Transaction data processing method and device, storage medium and program product

Abstract

The invention provides a transaction data processing method and device, a storage medium and a program product, and relates to the field of financial science and technology. The method comprises the following steps: acquiring transaction data and full-duty survey data of N target objects; on the basis of an attention mechanism, anomaly detection is carried out on the transaction data through an anomaly detection model, a transaction anomaly detection result is obtained, and the transaction anomaly detection result is used for indicating the transaction anomaly score value of each target object; constructing a plurality of triads based on a relationship among entities in the diliary investigation data; inputting the plurality of triads into the link prediction model, and outputting an entity vector set: fusing the transaction anomaly detection result and the entity vector set to obtain a target fusion vector; and determining a transaction risk assessment result of each target object based on the target fusion vector. Through the transaction risk assessment method and device, the problem of inaccurate transaction risk assessment result caused by poor feature capture effect in the transaction risk assessment process in related technologies is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, storage medium, and program product for processing transaction data. Background Technology

[0002] Customer due diligence, as a core component of financial institutions' compliance efforts, is becoming increasingly important. With the rapid development of big data and artificial intelligence technologies, the field of customer transaction behavior detection is evolving towards multi-dimensional data fusion, intelligent dynamic monitoring, and real-time early warning. However, customer due diligence in these technologies relies on the collection of static information and manual analysis, which can only meet basic compliance requirements. In the complex and ever-changing cross-border financial environment, these technologies are showing their limitations. For example, the AI-based methods for detecting anomalies and assessing risks in financial transactions suffer from difficulties in high-dimensional feature mining, temporal relationship learning, data relationship learning, and cross-domain knowledge fusion, making it challenging to form a complete and effective customer profile identification system. This results in low accuracy in identifying transaction risks and limited dynamic monitoring capabilities.

[0003] There is currently no effective solution to the problem of inaccurate transaction risk assessment results due to poor feature capture in the transaction risk assessment process of related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, storage medium, and program product for processing transaction data, so as to at least solve the problem that the feature capture effect in the transaction risk assessment process in related technologies is poor, resulting in inaccurate transaction risk assessment results.

[0005] To achieve the above objectives, according to one aspect of this application, a method for processing transaction data is provided. The method includes: acquiring transaction data and due diligence data for N target objects, where N is a positive integer; performing anomaly detection on the transaction data using an anomaly detection model based on an attention mechanism to obtain a transaction anomaly detection result, wherein the transaction anomaly detection result is used to indicate a transaction anomaly score for each target object; constructing multiple triples based on the relationships between entities in the due diligence data; inputting the multiple triples into a link prediction model to output a set of entity vectors, wherein the link prediction model is used to predict the vectorized representation of entities and relationships using embedding vector technology; fusing the transaction anomaly detection result and the set of entity vectors to obtain a target fusion vector; and determining a transaction risk assessment result for each target object based on the target fusion vector.

[0006] Furthermore, based on the attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data to obtain transaction anomaly detection results. This includes: preprocessing the transaction data to obtain processed transaction data; constructing a topological structure of counterparties based on the processed transaction data to obtain a counterparty topology, wherein the counterparty includes: any pair of two target objects with a transaction relationship; and determining the transaction anomaly detection results based on the attention mechanism, the processed transaction data, and the counterparty topology using the anomaly detection model.

[0007] Furthermore, based on the attention mechanism, the processed transaction data, and the counterparty topology, the anomaly detection model determines the transaction anomaly detection result, including: embedding the processed transaction data into vectors to obtain N embedding vectors; extracting features from the counterparty topology to obtain extraction results; aggregating the N embedding vectors and the extraction results based on the attention mechanism to obtain an aggregation result; and inputting the aggregation result into the anomaly detection model to obtain the transaction anomaly detection result, wherein the anomaly detection model includes a neural network model with an encoder-decoder structure.

[0008] Furthermore, the target fusion vector includes: a fusion feature vector associated with each target object. Based on the target fusion vector, determining the transaction risk assessment result for each target object includes: obtaining the fusion feature vector of an abnormal object, wherein the abnormal object includes: an object with transaction risk; calculating the similarity between the fusion feature vector of each target object and the fusion feature vector of the abnormal object to obtain the target similarity between each target object and the abnormal object; and determining the transaction risk assessment result for each target object based on the target similarity between each target object and the abnormal object.

[0009] Further, based on the target similarity between each target object and the abnormal object, the transaction risk assessment result of each target object is determined, including: comparing the target similarity between each target object and the abnormal object with a preset similarity threshold to obtain a comparison result; scoring the transaction risk of each target object based on the target similarity between each target object and the abnormal object to obtain a transaction risk score value for each target object; and determining the transaction risk assessment result of each target object based on the comparison result and the transaction risk score value for each target object.

[0010] Furthermore, the link prediction model is obtained through the following methods: acquiring multiple historical due diligence data, wherein the historical due diligence data includes due diligence data of multiple users generated during historical time periods; constructing multiple feature knowledge domains based on the multiple historical due diligence data, wherein each feature knowledge domain includes triples representing entities and relationships in the historical due diligence data; adding labels to the triples in each feature knowledge domain to obtain multiple labeled feature knowledge domains, wherein the label of each triple is used to indicate whether the relationship in the triple objectively exists; training an initial prediction model based on the multiple labeled feature knowledge domains, and determining the initial prediction model that has converged to the training result as the link prediction model.

[0011] Further, the transaction data is preprocessed to obtain processed transaction data, including: performing data cleaning and standardization on the transaction data to obtain first data; and using a natural language processing strategy to convert unstructured data in the first data into structured data to obtain the processed transaction data.

[0012] To achieve the above objectives, according to another aspect of this application, a transaction data processing apparatus is provided. The apparatus includes: an acquisition unit for acquiring transaction data and due diligence data of N target objects, where N is a positive integer; an anomaly detection unit for performing anomaly detection on the transaction data based on an attention mechanism and an anomaly detection model to obtain a transaction anomaly detection result, wherein the transaction anomaly detection result is used to indicate a transaction anomaly score for each target object; a construction unit for constructing multiple triples based on the relationships between entities in the due diligence data; a processing unit for inputting the multiple triples into a link prediction model and outputting a set of entity vectors, wherein the link prediction model is used to predict the vectorized representation of entities and relationships using embedded vector technology; a fusion unit for fusing the transaction anomaly detection result and the set of entity vectors to obtain a target fusion vector; and a determination unit for determining a transaction risk assessment result for each target object based on the target fusion vector.

[0013] Furthermore, the anomaly detection unit includes: a preprocessing subunit for preprocessing the transaction data to obtain processed transaction data; a first construction subunit for constructing a topological structure of the counterparty based on the processed transaction data to obtain a counterparty topology, wherein the counterparty includes: any pair of two target objects that have a transaction relationship; and a first determination subunit for determining the transaction anomaly detection result based on the attention mechanism, the processed transaction data, and the counterparty topology, using the anomaly detection model.

[0014] Further, the determined sub-unit includes: an embedding module for embedding vectors into the processed transaction data to obtain N embedding vectors; an extraction module for extracting features from the counterparty topology to obtain extraction results; an aggregation module for aggregating the N embedding vectors and the extraction results based on the attention mechanism to obtain an aggregation result; and a first processing module for inputting the aggregation result into the anomaly detection model to obtain the transaction anomaly detection result, wherein the anomaly detection model includes a neural network model with an encoder-decoder structure.

