Financial risk early warning method and system based on transaction behavior portrait

Abstract

The invention discloses a financial risk early warning method and system based on a transaction behavior portrait, and relates to the technical field of transaction data analysis, and the method comprises the steps: tracking a resource circulation path in real time, extracting the dynamic behavior characteristics of the resource circulation path before interruption, generating a resource fingerprint, and screening candidate associated resource circulation based on the resource fingerprint. The method comprises the following steps: establishing an internal resource interaction map, tracking a resource flow path in real time, performing logic splicing with the resource flow path to obtain a complete resource link, and if a closed loop is determined to be formed, triggering a risk early warning process and generating a resource link risk early warning report. A Hamming distance algorithm is utilized to match resource fingerprints with an external heterogeneous data source, closed-loop detection is performed on a complete resource link, quantitative scoring is performed in combination with indexes such as closed-loop hierarchy depth, total resource quantity and completion duration, and the resource backflow risk is effectively mined.

Description

Technical Field

[0001] This invention relates to the field of transaction data analysis technology, and in particular to a financial risk early warning method and system based on transaction behavior profiling. Background Technology

[0002] In recent years, in the current data interaction network, the flow of entities has shown significant characteristics of high frequency, cross-platform and heterogeneity. With the continuous expansion of business scenarios, data interaction between different systems is becoming more and more frequent, the amount of data is growing exponentially, and the formats and standards are different, making the analysis of cross-system flow behavior particularly difficult.

[0003] Existing technologies set fixed thresholds for transaction resource volume and frequency in a single dimension, lacking the ability to comprehensively profile the dynamic evolution characteristics of transaction behavior. When the transaction chain crosses the boundary of the internal system and enters the external network, due to the existence of data silos and the lack of effective correlation mechanisms between heterogeneous data sources, existing technologies cannot accurately match and logically splice the external resource flow at the point of link interruption using behavioral profiles. This makes it difficult to fully reconstruct complex resource flow paths, resulting in low efficiency and accuracy in identifying resource loops. It is also impossible to conduct in-depth quantitative analysis of loop risks and easily miss highly hidden resource backflow risks. Summary of the Invention

[0004] The technical problem solved by this invention is that setting fixed thresholds for transaction resource volume and frequency in a single dimension lacks the ability to comprehensively profile the dynamic evolution characteristics of transaction behavior. When the transaction chain crosses the boundary of the internal system and enters the external network, due to the existence of data silos and the lack of effective correlation mechanisms between heterogeneous data sources, existing technologies cannot accurately match and logically splice the external resource flow at the point of link interruption using behavioral profiles. This makes it difficult to fully restore the complex resource flow path, resulting in low efficiency and accuracy in identifying resource loops, an inability to conduct in-depth quantitative analysis of loop risks, and easy to miss highly hidden resource backflow risks.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a financial risk early warning method based on transaction behavior profiling, comprising the following steps: Step S1: Construct an internal resource interaction graph and track resource flow paths in real time based on the internal resource interaction graph; Step S2: When the resource flow path is interrupted, extract the dynamic behavior features of the resource flow path before the interruption and generate a resource fingerprint; Step S3: Obtain candidate resource flows, calculate the candidate resource fingerprints of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint respectively. Select candidate resource flows with Hamming distance less than a preset distance threshold as candidate associated resource flows. Logically concatenate the candidate associated resource flows with the resource flow paths to obtain a complete resource link. Step S4: Determine whether the complete resource link constitutes a closed loop. If it is determined to constitute a closed loop, trigger the risk warning process and generate a resource link risk warning report.

[0006] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, step S1 includes the following sub-steps: Step S101: Obtain internal resource transaction data within a first preset time period. The internal resource transaction data includes the resource transaction sender, the resource transaction amount, the resource transaction timestamp, and the resource transaction receiver. Step S102: Using the resource transaction sender and the resource transaction receiver as nodes and the resource transaction as directed edges, construct an internal resource interaction graph. The direction of the directed edge indicates the flow of resources from the resource transaction sender to the resource transaction receiver in a resource transaction; Step S103: Dynamically update the internal resource interaction graph based on the real-time generated internal resource transaction data, and identify and mark the resource flow paths in the updated internal resource interaction graph according to the tracking rules.

[0007] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, the tracking rules include: Track resource transactions whose single resource amount exceeds a preset resource amount threshold, and mark the internal resource interaction graph path of resource transactions that exceed the preset resource amount threshold.

[0008] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, step S2 includes the following sub-steps: Step S201: Real-time monitoring of each node in the resource flow path. When it is detected that one of the nodes in the resource flow path has not generated a directed edge pointing to a new node within a second preset time, the current node is regarded as an interruption node, and the resource flow path is determined to be interrupted at the interruption node. Step S202: Extract N consecutive resource transactions before the interruption node as analysis samples; Where N is an integer greater than or equal to 3; Step S203: Extract the dynamic behavior features of the analyzed sample and generate a resource fingerprint; The dynamic behavioral characteristics include: resource transaction resource quantity sequence, resource transaction time interval sequence, and time attributes of resource transaction timestamp.

