresses).

[0161] S8. Based on the analysis results of the dynamic risk propagation map, generate a graded early warning instruction that includes an explanation of the causes of the risk.

[0162] Threat level assessment: Real-time calculation of map indicators.

[0163] Current number of active nodes: Exceeds threshold N alert This indicates that the system is abnormally active.

[0164] Average risk path length: the average number of steps from the source to the convergence point. A shorter path length means a faster attack pace and an escalating threat.

[0165] Key node betweenness centrality: Identify key “bridge” users or events that connect different team subgraphs, which are the primary targets for attack.

[0166] Based on the comprehensive score of these indicators, the current threat level of the system is output as "low, medium, high, critical".

[0167] For example:

[0168] Warning level: High;

[0169] Core risk: Suspected "investment and wealth management" scam teams are active.

[0170] Users involved: Users A, B, C... (cluster IDs);

[0171] Attack chain reconstruction:

[0172] 1. (t1) Source of risk: User S (social media account) posted high-yield investment information in multiple groups (Risk). Atom2 ).

[0173] 2. (t2) Induction phase: Users A, B, etc. interact closely with S and are guided to a third-party platform.

[0174] 3. (t3) Implementation Phase: User A uses the new device to transfer funds to the platform's designated account from a non-local location (Risk). Atom1 ).

[0175] Current stage: At t3, there is already a risk of funds being transferred out, requiring immediate intervention.

[0176] Recommended measures: Initiate secondary authentication or manual telephone verification for user A; conduct a temporary suspension investigation of user S's account; and issue anti-fraud alerts in relevant social media groups.

[0177] By transforming the "black box" judgments of artificial intelligence into "tactical intelligence" that risk control personnel can understand and execute, the practical value and efficiency of early warnings are greatly enhanced.

[0178] Based on the same inventive concept, embodiments of the present invention also provide an anti-fraud early warning system based on cross-modal behavioral consistency verification for implementing the above method, the system comprising:

[0179] A multi-source heterogeneous data acquisition module is used to acquire raw behavior logs of transaction modalities, device modalities, social modalities, and location modalities in real time;

[0180] A cross-modal semantic encoding module is used to encode the raw behavior log into cross-modal alignable semantic feature vectors;

[0181] The behavior consistency verification module is used to calculate the cross-modal behavior consistency probability between any two-modal behavior instances;

[0182] The dynamic association network construction module is used to build and update a dynamic user behavior association network based on cross-modal behavior consistency probability.

[0183] The depth graph clustering analysis module is used to identify clusters of potential risky behaviors in dynamic user behavior association networks;

[0184] The risk pattern abstraction module is used to extract risk meta-events from clusters of risk behaviors;

[0185] A dynamic risk graph engine for building, visualizing, and analyzing dynamic risk propagation graphs;

[0186] An interpretable early warning generation module is used to output tiered early warnings and interpretive reports.

[0187] The interpretable warning generation module outputs the following warning reports:

[0188] A visual interface for dynamic risk propagation graphs; a timeline description of the attack chain; a list of involved users and summaries of their behaviors; recommended remedial measures and risk level assessments.

[0189] A further step in the dynamic risk graph engine includes a simulated attack module. This module is used to further implement the steps in S7. To verify the robustness of the system and achieve self-evolution, this module will simulate the abstracted risk meta-events (such as Risk). Atom1 and Risk Atom2 The system takes a generator based on a Generative Adversarial Network (GAN) architecture as input. The generator learns how to combine these atomic events into more covert, time-dispersed "simulated attack scripts." These scripts are then injected into the system front-end (e.g., simulating user behavior) for testing. If a new script successfully bypasses the detection of the existing model (i.e., is not marked as high-risk), this "successful attack" sample serves as a reinforcement learning signal, feeding back into the risk pattern abstraction module and the consistency verification model, driving them to update their parameters and identify this new variant. Through "active immunity" and "adversarial evolution," it is able to cope with the continuous iteration of fraudulent tactics.