[0015] Furthermore, the target fusion vector includes: a fusion feature vector associated with each target object, and the determining unit includes: a first acquisition subunit, used to acquire the fusion feature vector of an abnormal object, wherein the abnormal object includes: an object with transaction risk; a calculation subunit, used to calculate the similarity between the fusion feature vector of each target object and the fusion feature vector of the abnormal object, to obtain the target similarity between each target object and the abnormal object; and a second determining subunit, used to determine the transaction risk assessment result of each target object based on the target similarity between each target object and the abnormal object.

[0016] Further, the second determining subunit includes: a comparison module, used to compare the target similarity of each target object with the abnormal object and a preset similarity threshold to obtain a comparison result; a scoring module, used to score the transaction risk of each target object based on the target similarity of each target object with the abnormal object to obtain a transaction risk score value for each target object; and a determining module, used to determine the transaction risk assessment result of each target object based on the comparison result and the transaction risk score value of each target object.

[0017] Further, the link prediction model is obtained through the following sub-units: a second acquisition sub-unit, used to acquire multiple historical due diligence data, wherein the historical due diligence data includes due diligence data of multiple users generated in historical time periods; a second construction sub-unit, used to construct multiple feature knowledge domains based on the multiple historical due diligence data, wherein each feature knowledge domain includes triples representing entities and relationships in the historical due diligence data; an addition sub-unit, used to add labels to the triples in each feature knowledge domain to obtain multiple labeled feature knowledge domains, wherein the label of each triple is used to indicate whether the relationship in the triple objectively exists; and a training sub-unit, used to train the initial prediction model based on the labeled multiple feature knowledge domains, and determine the initial prediction model that has converged to the training as the link prediction model.

[0018] Furthermore, the preprocessing subunit includes: a second processing module, used to perform data cleaning and standardization on the transaction data to obtain first data; and a conversion module, used to convert the unstructured data in the first data into structured data using a natural language processing strategy to obtain the processed transaction data.

[0019] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is executed, it controls the device where the computer-readable storage medium is located to perform the transaction data processing method.

[0020] According to another aspect of this application, an electronic device is provided, comprising: a memory storing an executable program; and a processor for running the program, wherein the program, when running, executes the method for processing the transaction data.

[0021] According to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the transaction data processing method.

[0022] In this application, the following approach is adopted: Transaction data and due diligence data of N target objects are acquired, where N is a positive integer; based on an attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data, obtaining transaction anomaly detection results, which are used to indicate the transaction anomaly score for each target object; multiple triples are constructed based on the relationships between entities in the due diligence data; these triples are input into a link prediction model, outputting a set of entity vectors, where the link prediction model is used to predict the vectorized representation of entities and relationships using embedding vector technology; the transaction anomaly detection results and the set of entity vectors are fused to obtain a target fusion vector; based on the target fusion vector, the transaction risk assessment result for each target object is determined, thereby solving the technical problem in related technologies where poor feature capture in the transaction risk assessment process leads to inaccurate transaction risk assessment results. In this application, feature mining and anomaly detection are performed on transaction data based on attention mechanism and anomaly detection model, and vector embedding is performed on due diligence data. Finally, transaction risk is determined based on the anomaly detection results and the vector embedding results of due diligence data. This avoids the situation in related technologies where insufficient transaction feature mining capabilities lead to inaccurate transaction risk assessment results, thereby achieving the technical effect of improving the accuracy of transaction risk assessment. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a mobile terminal for performing a transaction data processing method according to an embodiment of this application is shown;

[0025] Figure 2 A flowchart illustrating a transaction data processing method according to an embodiment of this application is shown.

[0026] Figure 3 A diagram illustrating an attention-based counterparty topology feature extraction framework according to an embodiment of this application is shown.

[0027] Figure 4 A schematic diagram of a training framework for a vector representation learning algorithm based on NBFNet, according to an embodiment of this application, is shown.

[0028] Figure 5 An application framework diagram of NBFNet provided according to an embodiment of this application is shown;

[0029] Figure 6 A schematic diagram of a customer due diligence profile recognition process according to an embodiment of this application is shown;

[0030] Figure 7 A structural block diagram of a transaction data processing apparatus provided according to an embodiment of this application is shown. Detailed Implementation

[0031] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0032] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0035] Customer due diligence: The process by which financial institutions conduct systematic investigations and comprehensive analyses of various aspects of a customer's identity, background, source of funds, business activities, etc., in order to ensure compliance, identify potential risks, and prevent financial crimes;

[0036] Transaction behavior detection: This is the process of continuously analyzing and modeling customer transaction data in the financial system to identify whether their behavior patterns conform to normal rules, thereby discovering potential risks, abnormal behaviors, or illegal operations.

[0037] Profile recognition: The process of constructing customer profiles and identifying potential abnormal behaviors or atypical features through comprehensive analysis of multi-source data such as transaction data and customer information;

[0038] Anomaly detection: The process of identifying samples, behaviors, or patterns in a dataset that are significantly different from the majority of the data. These anomalies may represent errors, illegal activities, malfunctions, intrusions, risky behaviors, etc., and need to be detected and analyzed promptly.

[0039] Knowledge graph: A knowledge base that organizes various entities and their relationships in a graphical structure, and displays the semantic connections between data in the form of nodes and edges, thereby realizing cross-domain knowledge integration and information reasoning;

[0040] Link prediction: also known as link prediction, is a technical method that predicts and completes the links that have not yet appeared in an existing knowledge graph by learning the potential relationships between nodes, so as to improve the completeness and expressive power of the knowledge graph.

[0041] Machine learning: Based on statistical principles, it is a technology that enables computer systems to automatically identify data patterns and inherent laws by training on large amounts of data, thereby enabling prediction and decision-making on unknown data.

[0042] Vector: An ordered list of numbers that can represent the characteristics or attributes of data;

[0043] Feature: An input variable used to describe a certain aspect of the data;

[0044] Model: A mapping function from features to labels, which can be obtained through training;

[0045] Training: An optimization process that minimizes the loss function by adjusting the model parameters;

[0046] Loss function: A metric that measures the difference between the model's predictions and the true labels;

[0047] Deep learning: a machine learning technique that uses multi-layered neural networks to solve complex problems;

[0048] Neuron: A basic computational unit that can receive multiple input signals and output a signal according to an activation function;

[0049] Neural network: A structure composed of multiple interconnected neurons that can perform nonlinear mapping and feature extraction;

[0050] Layer: A group of neurons in a neural network, which can be divided into input layer, hidden layer, and output layer, etc.

[0051] Deep neural network: A neural network with multiple hidden layers that can express higher-level abstract features.

[0052] It should be noted that the user information (including but not limited to user device information, user personal information, etc.), the collected information and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse.

[0053] Example 1

[0054] The methods and embodiments provided in this application can be executed on a mobile terminal, computer terminal, or similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a transaction data processing method according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0055] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the transaction data processing method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0056] This embodiment provides a method for processing transaction data that runs on a mobile terminal, computer terminal, or similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0057] Figure 2 This is a flowchart illustrating a transaction data processing method according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0058] Step S201: Obtain transaction data and due diligence data for N target objects, where N is a positive integer.

[0059] The target objects mentioned above can be users or user accounts. In this embodiment, after obtaining authorization from the target objects to use transaction data and financial investigation data, transaction data and due diligence data of N target objects can be obtained from multiple data sources. For example, due diligence data of target objects can be obtained from public data sources, internal financial institutions, and other financial institutions outside the financial institution. For example, structured and unstructured data, including customer transaction records, equity structure, legal litigation information, social media behavior, and international sanctions lists, can be obtained from multiple channels. To address the heterogeneity and noise interference of the data, a multi-stage preprocessing mechanism can be used for cleaning and standardization: missing value imputation, outlier removal, and field normalization are performed on structured data (such as financial statements and transaction records); unstructured data (such as public opinion texts and legal documents) can be converted into structured features using natural language processing technology and OCR (Optical Character Recognition) technology.