[0009] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, the generation of resource fingerprints specifically includes: The dynamic behavior features are normalized to obtain the processed features; The processing features are concatenated into a feature string in a preset order, and a hash operation is performed on the feature string to generate a hash value of fixed length. The hash value is then used as a resource fingerprint.

[0010] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, step S3 includes the following sub-steps: Step S301: Take the transaction data in the preset external data source that has an account node association relationship with the interruption node of the resource flow path as candidate resource flow, calculate the candidate resource fingerprint of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint respectively. The preset external data sources include: cross-institutional transaction message database, cross-bank clearing system log data, and third-party payment institution transaction flow database; The account node association includes the account node name and account node number being the same for resource transactions; Step S302: Select candidate resource flows with a Hamming distance less than a preset distance threshold as candidate associated resource flows, and logically concatenate the candidate associated resource flows and resource flow paths at the interruption node to obtain a complete resource link.

[0011] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, the step of logically concatenating the candidate related resource transfers and resource transfer paths at the interruption node specifically includes: The candidate associated resource flows are subjected to time logic verification and numerical attribute consistency verification respectively. The candidate associated resource flow with the smallest Hamming distance among the candidate associated resource flows that pass both the time logic verification and numerical attribute consistency verification is selected as the final associated resource flow. Logically connect the end point of the resource flow path at the interruption node with the starting point of the final associated resource flow; The time logic verification includes: When the transaction time of the candidate associated resource transfer is greater than the transaction time of the last transaction in the resource transfer path, and the time difference between the transaction time of the candidate associated resource transfer and the transaction time of the last transaction in the resource transfer path is within a preset time range, the time logic verification is deemed to have passed. The consistency check of the numerical attributes includes: If the transaction resource volume of the candidate associated resource is the same as the transaction resource volume of the last transaction in the resource transfer path, then the numerical attribute consistency check is deemed to have passed.

[0012] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, step S4 includes the following sub-steps: Step S401: Select one of the nodes in the complete resource link as the starting tracking node, and use a graph traversal algorithm to track the resource transaction flow along the complete resource link; Step S402: During the tracking process, the account node information of the current node is monitored in real time. If the account node information of the current node is the same as the account node information of the starting tracking node, it is determined that the complete resource link constitutes a closed loop. The account node information includes the account node name and the account node number; If, after the tracking is completed, no node is found to have the same account node information as the starting tracking node, then it is determined that the complete resource link does not constitute a closed loop. Step S403: If it is determined that a closed loop has been formed, extract all nodes and directed edges that form the closed loop, record them as the closed loop path, and trigger the risk warning process to generate a resource link risk warning report.

[0013] As a preferred embodiment of the financial risk early warning method based on transaction behavior profiling described in this invention, the risk early warning triggering process includes: Calculate the risk quantification index of the closed loop, which includes the closed loop level depth, the total closed loop resource amount, and the closed loop completion time; Based on the aforementioned risk quantification indicators, a comprehensive score is obtained through weighted calculation, and the risk level of the risk warning is assessed based on the comprehensive score to generate a resource link risk warning report. The risk levels include: low risk, medium risk, and high risk; The risk warning report includes: the assessed risk level, a visualized topology diagram of the closed-loop path, information on resource trading entities in the closed loop, resource fingerprints, and specific values ​​of risk quantification indicators; The formula for calculating the comprehensive score through weighted calculation is as follows: ; in, This indicates the overall score. This indicates the preset first weight coefficient. This indicates a preset second weighting coefficient. This indicates a preset third weighting coefficient. Indicates the depth of the closed-loop hierarchy. This represents the total amount of resources in the closed loop. Indicates the time required to complete the closed loop. A standardized baseline value representing the depth of the closed-loop hierarchy. A standardized benchmark value representing the total closed-loop resource quantity. A standardized baseline value representing the time required to complete a closed loop; The risk level assessment of the risk warning based on the comprehensive score includes: When the overall score is greater than the first threshold, it is classified as high-risk; When the comprehensive score is between the first threshold and the second threshold, it is determined to be of medium risk; When the overall score is less than the second threshold, it is judged as a low-risk level.

[0014] A financial risk early warning system based on transaction behavior profiling is applied to a financial risk early warning method based on transaction behavior profiling, including a tracking module, a generation module, a stitching module, and an early warning module. The tracking module is used to construct an internal resource interaction graph and track the resource flow path in real time based on the internal resource interaction graph. The generation module is used to extract the dynamic behavior features of the resource flow path before the interruption and generate a resource fingerprint when the resource flow path is interrupted. The splicing module is used to obtain candidate resource flows, calculate the candidate resource fingerprints of each candidate resource flow, calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint, filter candidate resource flows with Hamming distance less than a preset distance threshold as candidate associated resource flows, and logically splice the candidate associated resource flows with the resource flow path to obtain a complete resource link. The early warning module is used to determine whether the complete resource link constitutes a closed loop. If it is determined to constitute a closed loop, a risk early warning process is triggered to generate a resource link risk early warning report.