[0190] To verify the effectiveness of the system, a three-month pilot deployment was conducted on an internet finance platform. The system monitored approximately 5 million users and processed an average of about 200 million behavior logs per day.

[0191] Experimental setup: Time window length is 30 minutes, sliding step size is 5 minutes; θ1=0.3, θ2=0.6; Consistency test model is trained using historical 90 days of data.

[0192] Baseline comparison: Traditional rule engine (based on single-dimensional threshold) vs. single-modal anomaly detection model based on isolated forest.

[0193] The results are shown in the table below:

[0194]

[0195] In addition, the system successfully detected three previously unknown collaborative fraud teams involved in cross-platform social manipulation and fund transfers, all of which were detected and intercepted in advance.

[0196] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A fraud prevention and early warning method based on cross-modal behavioral consistency testing, characterized in that, include: S1 collects real-time multimodal behavioral time-series data of the target user group, including transaction modality, device modality, social modality and location modality; S2, semantically enhance the encoding of the behavioral temporal data for each modality to obtain a cross-modal alignable semantic feature vector for each behavioral instance; S3, Construct a cross-modal behavior consistency verification model. Based on the semantic feature vector of a single user, calculate the probability of cross-modal behavior consistency between any two behavioral instances from different modalities occurring within the same time window; wherein, the cross-modal behavior consistency verification model specifically includes: Construct a consistency discriminator based on a multilayer perceptron. The input vector of the consistency discriminator is composed of the following concatenations: (a) The first line is instance M i semantic feature vector f i The mode is A; (b) The second line is instance M j semantic feature vector f j The mode is B; (c) Normalized time difference characteristics Δt norm Its value is the time difference between the occurrence of the two rows of instances divided by the preset maximum time window length; (d) Modality pair baseline vector C t (A, B) represents the modality A behavioral feature vector f generated by all users within the preset time period type of the current time window t, based on historical normal behavior data. A With the behavioral feature vector f of mode B B The concatenated vector [f A ;f B The mean vector of ]; The input vector is input into the multilayer perceptron, and the output layer of the multilayer perceptron uses the sigmoid activation function. The output value is the cross-modal behavior consistency probability P(M). i M j |t); S4, based on the cross-modal behavior consistency probability of all users in the target user group across all time windows, construct a three-dimensional cross-modal behavior consistency probability matrix of user-behavior-time, and generate a weighted dynamic user behavior association network; the generation of the weighted dynamic user behavior association network specifically includes: Users are designated as primary nodes, and behavioral instances belonging to different modalities that occur within the same time window are designated as secondary nodes. If the cross-modal behavior consistency probability between two user instances generated within the same time window is lower than the first threshold θ1, then an edge is established between the two user nodes, with the edge weight being the average of all corresponding cross-modal behavior consistency probabilities within that time window. If the cross-modal behavior consistency probability between different modal behavior instances generated by a single user is lower than the second threshold θ2, then an edge marked as a violation is established between the user node and its corresponding behavior instance node. S5. A deep clustering algorithm based on graph neural networks is used to perform clustering analysis on the dynamic user behavior association network to identify potential risk behavior clusters with abnormal cross-modal consistency patterns. S6, for each cluster of potential risky behaviors, extract cross-modal consistency violation patterns and abstract them into reusable risk meta-events; specifically including: Low cross-modal behavior consistency probability mode pairs appearing within statistical risk behavior clusters; Extract the feature difference dimensions that lead to low cross-modal behavior consistency probability; The combination of low crossmodal behavior consistency probability mode pairs and feature difference dimensions is formalized as [(M a M b ),(Dim k Triples of the structure [,Divergence)] are used as risk element events; Among them, M a M b For different modes, Dim k The feature dimension is Divergence, which is the difference measure. S7 constructs and updates a dynamic risk propagation map in real time based on the temporal correlation and causal reasoning between risk meta-events; S8. Based on the analysis results of the dynamic risk propagation map, generate a graded early warning instruction that includes an explanation of the causes of the risk.