[0060] By collecting raw transaction time-series data (corresponding to transaction data), including attributes such as transaction time, transaction amount, counterparty, and transaction province / city, high-dimensional transaction time-series features can be constructed. In terms of data processing, to address the heterogeneity and noise interference of transaction data, a multi-stage preprocessing mechanism can be employed to rigorously clean, denoise, and standardize the data. This includes missing value imputation, outlier removal, and field normalization, providing a reliable data foundation for subsequent anomaly detection.

[0061] In constructing customer due diligence data, multi-source data from both inside and outside financial institutions can be integrated. To address data heterogeneity and noise interference, a multi-stage preprocessing mechanism can be employed. The preprocessed multi-source data is then integrated into a high-dimensional feature knowledge domain. Entities (such as customers, enterprises, and counterparties) and relationships (such as holding, transactions, and affiliates) are organized in the form of this knowledge domain, supporting dynamic updates and multi-dimensional relational queries. This high-dimensional knowledge domain provides a high-quality, multi-dimensional, and scalable data foundation for subsequent customer profile identification, realizing the fusion of transaction behavior and customer due diligence information, and providing technical support for accurate dynamic profile identification and anomaly detection.

[0062] Step S202: Based on the attention mechanism, anomaly detection is performed on the transaction data using an anomaly detection model to obtain transaction anomaly detection results, wherein the transaction anomaly detection results are used to indicate the transaction anomaly score value for each target object.

[0063] In this embodiment, a graph attention-based counterparty topology feature extraction method is used to extract features from transaction data. For example, to comprehensively capture customer transaction behavior and the complex relationships between counterparties, transaction time-series data can be constructed into a multi-dimensional feature sequence to achieve a multi-dimensional characterization of transaction behavior. Furthermore, counterparty relationship modeling can be implemented. For instance, a graph attention-based counterparty topology feature extraction method can be used, which iteratively calculates the attention coefficients between counterparties and selectively aggregates neighbor node information to achieve a high-precision representation of counterparty relationships.

[0064] In this embodiment, the extracted transaction features can be input into the anomaly detection model for anomaly detection to obtain a transaction anomaly score for each target object. For example, the anomaly detection model constructed by the multi-dimensional time series modeling method can be combined to perform attention encoding on the transaction sequence (e.g., features of transaction data) to capture the potential patterns of transaction behavior evolving over time, thereby achieving fast and accurate detection of abnormal transactions.

[0065] Step S203: Based on the relationships between entities in the due diligence data, construct multiple triples.

[0066] In this embodiment, due diligence data can be stored in a high-dimensional knowledge domain. Entities (such as customers, enterprises, and counterparties) and relationships (such as holding, transactions, and associations) can be organized in a graph structure to generate several knowledge domains, including customer basic information knowledge domain, related party knowledge domain, questionnaire knowledge domain, and customer profile knowledge domain, supporting dynamic updates and multi-dimensional related queries. The specific storage content is shown in Table 1.

[0067] Table 1

[0068]

[0069] Step S204: Input multiple triples into the link prediction model and output a set of entity vectors. The link prediction model is used to predict the vectorized representation of entities and relationships using embedded vector technology.

[0070] In this embodiment, data (e.g., multiple unit groups) in a high-dimensional feature knowledge domain can be mapped to a low-dimensional continuous vector space using embedding vector-based techniques, and the potential correlation between embedding vectors can be learned using link prediction technology (NBFNet) to obtain a set of entity vectors, thereby realizing vectorized modeling of customer profiles.

[0071] Step S205: The transaction anomaly detection results and the entity vector set are fused to obtain the target fused vector.

[0072] In this embodiment, the transaction anomaly detection results and entity vector set can also be fused to obtain the target fusion vector, so as to realize the multi-dimensional fusion of transaction anomaly detection results and customer profile prediction results, and realize comprehensive and dynamic identification of customer profile.

[0073] In this embodiment, anomaly scoring sequences can be generated from the transaction anomaly detection results. The set of entity vectors output by the link prediction model Feature-level alignment and standardization can be performed. For example, a unified multi-source feature vector space can be constructed to concatenate and weight-fuse transaction behavior features (such as frequency, amount anomaly, and topological centrality) with knowledge domain semantic features (such as risk labels and vectorized results of related paths). The fused feature vector (i.e., the target fusion vector) is defined as follows:

[0074]

[0075] in, , The adaptive weight coefficients correspond to the anomaly detection features (i.e., transaction anomaly detection results) and the embedded features (entity vector set), respectively, and can also be dynamically updated based on data distribution and model feedback.

[0076] Step S206: Based on the target fusion vector, determine the transaction risk assessment result for each target object.

[0077] In this embodiment, the similarity between the fusion vector corresponding to each target object in the target fusion vector and the known high-risk customers or abnormal patterns can be calculated. Based on whether the similarity exceeds a preset threshold, the risk assessment result of each target object can be determined. For example, if the similarity exceeds the set threshold, the customer can be marked as having potential risks. Furthermore, the potential risks can be quantitatively assessed by combining related path information (such as equity relationships and transaction networks), thereby dynamically adjusting the risk level of the customer profile.

[0078] Through the above steps, this embodiment performs feature mining and anomaly detection on transaction data based on an attention mechanism and an anomaly detection model, and performs vector embedding on due diligence data. Finally, based on the anomaly detection results and the vector embedding results of the due diligence data, transaction risks are determined. This avoids the situation in related technologies where insufficient transaction feature mining capabilities lead to inaccurate transaction risk assessment results, thereby achieving the technical effect of improving the accuracy of transaction risk assessment. Furthermore, it solves the technical problem in related technologies where poor feature capture during the transaction risk assessment process leads to inaccurate transaction risk assessment results.

[0079] Optionally, based on the attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data to obtain transaction anomaly detection results. This includes: preprocessing the transaction data to obtain processed transaction data; constructing a topological structure of counterparties based on the processed transaction data to obtain a counterparty topology, wherein counterparties include any pair of two target objects with a transaction relationship; and determining the transaction anomaly detection results based on the attention mechanism, the processed transaction data, and the counterparty topology using the anomaly detection model.

[0080] In this embodiment, the transaction data can be preprocessed, for example, the transaction data can be cleaned and standardized.

[0081] The transaction data mentioned above can be transaction time-series data, which may include, but is not limited to: transaction time, transaction serial number, account number, public / private identifier, transaction amount, purpose of funds, transaction province / city, transaction code, status identifier, payment identifier, transaction channel, transaction currency, and other transaction information. Transaction time-series data can also be stored in a transaction wide table.

[0082] In this embodiment, a topological structure of trading counterparties can also be constructed based on the relationships between trading counterparties in the transaction data to obtain a trading counterparty topology. The trading counterparty topology can support dynamic updates and multi-dimensional relational queries, providing a data foundation for transaction anomaly detection.

[0083] The above-mentioned transaction anomaly detection results may include: an anomaly score sequence, which may include the transaction anomaly score value of each target object.

[0084] In this embodiment, the transaction time series data can be vector-embedded to obtain N embedding vectors. Topological learning can be performed on the counterparty to obtain the topological features of the counterparty. A graph attention learning mechanism can also be used to aggregate nodes of the N embedding vectors and the topological features of the counterparty to obtain a node aggregation vector. Then, the node aggregation vector can be input into the anomaly detection model to input the transaction anomaly detection result.