[0015] The beneficial effects of this invention are as follows: By constructing an internal resource interaction graph and tracking resource flow paths in real time, this invention extracts dynamic behavioral features to generate resource fingerprints when the path is interrupted, thus achieving a comprehensive profile of the dynamic evolution characteristics of transaction behavior. By using the Hamming distance algorithm to match resource fingerprints with external heterogeneous data sources and then concatenating them after logical verification, this invention effectively breaks down data silos and completely restores complex resource flow paths that cross system boundaries. By performing closed-loop detection on complete resource links and combining indicators such as closed-loop depth, total resource volume, and completion time for quantitative scoring, this invention significantly improves the efficiency and accuracy of resource closed-loop identification and effectively uncovers the risk of resource backflow. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the basic process of a financial risk early warning method based on transaction behavior profiling, provided as an embodiment of the present invention.

[0017] Figure 2 This is a basic flowchart of a financial risk early warning system based on transaction behavior profiling, provided as an embodiment of the present invention. Detailed Implementation

[0018] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0019] Reference Figure 1 As an embodiment of the present invention, a financial risk early warning method based on transaction behavior profiling is provided, comprising the following steps: Step S1: Construct an internal resource interaction graph and track resource flow paths in real time based on the internal resource interaction graph; Step S2: When the resource flow path is interrupted, extract the dynamic behavior features of the resource flow path before the interruption and generate a resource fingerprint; Step S3: Obtain candidate resource flows, calculate the candidate resource fingerprints of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint. Select candidate resource flows whose Hamming distance is less than a preset distance threshold as candidate associated resource flows. Logically concatenate the candidate associated resource flows with the resource flow paths to obtain the complete resource link. Step S4: Determine whether the complete resource link constitutes a closed loop. If it is determined to constitute a closed loop, trigger the risk warning process and generate a resource link risk warning report.

[0020] A risk warning framework based on resource fingerprinting and logical splicing was constructed. By building an internal resource interaction graph, the framework enables real-time tracking of resource flow paths. When an interruption in the resource flow path is detected, a unique resource fingerprint is generated using dynamic behavioral features. Combined with the Hamming distance calculation algorithm, the framework accurately matches external resource flows in massive amounts of data, realizing logical association and splicing between different data sources. By using behavioral profiling technology, previously isolated transaction fragments are reconnected into complete resource links. This framework can accurately identify hidden resource loops across institutions and platforms, significantly improving the ability to fully reconstruct risk transmission paths in complex resource networks and effectively addressing regulatory blind spots where resource flows shift to external areas.

[0021] Step S1 includes the following sub-steps: Step S101: Obtain internal resource transaction data within a first preset time period. The internal resource transaction data includes the resource transaction sender, the resource transaction quantity, the resource transaction timestamp, and the resource transaction receiver. Step S102: Construct an internal resource interaction graph with the resource transaction sender and the resource transaction receiver as nodes and the resource transaction as directed edges. The direction of a directed edge indicates the flow of resources from the resource transaction sender to the resource transaction receiver in a resource transaction. Step S103: Dynamically update the internal resource interaction graph based on the real-time generated internal resource transaction data, and identify and mark the resource flow paths in the updated internal resource interaction graph according to the tracking rules.

[0022] It should be noted that in this application, data resources represent transaction funds, and the corresponding resource transfer path represents the flow of funds.

[0023] The first preset time period is set at 30 days. The basis for this setting is to cover a complete monthly financial settlement cycle, ensuring that short-term cyclical transactions and complex resource closed-loop networks with time intervals can be captured, while balancing the computational efficiency of data and the storage overhead of graph construction.

[0024] The internal resource interaction graph is constructed based on all internal transfer records within a first preset time period. The data fields of the internal transfer records include resource transaction sender ID, resource transaction receiver ID, resource transaction amount, and resource transaction timestamp accurate to milliseconds.

[0025] In the internal resource interaction graph structure, each bank account node or entity is modeled as an independent node, and each resource transaction is modeled as a directed edge from the sender to the receiver, with the weight of the edge corresponding to the amount of transaction resources.

[0026] The internal resource interaction graph is dynamically updated using a streaming computing architecture. Once new internal transaction data is generated, the corresponding nodes and edges are immediately instantiated in the graph, and the topology is refreshed in real time.

[0027] A dynamically updated internal resource interaction graph is introduced. By acquiring internal resource transaction data in real time within a first preset time period, and using the resource transaction sender and receiver as nodes and resource transactions as directed edges, a topology structure that reflects the resource flow turning relationship is constructed. At the same time, the graph is continuously updated and path marking is performed based on the real-time data, ensuring the timeliness and accuracy of resource flow turning tracking. Even when faced with massive high-concurrency transaction data, it can still quickly identify and mark resource flow paths that meet the tracking rules, overcoming the shortcomings of static data processing methods with slow response. This provides a solid and highly timely data foundation for subsequent risk analysis, effectively responding to the challenge of rapidly changing resource flow turning and ensuring the real-time response speed of risk monitoring.

[0028] Tracking rules include: Track resource transactions whose single resource amount exceeds a preset resource amount threshold, and mark the internal resource interaction graph path of resource transactions that exceed the preset resource amount threshold.

[0029] The preset resource threshold is set at RMB 500,000, which is determined based on the statistical distribution of large transactions of the institution over the past year and the reporting standards for large transactions in anti-money laundering regulations.