2. The method according to claim 1, characterized in that, The semantic enhancement coding in S2 is specifically as follows: For the transaction modality, a Transformer-based sequence model is used to encode the sequence consisting of transaction amount, counterparty, and product category, and outputs a transaction intent vector; For device modalities, device fingerprints, sensor data, and application lists are compressed into device state vectors using an autoencoder. For social modalities, a graph attention network is used to encode short-term interaction features in the user's social relationship graph and output social behavior vectors. For location modalities, latitude and longitude sequences are fused with semantic location information, and a location semantic vector is output through a spatiotemporal coding network; Furthermore, by contrastive learning alignment, vectors from different modalities are mapped to the same semantic metric space.

3. The method according to claim 1, characterized in that, The deep clustering algorithm in S5 is specifically as follows: A graph convolutional neural network (GCN) is used to process dynamic user behavior association networks, aggregating the features of nodes and their neighbors. A clustering auxiliary loss function is introduced, which simultaneously minimizes the feature distance between nodes within the same cluster and maximizes the feature distance between nodes in different clusters, and imposes additional separation constraints on nodes that violate the connection edge. By jointly optimizing the parameters of the graph convolutional neural network (GCN) and cluster centers, node embedding and cluster assignment are learned synchronously, and finally the risk behavior cluster label to which the node belongs is output.

4. The method according to claim 1, characterized in that, The process of constructing the dynamic risk propagation map in S7 is as follows: Each risk event is treated as a node in the graph; If two risk events occur consecutively in the same user or related user in time sequence, and Granger causality is determined by the causal discovery algorithm, then a directed edge is established between the two nodes, with the edge weight being the causal strength. The graph is set with virtual risk source nodes and risk convergence nodes, which connect the initial occurrence and high-frequency convergence of risk meta-events, respectively. Real-time calculation of global risk indicators of the graph, including average risk path length, node betweenness centrality, and the size of currently active risk clusters, and assessment of threat level.

5. The method according to claim 4, characterized in that, The causal discovery algorithm employs an improved method based on the time-series Granger causality test, specifically including: Stationarity tests and differencing are performed on the time series of risk element events. Construct a vector autoregressive model and use the Bayesian information criterion to determine the optimal lag order; Calculate the F-statistic of the Granger causality test and combine it with the causality strength threshold to determine whether a significant causal relationship exists.

6. A fraud prevention and early warning system based on cross-modal behavioral consistency testing for implementing the method of any one of claims 1-5, characterized in that, The system includes: A multi-source heterogeneous data acquisition module is used to acquire raw behavior logs of transaction modalities, device modalities, social modalities, and location modalities in real time; A cross-modal semantic encoding module is used to encode the raw behavior log into cross-modal alignable semantic feature vectors; The behavior consistency verification module is used to calculate the cross-modal behavior consistency probability between any two-modal behavior instances; The dynamic association network construction module is used to build and update a dynamic user behavior association network based on cross-modal behavior consistency probability. The depth graph clustering analysis module is used to identify clusters of potential risky behaviors in dynamic user behavior association networks; The risk pattern abstraction module is used to extract risk meta-events from clusters of risk behaviors; A dynamic risk graph engine for building, visualizing, and analyzing dynamic risk propagation graphs; An interpretable early warning generation module is used to output tiered early warnings and interpretive reports.

7. The system according to claim 6, characterized in that, The dynamic risk graph engine also includes a simulated attack module for: Receive abstracted risk meta-events; Based on the principles of generative adversarial networks, this study simulates how fraudsters can use known risk patterns to construct new and more covert collaborative attack sequences. The generated simulated attack sequences are injected into the consistency verification module for testing, in order to verify the system's defense capabilities and trigger enhanced learning updates to the risk meta-event library.

Images