[0085] Optionally, based on the attention mechanism, the processed transaction data, and the counterparty topology, an anomaly detection model is used to determine the transaction anomaly detection result, including: embedding the processed transaction data into vectors to obtain N embedding vectors; extracting features from the counterparty topology to obtain extraction results; aggregating the N embedding vectors and the extraction results based on the attention mechanism to obtain an aggregation result; and inputting the aggregation result into the anomaly detection model to obtain the transaction anomaly detection result, wherein the anomaly detection model includes a neural network model with an encoder-decoder structure.

[0086] In the field of high-dimensional time-series transaction anomaly detection, given the massive and complex transaction data, feature extraction of high-dimensional features is crucial. Counterparty topology is key information in transaction data, but many related anomaly detection methods fail to fully learn the counterparty structure as topological information, thus affecting anomaly detection performance. In this embodiment, to avoid this situation, counterparty topology feature extraction based on an attention mechanism is used to extract features from both transaction data and counterparty topology, thereby improving the accuracy of transaction anomaly detection results.

[0087] Figure 3 The diagram illustrates a counterparty topology feature extraction framework based on an attention mechanism according to an embodiment of this application, as shown in Figure 3, comprising:

[0088] 1. Vector embedding can be used to embed N embedded vectors into the input "N×d dimensional data (i.e., transaction time series data)".

[0089] 2. Topology learning can be used to learn the topological structure (i.e., counterparty topology) to obtain counterparty features, where x i x j x k It can represent the counterparty characteristics of different target objects.

[0090] 3. Graph attention learning can aggregate nodes based on counterparty features and N embedding vectors to obtain an aggregated node vector (i.e., the aggregation result).

[0091] The node aggregation vector can then be input into the TranAD model (i.e., the anomaly detection model) for transaction anomaly detection.

[0092] During the training phase of the anomaly detection model, the training data for transaction anomaly detection can be composed of m-dimensional embedding vectors of features from d data points of N clients over a duration of T. This can represent the embedding vector for each node (i.e., each customer), which can be initially a random vector. Model input. It can be a historical time series data with a sliding window size of w, which can include transaction time series data for each time window S(tw).

[0093]

[0094] In this embodiment, the counterparty topology can use an adjacency matrix. express, This indicates that node i and node j have a transaction. In the topology, this means that node i and node j have a transaction. Nodes that are connected form a set of nodes that are potentially related to each other. .

[0095] To capture the relationships between nodes and features, an attention mechanism is introduced to learn their latent relationships. For this purpose, the attention coefficients of node i and feature j at time t are used. The calculation is as follows

[0096]

[0097]

[0098]

[0099] in, For a trainable matrix parameter, It is the historical time series data of feature k at node i. This indicates concatenating two vectors. This is a vector of learning coefficients for an attention mechanism. In this embodiment, LeakyReLU (linear rectified function) can be used as a non-linear activation to calculate the attention coefficients, and the Softmax (S-curve) function can be used to normalize the attention coefficients.

[0100] The aggregate representation of node i at time t for

[0101]

[0102] The aggregate representation of N nodes was obtained. As input to the subsequent Temporal Anomaly Detection Model (TranAD), it provides a more accurate feature representation for transaction anomaly detection.

[0103] In this embodiment, after obtaining the network time-series data (i.e., the aggregated representation of N nodes) using an attention-based counterparty topology feature extraction method, the TranAD model can be used for time-series anomaly detection. TranAD is an anomaly detection model based on Transformer (a neural network architecture), which deeply reconstructs the Transformer architecture to accomplish the task of anomaly detection in time-series data. Like other Encoder-Decoder models, in the Transformer, the input sequence can undergo multiple attention-based transformations. The Encoder encodes the entire sequence up to the current timestamp C and uses a focus score. The Window Encoder uses this information to create an encoded representation of the input window sequence W, which is then passed to the two Decoders to create its reconstruction.

[0104] Optionally, the target fusion vector includes: a fusion feature vector associated with each target object. Based on the target fusion vector, the transaction risk assessment result of each target object is determined, including: obtaining the fusion feature vector of abnormal objects, wherein abnormal objects include: objects with transaction risks; calculating the similarity between the fusion feature vector of each target object and the fusion feature vector of abnormal objects to obtain the target similarity between each target object and the abnormal objects; and determining the transaction risk assessment result of each target object based on the target similarity between each target object and the abnormal objects.

[0105] In this embodiment, a vector similarity calculation and risk quantification mechanism can also be introduced to determine the transaction risk assessment result for each target object. For example, for target customers... (Corresponding to the target object), its fusion vector can be calculated. With known anomalous customer vectors in the knowledge domain The cosine similarity is used to obtain the target similarity. If the target similarity exceeds a set threshold, the customer can be marked as having potential risk. Furthermore, by combining multi-hop association paths in the knowledge domain, the transaction risk assessment result for each target object can be determined, achieving the technical effect of accurately assessing the transaction risk of customers.

[0106] Optionally, based on the target similarity between each target object and the abnormal object, the transaction risk assessment result of each target object is determined, including: comparing the target similarity between each target object and the abnormal object with a preset similarity threshold to obtain a comparison result; scoring the transaction risk of each target object based on the target similarity between each target object and the abnormal object to obtain a transaction risk score value for each target object; and determining the transaction risk assessment result of each target object based on the comparison result and the transaction risk score value for each target object.

[0107] The formula for quantifying the strength of the indirect connection between a customer and a high-risk customer to obtain the comprehensive risk score is as follows:

[0108]

[0109] in, For cosine similarity, It is determined by the number of related links, the type of links (such as equity, transaction, judicial), and weighting factors.

[0110] This embodiment can introduce a real-time profile update mechanism at the system architecture level. When new transaction flows or external due diligence data are accessed, the following processes can be automatically triggered: recalculate the transaction anomaly detection results through a sliding window; input the new knowledge domain triples into NBFNet (link prediction model) to generate vector embeddings of the new entities and relationships; and fuse the new results into the customer profile to form an updated risk vector. .

[0111] Optionally, the link prediction model is obtained through the following methods: acquiring multiple historical due diligence data, which include due diligence data of multiple users generated during historical time periods; constructing multiple feature knowledge domains based on the multiple historical due diligence data, where each feature knowledge domain includes triples representing entities and relationships in the historical due diligence data; adding labels to the triples in each feature knowledge domain to obtain multiple labeled feature knowledge domains, where the label of each triple is used to indicate whether the relationship in the triple objectively exists; training the initial prediction model based on the multiple labeled feature knowledge domains, and determining the initial prediction model that has converged to the desired outcome as the link prediction model.

[0112] In this embodiment, to uncover potential contour associations between entities in the knowledge domain, embedding vector technology can be used to map entities and relationships to a low-dimensional continuous vector space. Specifically, based on the link prediction model (NBFNet, corresponding to the link prediction model) algorithm, the vectorized representations of entities and relationships are learned by optimizing the projection loss function, so that high-risk association patterns have higher similarity in the vector space.

[0113] Figure 4 A schematic diagram of a training framework for a vector representation learning algorithm based on NBFNet, according to an embodiment of this application, is shown. Figure 4 As shown, the NBFNet algorithm can be divided into three steps: feature extraction, model training, and vector mapping, as detailed below:

[0114] In the feature extraction step, the knowledge graph can be used to examine high-dimensional features, generating labeled (positive and negative) relation triples. Positive triples represent real, objectively existing relations, denoted by Δ+; negative triples represent non-existent relations, denoted by Δ-.