[0030] The tracking rules target resource transactions exceeding 500,000 yuan per transaction. When processing massive amounts of transaction data, these large transactions are prioritized for loading into memory for path analysis. This ignores 90% of low-risk, small-value retail transactions, significantly saving CPU computing power and ensuring that the risk control system focuses on the most critical resource flow leads. Specific tracking rules were set for large-value resource transactions. Key monitoring targets were screened by pre-setting resource volume thresholds. Only resource transactions with a single resource volume exceeding the threshold were marked with path markers. This optimized the allocation of computing resources, improved the capture rate of high-risk behaviors, and reduced the interference of invalid data generated by a large number of low-risk small-value transactions by focusing on key resource flows. It can concentrate core computing power and storage resources on resource paths most likely to involve financial risks. Thus, while ensuring monitoring coverage, it significantly improved the targeting and processing efficiency of risk identification, avoided resource waste, and achieved the best match between computing resources and risk value.

[0031] Step S2 includes the following sub-steps: Step S201: Real-time monitoring of each node in the resource flow path. When it is detected that one of the nodes in the resource flow path has not generated a directed edge pointing to a new node within a second preset time, the current node is taken as the interruption node, and the resource flow path is determined to be interrupted at the interruption node. Step S202: Extract N consecutive resource transactions before the interruption node as an analysis sample; Where N is an integer greater than or equal to 3; Step S203: Extract and analyze the dynamic behavior features of the sample and generate resource fingerprints; Dynamic behavioral characteristics include: resource transaction resource quantity sequence, resource transaction time interval sequence, and time attribute of resource transaction timestamp.

[0032] Extracting and analyzing the dynamic behavioral characteristics of samples specifically includes the following steps: Iterate through each transaction record in the sample, extract the transaction resource quantity field in chronological order, and construct a resource transaction resource quantity sequence.

[0033] Calculate the difference between the timestamps of two adjacent transaction records, map the timestamp difference to a time value, and construct a resource transaction time interval sequence; The timestamp of each transaction record is parsed and mapped to discrete time attribute values, including the number of hours, weekdays, and whether it is a working day or a non-working day.

[0034] N=5, and continuous trading was chosen to capture the inertial characteristics and regularity of resource flow.

[0035] The second preset time is set to 24 hours. The basis for this setting is that, taking into account the clearing time of the interbank transfer system and the reasonable delays in business processing, 24 hours is used as the threshold for determining the interruption of the resource flow path. This not only excludes normal resource delays in transit, but also promptly identifies risk nodes where the resource flow is abnormally terminated.

[0036] The specific process for interruption detection and fingerprint generation is defined. A dynamic feature extraction mechanism based on time windows and continuous samples is adopted. Interruption is determined by monitoring whether a node generates a directed edge pointing to a new node within a second preset time. Multiple consecutive transactions before the interruption node are extracted as analysis samples to extract multi-dimensional dynamic behavioral features and construct a behavioral profile with a time dimension. This can keenly capture the rhythm and habitual features of resource flow, making the generated resource fingerprint highly recognizable. It effectively prevents misjudgment caused by abnormal fluctuations in a single transaction, ensures that the fingerprint features can truly and comprehensively reflect the behavioral patterns of the resource subject, and greatly improves the robustness of risk feature extraction.

[0037] Generating resource fingerprints specifically includes: The dynamic behavior features are normalized to obtain the processed features; The processing features are concatenated into a feature string in a preset order, and a hash operation is performed on the feature string to generate a hash value of fixed length. The hash value is then used as a resource fingerprint.

[0038] The normalization process uses the Min-Max standardization algorithm to linearly map the processing feature values ​​of different units to the range of 0 to 1, eliminating the calculation bias caused by the difference in resource quantity units and time units.

[0039] The MD5 message digest algorithm is used to perform hash operations on the feature string to generate a 128-bit binary hash value. This fixed-length hash value is defined as the resource fingerprint. It not only compresses the data storage space, but also transforms complex dynamic behavior characteristics into standardized digital codes that are easy to compare quickly.

[0040] The default order is: resource transaction quantity sequence first, resource transaction time interval sequence in the middle, and resource transaction timestamp time attribute last. The basis for this setting is that resource quantity is usually the most direct risk feature, and prioritizing it helps to improve the distinguishability of hash operation. The time interval in the middle is used to reflect the transaction rhythm, and the time attribute is placed last as an auxiliary identification feature. This arrangement not only conforms to the weight analysis of business logic, but also ensures the stability of feature strings.

[0041] Feature data is normalized and hash values ​​are generated as resource fingerprints. By normalizing multi-dimensional dynamic behavioral features, differences between data of different dimensions are eliminated. The features are concatenated into feature strings in a preset order and hashed to generate fixed-length hash values. Complex transaction features are transformed into standardized digital fingerprints, making rapid matching of massive amounts of external data possible, reducing data storage overhead, providing a standardized data foundation for subsequent Hamming distance calculation, significantly improving the retrieval speed and matching accuracy of cross-platform and cross-institutional resource associations, providing technical support for real-time monitoring of large-scale resource networks, and accelerating the risk identification process.

[0042] Step S3 includes the following sub-steps: Step S301: Take the transaction data in the preset external data source that has an account node association relationship with the interruption node of the resource flow path as candidate resource flow, calculate the candidate resource fingerprint of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint respectively. Preset external data sources include: cross-institutional transaction message database, cross-bank clearing system log data, and third-party payment institution transaction flow database; Account node association includes the account node name and account node number being the same for resource transactions; Step S302: Select candidate resource flows with a Hamming distance less than a preset distance threshold as candidate associated resource flows, and logically concatenate the candidate associated resource flows with the resource flow paths at the interruption nodes to obtain a complete resource link.

[0043] External data sources are pre-connected via standard API interfaces.

[0044] The inter-institutional transaction message database primarily stores transaction message records transmitted between banks and financial institutions through standard networks. These transaction message records include key information such as remittance instructions, account node information, transaction resource volume, and settlement status, and can fully reflect the original communication process and final execution results of inter-institutional resource allocation.

[0045] Interbank clearing system log data consists of detailed transaction logs generated by the core payment clearing system operated by the clearing institution. These detailed transaction logs cover the clearing details of each interbank transfer, including the initiating bank, receiving bank, clearing timestamp, clearing resource amount, and clearing status. They are the most authoritative data source for verifying the actual arrival of interbank resources.

[0046] The third-party payment institution transaction database integrates raw transaction data from third-party payment platforms. This raw transaction data records details of all resource operations performed by users through payment account nodes, such as top-ups, withdrawals, transfers, and consumption. It includes information on the account nodes of both parties, the amount of transaction resources, the transaction time, and the channel type, and is used to track the flow of resources through non-bank channels.

[0047] The preset distance threshold is set to 5 bits, based on the 128-bit Hamming distance calculation space. This allows for a slight difference of 4% in fingerprints while strictly controlling the upper limit of similarity to ensure that the selected candidate resources are highly consistent in their behavioral patterns and avoid mismatches.

[0048] By integrating external data and connecting internal tracking with external databases through account node relationships, and by calculating the Hamming distance between the candidate resource fingerprints of each candidate resource transfer and the resource fingerprints before the interruption, qualified candidate associated resource transfers are selected. This fills the technical gap in cross-network resource tracking, accurately pinpoints the specific destination of resources after they leave the internal system, solves the problem of resource link breakage caused by data source fragmentation, provides rich and accurate data support for fully reconstructing complex resource transfer paths, greatly expands the coverage of risk monitoring, and realizes full-network tracking of resource transfers across systems.

[0049] The logical concatenation of candidate associated resource transfers and resource transfer paths at the interruption node specifically includes: Perform time logic verification and numerical attribute consistency verification on the candidate associated resource flows respectively. Select the candidate associated resource flow with the smallest Hamming distance among the candidate associated resource flows that pass both the time logic verification and the numerical attribute consistency verification as the final associated resource flow. Logically connect the endpoint of the resource flow path at the interruption node to the starting point of the final associated resource flow; Time logic verification includes: When the transaction time of the candidate associated resource transfer is greater than the transaction time of the last transaction in the resource transfer path, and the time difference between the transaction time of the candidate associated resource transfer and the transaction time of the last transaction in the resource transfer path is within a preset time range, the time logic verification is deemed to have passed. Numerical attribute consistency checks include: If the transaction resource volume of the candidate associated resource transfer is the same as the transaction resource volume of the last transaction in the resource transfer path, then the numerical attribute consistency check is deemed to have passed.

[0050] The preset time range is set to 2 hours. This setting is based on the business timeliness logic of normal large-amount resource transfers and interbank clearing, excluding long delays caused by non-working days or system failures, and allowing sufficient buffer time for the reasonable flow of resources between different account nodes, so as to avoid accidentally cutting off the real connection link due to the time window being too narrow.

[0051] A dual filtering mechanism, consisting of time logic verification and numerical attribute consistency verification, has been added. After screening candidate resource flows with a Hamming distance less than a preset threshold, the flow of candidate related resources is further subjected to rigorous logical verification. This includes verifying whether the transaction occurrence time is within a preset time range and whether the transaction resource volume is consistent. This ensures the authenticity and rigor of the spliced ​​link, eliminates interference items with similar characteristics but no actual relevance to the greatest extent, and guarantees the high reliability of the restored complete resource link in terms of business logic and time series. This ensures that the final spliced ​​complete resource link can truly reflect the resource flow trajectory, improves the accuracy of risk analysis, reduces the false alarm rate, and enhances the credibility of the risk control system.

[0052] Step S4 includes the following sub-steps: Step S401: Select one of the nodes in the complete resource link as the starting tracking node, and use the graph traversal algorithm to track the resource transaction flow along the complete resource link; Step S402: During the tracking process, monitor the account node information of the current node in real time. If the account node information of the current node is the same as the account node information of the starting tracking node, it is determined that the complete resource link constitutes a closed loop. Account node information includes the account node name and account node number; If, after the tracking is completed, no node is found to have the same account node information as the starting tracking node, it is determined that the complete resource link does not constitute a closed loop. Step S403: If it is determined that a closed loop has been formed, extract all nodes and directed edges that form the closed loop, record them as the closed loop path, and trigger the risk warning process to generate a resource link risk warning report.