[0115] Based on the set of positive and negative triples obtained from feature extraction, all entities and relationships in the high-dimensional feature due diligence knowledge graph are mapped to a k-dimensional vector space through the model for model training. Since entities in the high-dimensional feature due diligence knowledge graph exhibit one-to-many and many-to-one relationships (e.g., the same customer may be associated with multiple users), this algorithm improves the NBFNet model and introduces it into vector representation learning, enabling the model to learn vector representations of various relationships between entities.

[0116] The goal of link prediction is to predict whether a relationship q exists between a head entity u and a tail entity v. From a representation learning perspective, a pairwise representation can also be learned. Specifically, NBFNet parameterizes the generalized Bellman-Ford algorithm (an algorithm for calculating single-source shortest paths) into three neural components: INDICATOR, Message, and Aggregate. The INDICATOR function initializes the representation of each node as a boundary condition for NBFNet; the Message function replaces the generalized product operator in related techniques; and the Aggregate function replaces the generalized sum operator, resulting in the following iterative algorithm:

[0117]

[0118]

[0119] in, This represents the representation of entity x at time t-1. Let e ​​represent the edge e = (x, r, v), where x and v are entities. Let x represent the set of triples that are related to an entity v, and r represent the type of relation that is related to v.

[0120] Figure 5 An application framework diagram of NBFNet according to an embodiment of this application is shown, such as... Figure 5 As shown, RotatE (rotation embedding function) can be used as the Message function, which can better model complex relationship patterns; Sum (summation function) function is chosen as the Aggregate function. The Sum function comprehensively considers the information on each link and node along the way, and has good applicability in the calculation of risk paths.

[0121] A well-trained NBFNet model can map entities and relation types in a high-dimensional feature due diligence knowledge graph to a k-dimensional vector space, providing computational support for risk profile prediction. Examples of the trained entity and relation embedding vectors are as follows:

[0122] cust_id0=[-0.0858, 0.0734,0.1240, ..., -0.2806] (Sample embedding vector of customer ID);

[0123] manager0 = [-0.1668, -0.0017, 0.0756, · · · , -0.0571] (Sample embedding vector for managers or account managers);

[0124] relationship0 = [-0.0579, -0.0912, -0.2475, · · · , 0.0019] (Example of an embedding vector for relationships between entities);

[0125] businessCountry0 = [-0.0471, -0.1180, -0.0964, ..., 0.1281] (Sample embedding vector of the transaction region);

[0126] ...

[0127] factorTag0 = [0.1278, 0.1213, -0.0955, · · · , 0.1315] (Sample embedding vector of risk factor labels).

[0128] In an alternative example, customers, profile relationships, and customer profiles can be grouped into several triples. Batch predictions can be performed using a trained NBFNet to obtain the corresponding scores for the triples. If the prediction score reaches the positive triple threshold, the triple is determined to be a positive triple, meaning that the new customer has the corresponding customer profile (such as involvement in abnormal transactions, specific natural persons, high-risk customers, negative news, and being hit by sanctions lists).

[0129] Optionally, the transaction data is preprocessed to obtain processed transaction data, including: performing data cleaning and standardization on the transaction data to obtain first data; and using natural language processing strategies to convert unstructured data in the first data into structured data to obtain processed transaction data.

[0130] In this embodiment, a multi-stage preprocessing mechanism can be used to clean and standardize transaction data. Specifically, structured data (such as financial statements and transaction records) can be imputed for missing values, removed for outliers, and normalized for fields. Unstructured data (such as public opinion texts and judicial documents) can be transformed into structured features using natural language processing and OCR technologies.

[0131] Figure 6A schematic diagram of a customer due diligence profile recognition process according to an embodiment of this application is shown, such as... Figure 6 As shown, after the customer enters transaction data and customer due diligence data, the following steps are included:

[0132] Step S0: Data preprocessing to generate transaction time-series data and due diligence knowledge base.

[0133] Step S1: Detect anomalies in time-series transaction data (corresponding to aggregation results) using the anomaly detection module (corresponding to the anomaly detection model).

[0134] Step S2: Predict customer profile labels (corresponding to entity vector sets) through the link prediction module (corresponding to the link prediction model).

[0135] Step S3: The transaction detection and customer profile are fused to obtain the target fusion vector.

[0136] Output: Customer profile.

[0137] In one alternative example, a baseline model of variables such as transaction amount, frequency, and duration can be established based on statistical distributions (such as Gaussian, Poisson, and t-distribution), and anomalies can be identified by the degree of deviation (such as Z-score and Mahalanobis distance). Time series analysis can also be performed.

[0138] In another alternative example, Pearson correlation, chi-square test, covariance matrix and other methods can be used to determine abnormal coupling relationships between different dimensions to assist in risk assessment.

[0139] Random forests (RF), support vector machines (SVM), gradient boosting trees (GBDT, XGBoost, LightGBM), and other methods can also be used to classify marked transactions and predict their risk levels.

[0140] In this embodiment, clustering methods can also be used to identify abnormal transaction groups and construct risk scores. Graph computing algorithms are used to identify key nodes and high-risk relationships in the financial transaction network.

[0141] It should be noted that in this embodiment, high-dimensional transaction time-series features can be constructed by collecting raw transaction time-series data, including attributes such as transaction time, transaction amount, counterparty, and transaction province / city. Regarding data processing, to address the heterogeneity and noise interference of transaction data, a multi-stage preprocessing mechanism is employed to rigorously clean, denoise, and standardize the data, specifically including missing value imputation, outlier removal, and field normalization. Simultaneously, anomaly annotations are derived from existing annotation methods, providing a reliable data foundation for subsequent anomaly detection. In terms of constructing customer due diligence data, multi-source data is integrated. Addressing data heterogeneity and noise interference, a multi-stage preprocessing mechanism is used. The preprocessed multi-source data is integrated into a high-dimensional feature knowledge domain, where entities (such as customers, enterprises, and counterparties) and relationships (such as holding, transaction, and association) are organized in the form of a knowledge domain, supporting dynamic updates and multi-dimensional relational queries. This high-dimensional knowledge domain provides a high-quality, multi-dimensional, and scalable data foundation for subsequent customer profile recognition, realizing the fusion of transaction behavior and customer due diligence information, and providing technical support for accurate dynamic profile recognition and anomaly detection.

[0142] To comprehensively capture customer transaction behavior and the complex relationships between counterparties, this embodiment constructs transaction time-series data into a multi-dimensional feature sequence, enabling a multi-dimensional characterization of transaction behavior. For counterparty relationship modeling, a graph attention-based counterparty topological feature extraction method is employed. By iteratively calculating the attention coefficients between counterparties and selectively aggregating neighbor node information, a high-precision representation of counterparty relationships is achieved. Simultaneously, the TranAD multi-dimensional time-series modeling method is combined to perform attention encoding on the transaction sequence, capturing potential patterns in the evolution of transaction behavior over time, enabling rapid and accurate detection of abnormal transactions.

[0143] This embodiment utilizes vector embedding technology to map data from a high-dimensional feature knowledge domain to a low-dimensional continuous vector space, and employs the link prediction technique NBFNet to learn the potential relationships between embedded vectors. In the customer due diligence process, the vectorized representation of the target customer is learned and updated in real time, and the similarity between the target customer and known risk customers is measured using a vector similarity calculation algorithm. By combining the association paths in the knowledge domain (such as equity linkages and transaction networks), the probability of the target customer posing a risk is quantified, and finally, the target customer profile is determined based on the association between the customer and the risk profile.