[0053] The graph traversal algorithm employs a depth-first search strategy, maintaining a list of visited nodes to prevent getting stuck in infinite loops in complex networks. Tracing begins from any node in the complete resource link and proceeds layer by layer along the resource flow directions indicated by the directed edges. At each step of the tracing, the account node name and account number of the current node are extracted in real time and compared with the account node information of the starting node. Once it is detected that the current node is completely consistent with the starting node, it is confirmed that the resource has completed a complete closed loop flow, the tracing stops immediately, and the path is output. This mechanism can effectively identify the hidden behavior of resources returning to the starting point after multiple transfers.

[0054] A graph traversal algorithm is employed for loop closure detection. By selecting one node in the complete resource link as the starting tracking node, the graph traversal algorithm is used to perform deep tracking along the resource transaction flow, and the consistency between the account node information of the current node and the account node information of the starting tracking node is monitored in real time. This method can accurately identify the closed-loop structure of the final flow of resources to the starting point from a complex network of resource links, effectively overcoming the difficulties of complex node relationships and difficulty in tracing in long path tracking. It can automatically and efficiently discover resource return paths, providing a direct and powerful basis for identifying illegal activities through resource return, and can accurately combat money laundering, illegal fundraising and other illegal and criminal activities involving resource return.

[0055] The risk warning triggering process includes: Calculate the risk quantification indicators for the closed loop, which include the closed loop level depth, the total resources required for the closed loop, and the closed loop completion time. Based on the risk quantification indicators, a comprehensive score is obtained through weighted calculation, and the risk level of the risk warning is assessed based on the comprehensive score to generate a resource link risk warning report. Risk levels are categorized as: low risk, medium risk, and high risk. The risk warning report includes: the assessed risk level, a visualized topology diagram of the closed-loop path, information on resource trading entities in the closed loop, resource fingerprints, and specific values ​​of risk quantification indicators; The visual topology diagram of the closed-loop path is dynamically generated using a graphics engine. The nodes in the diagram represent the main entities involved in resource transactions, and the edges represent the directions of resource flow. The topology diagram clearly shows the complete closed-loop structure of resources flowing out from the starting node, passing through multiple intermediate nodes, and finally flowing back to the starting node. Each node in the diagram is labeled with the account node name and the amount of resources traded. The thickness of the edge lines corresponds to the size of the amount of resources traded. The entire path is colored according to the risk level. Closed-loop paths with high risk are displayed in striking red, closed-loop paths with medium risk are displayed in orange, and closed-loop paths with low risk are displayed in blue. This intuitive visualization allows risk control personnel to quickly grasp the overall picture of resource flow and risk points.

[0056] The formula for calculating the overall score through weighted calculation is as follows: ; in, This indicates the overall score. This indicates the preset first weight coefficient. This indicates a preset second weighting coefficient. This indicates a preset third weighting coefficient. Indicates the depth of the closed-loop hierarchy. This represents the total amount of resources in the closed loop. Indicates the time required to complete the closed loop. A standardized baseline value representing the depth of the closed-loop hierarchy. A standardized benchmark value representing the total closed-loop resource quantity. A standardized baseline value representing the time required to complete a closed loop; The risk level assessment for risk warnings based on a comprehensive score includes: When the overall score is greater than the first threshold, it is classified as high risk; When the comprehensive score is between the first and second thresholds, it is judged as medium risk; When the overall score is less than the second threshold, it is judged as low-risk.

[0057] The default first weight coefficient is set to 0.3. The basis for this setting is that the depth of the closed-loop hierarchy reflects the complexity and concealment of resource flow. Although the deeper the hierarchy, the higher the risk, the direct impact on the final resource loss is relatively small compared to the amount of resources and time. Therefore, it is given a weight that is slightly lower than medium.

[0058] The second weighting coefficient is set to 0.5. The reason for this setting is that the total amount of closed-loop resources is the most critical indicator for measuring risk. The size of the resources directly determines the potential scale of financial losses and the severity of violations. Therefore, it is given the highest weight in the comprehensive score.

[0059] The default third weight coefficient is set to 0.2. The basis for this setting is that the closed-loop completion time reflects the speed of resource recovery and the length of the crime cycle. It is an indicator that helps to judge the nature of risk, but its importance is lower than that of resource quantity and level, so it is given a relatively low weight.

[0060] The value is 10. The value is set at 1 million yuan. The values ​​are taken over a 24-hour period. These benchmark values ​​are determined based on the statistical average of historical risk cases. The first threshold is set at 0.8, and the second threshold is set at 0.4. The calculated comprehensive score... When the value is greater than 0.8, it is assessed as a high-risk level and triggers the highest-level red alert. A value between 0.4 and 0.8 is considered a medium risk level. When the value is less than 0.4, it is assessed as a low-risk level. A risk warning report is then automatically generated based on the level, which includes a closed-loop visual topology diagram and the specific values ​​of each quantitative indicator.

[0061] The closed-loop level depth is calculated by counting the total number of resource transaction entities along the resource flow path that constitutes the closed loop.

[0062] The total resource volume in the closed loop is calculated by either obtaining the maximum resource volume of a single resource transaction in the closed loop path, or by calculating the sum of the resource volumes of all resource transactions in the closed loop path.

[0063] The closed-loop completion time is calculated as follows: the time difference between the occurrence time of the first resource transaction and the occurrence time of the last resource transaction in the closed-loop path.

[0064] A quantitative scoring model was constructed, which includes the depth of the closed-loop hierarchy, the total amount of resources in the closed loop, and the completion time of the closed loop. The three key indicators are weighted by preset weight coefficients to obtain a scientific comprehensive score. Based on the score results, risk levels are divided, and a detailed risk warning report is generated, which includes a visualized topology map, transaction entity information, and quantitative risk indicator values. This multi-dimensional quantitative analysis mechanism not only achieves accurate measurement of closed-loop risk but also intuitively reflects the severity of risk, helping risk control personnel to quickly understand the risk situation. It provides scientific and quantitative data support for subsequent risk disposal and decision-making, upgrading risk management from qualitative judgment to quantitative analysis, significantly improving the scientificity and effectiveness of risk control decisions, and realizing intelligent and refined risk warning.

[0065] Reference Figure 2 This is another embodiment of the present invention. Unlike the first embodiment, this embodiment provides a financial risk early warning system based on transaction behavior profiles, including a tracking module, a generation module, a splicing module, and an early warning module. The tracking module is used to build an internal resource interaction graph and track resource flow paths in real time based on the internal resource interaction graph; The generation module is used to extract the dynamic behavior characteristics of the resource flow path before the interruption and generate a resource fingerprint when the resource flow path is interrupted. The splicing module is used to obtain candidate resource flows, calculate the candidate resource fingerprints of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint. Candidate resource flows with a Hamming distance less than a preset distance threshold are selected as candidate associated resource flows. The candidate associated resource flows and the resource flow paths are logically spliced ​​together to obtain the complete resource link. The early warning module is used to determine whether the complete resource link forms a closed loop. If it is determined to form a closed loop, the risk early warning process is triggered to generate a resource link risk early warning report.

[0066] This invention constructs an internal resource interaction graph and tracks resource flow paths in real time. When a path is interrupted, dynamic behavioral features are extracted to generate resource fingerprints, achieving a comprehensive profile of the dynamic evolution characteristics of transaction behavior. The Hamming distance algorithm is used to match resource fingerprints with external heterogeneous data sources, and the fingerprints are then concatenated after logical verification. This effectively breaks down data silos and fully reconstructs complex resource flow paths that cross system boundaries. By performing closed-loop detection on the complete resource link and combining indicators such as closed-loop depth, total resource volume, and completion time for quantitative scoring, the efficiency and accuracy of resource closed-loop identification are significantly improved, effectively uncovering the risk of resource backflow.

[0067] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0068] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A financial risk early warning method based on transaction behavior profiling, characterized in that, Includes the following steps: Step S1: Construct an internal resource interaction graph and track resource flow paths in real time based on the internal resource interaction graph; Step S2: When the resource flow path is interrupted, extract the dynamic behavior features of the resource flow path before the interruption and generate a resource fingerprint; Step S3: Obtain candidate resource flows, calculate the candidate resource fingerprints of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint respectively. Select candidate resource flows with Hamming distance less than a preset distance threshold as candidate associated resource flows. Logically concatenate the candidate associated resource flows with the resource flow paths to obtain a complete resource link. Step S4: Determine whether the complete resource link constitutes a closed loop. If it is determined to constitute a closed loop, trigger the risk warning process and generate a resource link risk warning report.

2. The financial risk early warning method based on transaction behavior profiling as described in claim 1, characterized in that, Step S1 includes the following sub-steps: Step S101: Obtain internal resource transaction data within a first preset time period. The internal resource transaction data includes the resource transaction sender, the resource transaction amount, the resource transaction timestamp, and the resource transaction receiver. Step S102: Using the resource transaction sender and the resource transaction receiver as nodes and the resource transaction as directed edges, construct an internal resource interaction graph. The direction of the directed edge indicates the flow of resources from the resource transaction sender to the resource transaction receiver in a resource transaction; Step S103: Dynamically update the internal resource interaction graph based on the real-time generated internal resource transaction data, and identify and mark the resource flow paths in the updated internal resource interaction graph according to the tracking rules.

3. The financial risk early warning method based on transaction behavior profiling as described in claim 2, characterized in that, The tracking rules include: Track resource transactions whose single resource amount exceeds a preset resource amount threshold, and mark the internal resource interaction graph path of resource transactions that exceed the preset resource amount threshold.

4. The financial risk early warning method based on transaction behavior profiling as described in claim 3, characterized in that, Step S2 includes the following sub-steps: Step S201: Real-time monitoring of each node in the resource flow path. When it is detected that one of the nodes in the resource flow path has not generated a directed edge pointing to a new node within a second preset time, the current node is regarded as an interruption node, and the resource flow path is determined to be interrupted at the interruption node. Step S202: Extract N consecutive resource transactions before the interruption node as analysis samples; Where N is an integer greater than or equal to 3; Step S203: Extract the dynamic behavior features of the analyzed sample and generate a resource fingerprint; The dynamic behavioral characteristics include: resource transaction resource quantity sequence, resource transaction time interval sequence, and time attributes of resource transaction timestamp.

5. The financial risk early warning method based on transaction behavior profiling as described in claim 4, characterized in that, The generated resource fingerprint specifically includes: The dynamic behavior features are normalized to obtain the processed features; The processing features are concatenated into a feature string in a preset order, and a hash operation is performed on the feature string to generate a hash value of fixed length. The hash value is then used as a resource fingerprint.