[0144] After completing transaction behavior detection and knowledge domain embedding vector calculation, a multi-dimensional fusion method is further developed to integrate transaction detection results with customer profile prediction results, achieving comprehensive and dynamic identification of customer profiles. First, transaction behavior features, high-dimensional knowledge domain embedding vectors, and customer due diligence information are uniformly represented. A multi-source fusion feature space is constructed through feature standardization, weighted fusion, and multi-dimensional vector concatenation, achieving deep integration of transaction data and customer information. Within the fusion feature space, a vector similarity measurement method is used to calculate the similarity between the target customer and known high-risk customers or abnormal patterns in real time. This is combined with related path information (such as equity relationships and transaction networks) to quantitatively assess potential risks, thereby dynamically adjusting the risk level of the customer profile. Furthermore, this invention supports a real-time update mechanism, continuously inputting new transaction data and newly added knowledge domain information into the fusion model to update the customer profile vector representation in real time, achieving dynamic evolution of the customer profile.

[0145] The transaction data processing method provided in this embodiment has the following advantages:

[0146] (1) High-dimensional data processing and cross-domain knowledge fusion capabilities: The invention utilizes an easy-to-use topology and attention mechanism with an anomaly detection module to perform anomaly detection on high-dimensional time-series data; it uses knowledge representation learning methods to unify the modeling of multi-source heterogeneous data such as customer information, transaction behavior, and related party information, which can effectively capture high-dimensional features and complex relationships. In addition, the invention proposes a multi-source fusion mechanism for detection results and contour results at the system architecture level. By constructing a unified feature vector space, the transaction anomaly score and knowledge domain embedded features are aligned and weighted, and then fused into the customer contour, ensuring the accuracy, dynamism, and forward-looking nature of contour recognition.

[0147] (2) Improved anomaly detection accuracy driven by counterparty topology and attention mechanism: Compared with detection methods based on single-dimensional statistical features or isolated time series analysis in related technologies, the introduction of a counterparty topology feature extraction method based on graph attention mechanism can fully capture potential abnormal patterns between counterparty relationships, targeting the large-scale, multi-dimensional features existing in complex transaction networks. This invention uses TranAD for time series anomaly detection at the time series level, and combines counterparty topology at the structural level, using the attention mechanism to assign differentiated weights to different nodes and their feature relationships, thereby enhancing the model's sensitivity to abnormal fund flow paths and hidden transaction structures, and significantly improving the recall and accuracy of transaction anomaly detection.

[0148] (3) Customer Risk Profile Prediction Capability Based on Knowledge Embedding: By introducing the NBFNet link prediction model, entities such as customers, enterprises, shareholders, and legal disputes in the knowledge domain, as well as their relationships, are mapped to a low-dimensional vector space to achieve vectorized modeling of risk patterns. This mechanism can capture potential risk connections of customers in multi-hop paths, such as risk characteristics indirectly exposed through equity penetration relationships, judicial litigation links, or negative news links, thereby generating dynamic and fine-grained customer profiles. This method not only improves the expressive power of customer profiles but also effectively overcomes the lag and insufficient coverage problems of traditional static label or rule base-based methods.

[0149] (4) Enhanced Model Interpretability and Transparency: Multiple interpretability mechanisms are introduced in the architecture and algorithm design to ensure that risk identification results are traceable and verifiable. First, an entity-relationship representation based on the knowledge domain is explicitly used to construct a graph structure, enabling risk judgment to be traced directly to its source through relational links. Second, an attention mechanism is introduced in transaction topology modeling, where weight coefficients can quantify the influence of key counterparties and features during anomaly detection, avoiding "black box" judgments. Embedding learning based on NBFNet reveals the risk transmission chain through vector similarity and path scoring, achieving dual interpretation of "numerical scores + semantic paths". Finally, the result fusion layer adopts a weighted combination method, where risk scores can be decomposed into specific transactions and links. Combined with a dynamic update mechanism, this not only helps business personnel understand the model output results but also meets the requirements of compliance and interpretability.

[0150] Example 2

[0151] This application also provides a transaction data processing apparatus. It should be noted that the transaction data processing apparatus of this application can be used to execute the transaction data processing method provided in this application. This apparatus is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated. The transaction data processing apparatus provided in this application is described below.

[0152] Figure 7 This is a structural block diagram of a transaction data processing apparatus according to an embodiment of this application. Figure 7 As shown, the device includes: an acquisition unit 71, an anomaly detection unit 72, a construction unit 73, a processing unit 74, a fusion unit 75, and a determination unit 76.

[0153] Among them, the acquisition unit 71 is used to acquire transaction data and due diligence data of N target objects, where N is a positive integer;

[0154] Anomaly detection unit 72 is used to perform anomaly detection on transaction data based on an attention mechanism and an anomaly detection model to obtain transaction anomaly detection results, wherein the transaction anomaly detection results are used to indicate the transaction anomaly score value of each target object;

[0155] Building unit 73 is used to construct multiple triples based on the relationships between entities in the due diligence data;

[0156] Processing unit 74 is used to input multiple triples into the link prediction model and output a set of entity vectors, wherein the link prediction model is used to predict the vectorized representation of entities and relations using embedding vector techniques:

[0157] The fusion unit 75 is used to fuse the transaction anomaly detection results and the entity vector set to obtain the target fusion vector;

[0158] The determination unit 76 is used to determine the transaction risk assessment result of each target object based on the target fusion vector.

[0159] In the transaction data processing apparatus provided in this application embodiment, the acquisition unit 71 can acquire transaction data and due diligence data of N target objects, where N is a positive integer. The anomaly detection unit 72 performs anomaly detection on the transaction data based on an attention mechanism and an anomaly detection model to obtain transaction anomaly detection results. The transaction anomaly detection results are used to indicate the transaction anomaly score value of each target object. The construction unit 73 constructs multiple triples based on the relationships between entities in the due diligence data. The processing unit 74 inputs the multiple triples into the link prediction model and outputs a set of entity vectors. The link prediction model is used to predict the vectorized representation of entities and relationships using embedded vector technology. The fusion unit 75 fuses the transaction anomaly detection results and the set of entity vectors to obtain a target fusion vector. The determination unit 76 determines the transaction risk assessment result of each target object based on the target fusion vector, thereby solving the technical problem in related technologies where the feature capture effect in the transaction risk assessment process is poor, resulting in inaccurate transaction risk assessment results. In this embodiment, feature mining and anomaly detection are performed on transaction data based on an attention mechanism and an anomaly detection model, and vector embedding is performed on due diligence data. Finally, transaction risks are determined based on the anomaly detection results and the vector embedding results of due diligence data. This avoids the situation in related technologies where insufficient transaction feature mining capabilities lead to inaccurate transaction risk assessment results, thereby achieving the technical effect of improving the accuracy of transaction risk assessment.

[0160] Optionally, in the transaction data processing apparatus provided in this application embodiment, the anomaly detection unit includes: a preprocessing subunit, used to preprocess the transaction data to obtain processed transaction data; a first construction subunit, used to construct the topology of the counterparty based on the processed transaction data to obtain the counterparty topology, wherein the counterparty includes: any pair of two target objects that have a transaction relationship; and a first determination subunit, used to determine the transaction anomaly detection result based on the attention mechanism, the processed transaction data, and the counterparty topology, through the anomaly detection model.