6. The financial risk early warning method based on transaction behavior profiling as described in claim 5, characterized in that, Step S3 includes the following sub-steps: Step S301: Take the transaction data in the preset external data source that has an account node association relationship with the interruption node of the resource flow path as candidate resource flow, calculate the candidate resource fingerprint of each candidate resource flow, and calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint respectively. The preset external data sources include: cross-institutional transaction message database, cross-bank clearing system log data, and third-party payment institution transaction flow database; The account node association includes the account node name and account node number being the same for resource transactions; Step S302: Select candidate resource flows with a Hamming distance less than a preset distance threshold as candidate associated resource flows, and logically concatenate the candidate associated resource flows and resource flow paths at the interruption node to obtain a complete resource link.

7. The financial risk early warning method based on transaction behavior profiling as described in claim 6, characterized in that, The step of logically concatenating the candidate associated resource transfer and the resource transfer path at the interruption node specifically includes: The candidate associated resource flows are subjected to time logic verification and numerical attribute consistency verification respectively. The candidate associated resource flow with the smallest Hamming distance among the candidate associated resource flows that pass both the time logic verification and numerical attribute consistency verification is selected as the final associated resource flow. Logically connect the end point of the resource flow path at the interruption node with the starting point of the final associated resource flow; The time logic verification includes: When the transaction time of the candidate associated resource transfer is greater than the transaction time of the last transaction in the resource transfer path, and the time difference between the transaction time of the candidate associated resource transfer and the transaction time of the last transaction in the resource transfer path is within a preset time range, the time logic verification is deemed to have passed. The consistency check of the numerical attributes includes: If the transaction resource volume of the candidate associated resource is the same as the transaction resource volume of the last transaction in the resource transfer path, then the numerical attribute consistency check is deemed to have passed.

8. The financial risk early warning method based on transaction behavior profiling as described in claim 7, characterized in that, Step S4 includes the following sub-steps: Step S401: Select one of the nodes in the complete resource link as the starting tracking node, and use a graph traversal algorithm to track the resource transaction flow along the complete resource link; Step S402: During the tracking process, the account node information of the current node is monitored in real time. If the account node information of the current node is the same as the account node information of the starting tracking node, it is determined that the complete resource link constitutes a closed loop. The account node information includes the account node name and the account node number; If, after the tracking is completed, no node is found to have the same account node information as the starting tracking node, then it is determined that the complete resource link does not constitute a closed loop. Step S403: If it is determined that a closed loop has been formed, extract all nodes and directed edges that form the closed loop, record them as the closed loop path, and trigger the risk warning process to generate a resource link risk warning report.

9. The financial risk early warning method based on transaction behavior profiling as described in claim 8, characterized in that, The risk warning triggering process includes: Calculate the risk quantification index of the closed loop, which includes the closed loop level depth, the total closed loop resource amount, and the closed loop completion time; Based on the aforementioned risk quantification indicators, a comprehensive score is obtained through weighted calculation, and the risk level of the risk warning is assessed based on the comprehensive score to generate a resource link risk warning report. The risk levels include: low risk, medium risk, and high risk; The risk warning report includes: the assessed risk level, a visualized topology diagram of the closed-loop path, information on resource trading entities in the closed loop, resource fingerprints, and specific values ​​of risk quantification indicators; The formula for calculating the comprehensive score through weighted calculation is as follows: ； in, This indicates the overall score. This indicates the preset first weight coefficient. This indicates a preset second weighting coefficient. This indicates a preset third weighting coefficient. Indicates the depth of the closed-loop hierarchy. This represents the total amount of resources in the closed loop. Indicates the time required to complete the closed loop. A standardized baseline value representing the depth of the closed-loop hierarchy. A standardized benchmark value representing the total closed-loop resource quantity. A standardized baseline value representing the time required to complete a closed loop; The risk level assessment of the risk warning based on the comprehensive score includes: When the overall score is greater than the first threshold, it is classified as high-risk; When the comprehensive score is between the first threshold and the second threshold, it is determined to be of medium risk; When the overall score is less than the second threshold, it is judged as a low-risk level.

10. A financial risk early warning system based on transaction behavior profiling, applied in a financial risk early warning method based on transaction behavior profiling as described in any one of claims 1-9, characterized in that, It includes a tracking module, a generation module, a stitching module, and an early warning module; The tracking module is used to construct an internal resource interaction graph and track the resource flow path in real time based on the internal resource interaction graph. The generation module is used to extract the dynamic behavior features of the resource flow path before the interruption and generate a resource fingerprint when the resource flow path is interrupted. The splicing module is used to obtain candidate resource flows, calculate the candidate resource fingerprints of each candidate resource flow, calculate the Hamming distance between each candidate resource fingerprint and the resource fingerprint, filter candidate resource flows with Hamming distance less than a preset distance threshold as candidate associated resource flows, and logically splice the candidate associated resource flows with the resource flow path to obtain a complete resource link. The early warning module is used to determine whether the complete resource link constitutes a closed loop. If it is determined to constitute a closed loop, a risk early warning process is triggered to generate a resource link risk early warning report.

Images