[0161] Optionally, in the transaction data processing apparatus provided in this application embodiment, the determining subunit includes: an embedding module for embedding vectors into the processed transaction data to obtain N embedding vectors; an extraction module for extracting features from the counterparty topology to obtain extraction results; an aggregation module for aggregating the N embedding vectors and extraction results based on an attention mechanism to obtain an aggregation result; and a first processing module for inputting the aggregation result into an anomaly detection model to obtain a transaction anomaly detection result, wherein the anomaly detection model includes: a neural network model with an encoder-decoder structure.

[0162] Optionally, in the transaction data processing apparatus provided in this application embodiment, the target fusion vector includes: a fusion feature vector associated with each target object, and the determining unit includes: a first acquisition subunit, used to acquire the fusion feature vector of an abnormal object, wherein the abnormal object includes: an object with transaction risk; a calculation subunit, used to calculate the similarity between the fusion feature vector of each target object and the fusion feature vector of the abnormal object, to obtain the target similarity between each target object and the abnormal object; and a second determining subunit, used to determine the transaction risk assessment result of each target object based on the target similarity between each target object and the abnormal object.

[0163] Optionally, in the transaction data processing apparatus provided in this application embodiment, the second determining subunit includes: a comparison module, used to compare the target similarity of each target object with an abnormal object and a preset similarity threshold to obtain a comparison result; a scoring module, used to score the transaction risk of each target object based on the target similarity of each target object with an abnormal object to obtain a transaction risk score value for each target object; and a determining module, used to determine the transaction risk assessment result of each target object based on the comparison result and the transaction risk score value of each target object.

[0164] Optionally, in the transaction data processing apparatus provided in this application embodiment, the link prediction model is obtained through the following sub-units: a second acquisition sub-unit, used to acquire multiple historical due diligence data, wherein the historical due diligence data includes: due diligence data of multiple users generated in historical time periods; a second construction sub-unit, used to construct multiple feature knowledge domains based on the multiple historical due diligence data, wherein each feature knowledge domain includes: triples representing entities and relationships in the historical due diligence data; an adding sub-unit, used to add labels to the triples in each feature knowledge domain to obtain multiple labeled feature knowledge domains, wherein the label of each triple is used to indicate whether the relationship in the triple objectively exists; and a training sub-unit, used to train the initial prediction model based on the labeled multiple feature knowledge domains, and determine the initial prediction model that has converged to the training as the link prediction model.

[0165] Optionally, in the transaction data processing apparatus provided in this application embodiment, the preprocessing subunit includes: a second processing module, used to perform data cleaning and standardization processing on the transaction data to obtain first data; and a conversion module, used to use a natural language processing strategy to convert unstructured data in the first data into structured data to obtain processed transaction data.

[0166] The transaction data processing device includes a processor and a memory. The aforementioned acquisition unit 71, anomaly detection unit 72, construction unit 73, processing unit 74, fusion unit 75, and determination unit 76 are all stored as program units in the memory. The processor executes the aforementioned program units stored in the memory to achieve the corresponding functions. All of the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0167] The processor contains a kernel that retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, feature mining and anomaly detection are performed on transaction data based on attention mechanisms and anomaly detection models. Vector embedding is also performed on due diligence data. Finally, based on the anomaly detection results and the vector embedding results of the due diligence data, transaction risk is determined. This avoids the inaccurate transaction risk assessment results caused by insufficient transaction feature mining capabilities in related technologies, thus achieving the technical effect of improving the accuracy of transaction risk assessment.

[0168] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0169] Example 3

[0170] This invention provides a computer-readable storage medium including a stored program, wherein, when the program is running, it controls the device where the computer-readable storage medium is located to perform a method for processing transaction data.

[0171] Specifically, the transaction data processing method includes: acquiring transaction data and due diligence data for N target objects, where N is a positive integer; performing anomaly detection on the transaction data using an anomaly detection model based on an attention mechanism to obtain transaction anomaly detection results, where the transaction anomaly detection results are used to indicate the transaction anomaly score value for each target object; constructing multiple triples based on the relationships between entities in the due diligence data; inputting the multiple triples into a link prediction model to output a set of entity vectors, where the link prediction model is used to predict the vectorized representation of entities and relationships using embedding vector technology; fusing the transaction anomaly detection results and the set of entity vectors to obtain a target fusion vector; and determining the transaction risk assessment result for each target object based on the target fusion vector.

[0172] Optionally, based on the attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data to obtain transaction anomaly detection results. This includes: preprocessing the transaction data to obtain processed transaction data; constructing a topological structure of counterparties based on the processed transaction data to obtain a counterparty topology, wherein counterparties include any pair of two target objects with a transaction relationship; and determining the transaction anomaly detection results based on the attention mechanism, the processed transaction data, and the counterparty topology using the anomaly detection model.

[0173] Optionally, based on the attention mechanism, the processed transaction data, and the counterparty topology, an anomaly detection model is used to determine the transaction anomaly detection result, including: embedding the processed transaction data into vectors to obtain N embedding vectors; extracting features from the counterparty topology to obtain extraction results; aggregating the N embedding vectors and the extraction results based on the attention mechanism to obtain an aggregation result; and inputting the aggregation result into the anomaly detection model to obtain the transaction anomaly detection result, wherein the anomaly detection model includes a neural network model with an encoder-decoder structure.

[0174] Optionally, the target fusion vector includes: a fusion feature vector associated with each target object. Based on the target fusion vector, the transaction risk assessment result of each target object is determined, including: obtaining the fusion feature vector of abnormal objects, wherein abnormal objects include: objects with transaction risks; calculating the similarity between the fusion feature vector of each target object and the fusion feature vector of abnormal objects to obtain the target similarity between each target object and the abnormal objects; and determining the transaction risk assessment result of each target object based on the target similarity between each target object and the abnormal objects.

[0175] Optionally, based on the target similarity between each target object and the abnormal object, the transaction risk assessment result of each target object is determined, including: comparing the target similarity between each target object and the abnormal object with a preset similarity threshold to obtain a comparison result; scoring the transaction risk of each target object based on the target similarity between each target object and the abnormal object to obtain a transaction risk score value for each target object; and determining the transaction risk assessment result of each target object based on the comparison result and the transaction risk score value for each target object.

[0176] Optionally, the link prediction model is obtained through the following methods: acquiring multiple historical due diligence data, which include due diligence data of multiple users generated during historical time periods; constructing multiple feature knowledge domains based on the multiple historical due diligence data, where each feature knowledge domain includes triples representing entities and relationships in the historical due diligence data; adding labels to the triples in each feature knowledge domain to obtain multiple labeled feature knowledge domains, where the label of each triple is used to indicate whether the relationship in the triple objectively exists; training the initial prediction model based on the multiple labeled feature knowledge domains, and determining the initial prediction model that has converged to the desired outcome as the link prediction model.

[0177] Optionally, the transaction data is preprocessed to obtain processed transaction data, including: performing data cleaning and standardization on the transaction data to obtain first data; and using natural language processing strategies to convert unstructured data in the first data into structured data to obtain processed transaction data.

[0178] Example 4

[0179] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having at least the following method steps: acquiring transaction data and due diligence data of N target objects, where N is a positive integer; performing anomaly detection on the transaction data using an anomaly detection model based on an attention mechanism to obtain a transaction anomaly detection result, wherein the transaction anomaly detection result is used to indicate the transaction anomaly score value of each target object; constructing multiple triples based on the relationships between entities in the due diligence data; inputting the multiple triples into a link prediction model to output a set of entity vectors, wherein the link prediction model is used to predict the vectorized representation of entities and relationships using embedding vector technology; fusing the transaction anomaly detection result and the set of entity vectors to obtain a target fusion vector; and determining the transaction risk assessment result for each target object based on the target fusion vector.

[0180] Optionally, based on the attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data to obtain transaction anomaly detection results. This includes: preprocessing the transaction data to obtain processed transaction data; constructing a topological structure of counterparties based on the processed transaction data to obtain a counterparty topology, wherein counterparties include any pair of two target objects with a transaction relationship; and determining the transaction anomaly detection results based on the attention mechanism, the processed transaction data, and the counterparty topology using the anomaly detection model.

[0181] Optionally, based on the attention mechanism, the processed transaction data, and the counterparty topology, an anomaly detection model is used to determine the transaction anomaly detection result, including: embedding the processed transaction data into vectors to obtain N embedding vectors; extracting features from the counterparty topology to obtain extraction results; aggregating the N embedding vectors and the extraction results based on the attention mechanism to obtain an aggregation result; and inputting the aggregation result into the anomaly detection model to obtain the transaction anomaly detection result, wherein the anomaly detection model includes a neural network model with an encoder-decoder structure.

[0182] Optionally, the target fusion vector includes: a fusion feature vector associated with each target object. Based on the target fusion vector, the transaction risk assessment result of each target object is determined, including: obtaining the fusion feature vector of abnormal objects, wherein abnormal objects include: objects with transaction risks; calculating the similarity between the fusion feature vector of each target object and the fusion feature vector of abnormal objects to obtain the target similarity between each target object and the abnormal objects; and determining the transaction risk assessment result of each target object based on the target similarity between each target object and the abnormal objects.

[0183] Optionally, based on the target similarity between each target object and the abnormal object, the transaction risk assessment result of each target object is determined, including: comparing the target similarity between each target object and the abnormal object with a preset similarity threshold to obtain a comparison result; scoring the transaction risk of each target object based on the target similarity between each target object and the abnormal object to obtain a transaction risk score value for each target object; and determining the transaction risk assessment result of each target object based on the comparison result and the transaction risk score value for each target object.

[0184] Optionally, the link prediction model is obtained through the following methods: acquiring multiple historical due diligence data, which include due diligence data of multiple users generated during historical time periods; constructing multiple feature knowledge domains based on the multiple historical due diligence data, where each feature knowledge domain includes triples representing entities and relationships in the historical due diligence data; adding labels to the triples in each feature knowledge domain to obtain multiple labeled feature knowledge domains, where the label of each triple is used to indicate whether the relationship in the triple objectively exists; training the initial prediction model based on the multiple labeled feature knowledge domains, and determining the initial prediction model that has converged to the desired outcome as the link prediction model.

[0185] Optionally, the transaction data is preprocessed to obtain processed transaction data, including: performing data cleaning and standardization on the transaction data to obtain first data; and using natural language processing strategies to convert unstructured data in the first data into structured data to obtain processed transaction data.

[0186] It is obvious to those skilled in the art that the modules or steps of the present invention described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0187] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0188] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0189] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0190] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0191] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0192] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0193] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0194] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0195] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0196] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for processing transaction data, characterized in that, include: Obtain transaction data and due diligence data for N target objects, where N is a positive integer; Based on the attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data to obtain transaction anomaly detection results, wherein the transaction anomaly detection results are used to indicate the transaction anomaly score value for each target object; Based on the relationships between entities in the due diligence data, multiple triples are constructed; Multiple triples are input into the link prediction model, which outputs a set of entity vectors. The link prediction model is used to predict the vectorized representation of entities and relationships using embedded vector technology. The transaction anomaly detection results and the entity vector set are fused to obtain the target fused vector; Based on the target fusion vector, the transaction risk assessment result for each target object is determined.

2. The processing method according to claim 1, characterized in that, Based on an attention mechanism, an anomaly detection model is used to detect anomalies in the transaction data, resulting in transaction anomaly detection results, including: The transaction data is preprocessed to obtain processed transaction data; Based on the processed transaction data, a topological structure of the counterparty is constructed to obtain the counterparty topology, wherein the counterparty includes: any pair of two target objects that have a transaction relationship; Based on the attention mechanism, the processed transaction data, and the counterparty topology, the anomaly detection model is used to determine the transaction anomaly detection result.

3. The processing method according to claim 2, characterized in that, Based on the attention mechanism, the processed transaction data, and the counterparty topology, the anomaly detection model determines the transaction anomaly detection result, including: The processed transaction data is vector-embedded to obtain N embedding vectors; Feature extraction is performed on the counterparty topology to obtain the extraction results; Based on the attention mechanism, the N embedding vectors and the extraction results are aggregated to obtain an aggregated result; The aggregation result is input into the anomaly detection model to obtain the transaction anomaly detection result, wherein the anomaly detection model includes a neural network model with an encoder-decoder structure.

4. The processing method according to claim 1, characterized in that, The target fusion vector includes: a fusion feature vector associated with each target object; and based on the target fusion vector, the transaction risk assessment result for each target object is determined, including: Obtain the fusion feature vector of the abnormal object, wherein the abnormal object includes: an object with transaction risk; Calculate the similarity between the fused feature vector of each target object and the fused feature vector of the abnormal object to obtain the target similarity between each target object and the abnormal object; Based on the target similarity between each target object and the abnormal object, the transaction risk assessment result of each target object is determined.

5. The processing method according to claim 4, characterized in that, Based on the target similarity between each target object and the abnormal object, the transaction risk assessment result for each target object is determined, including: The target similarity of each target object and the abnormal object is compared with a preset similarity threshold to obtain the comparison result; Based on the target similarity between each target object and the abnormal object, the transaction risk of each target object is scored to obtain the transaction risk score value of each target object; Based on the comparison results and the transaction risk score of each target object, the transaction risk assessment result of each target object is determined.

6. The processing method according to claim 1, characterized in that, The link prediction model is obtained in the following way: Acquire multiple historical due diligence data, which include due diligence data of multiple users generated during historical time periods; Based on multiple historical due diligence data, multiple feature knowledge domains are constructed, wherein each feature knowledge domain includes: triples representing entities and relations in the historical due diligence data; Labels are added to the triples in each of the feature knowledge domains to obtain multiple labeled feature knowledge domains, wherein the label of each triple is used to indicate whether the relation in the triple objectively exists; The initial prediction model is trained based on the labeled multiple feature knowledge domains, and the initial prediction model that has converged during training is determined as the link prediction model.

7. The processing method according to claim 2, characterized in that, The transaction data is preprocessed to obtain processed transaction data, including: The transaction data is cleaned and standardized to obtain the first data. A natural language processing strategy is used to convert the unstructured data in the first data into structured data to obtain the processed transaction data.

8. A transaction data processing apparatus, characterized in that, include: The acquisition unit is used to acquire transaction data and due diligence data of N target objects, where N is a positive integer; An anomaly detection unit is used to perform anomaly detection on the transaction data based on an attention mechanism and an anomaly detection model to obtain a transaction anomaly detection result, wherein the transaction anomaly detection result is used to indicate the transaction anomaly score value for each target object; A construction unit is used to construct multiple triples based on the relationships between entities in the due diligence data; The processing unit is configured to input multiple triples into a link prediction model and output a set of entity vectors, wherein the link prediction model is used to predict the vectorized representation of entities and relations using embedded vector technology. The fusion unit is used to fuse the transaction anomaly detection result and the entity vector set to obtain a target fusion vector; The determining unit is used to determine the transaction risk assessment result of each target object based on the target fusion vector.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device containing the computer-readable storage medium to perform the transaction data processing method according to any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the transaction data processing method according to any one of claims 1 to 7.

Images