Transaction processing method and device based on graph neural network, equipment and storage medium

Abstract

The invention provides a transaction processing method and device based on a graph neural network, equipment and a medium, and relates to application of risk management in the field of financial science and technology. The transaction processing method based on the graph neural network comprises the following steps: in response to a transfer transaction of a target account, updating a connection relationship between a target account node and an associated account node in an account transaction graph based on the transfer transaction; wherein the account transaction graph comprises a plurality of account nodes, and the connection relationship between any two account nodes is determined based on the transfer frequency and time anomaly between any two account nodes; determining a target sub-transaction graph from the updated account transaction graph, wherein the target sub-transaction graph comprises a connection relationship between at least one target account node and an associated account node; and on the basis of the connection relationship in the target sub-transaction graph, determining an account with a transaction risk in the target account and the associated account.

Description

Technical Field

[0001] This application relates to the field of risk management technology and can be applied to the field of financial technology. More specifically, it relates to a transaction processing method, apparatus, device, and medium based on graph neural networks. Background Technology

[0002] With the development of digital finance, bank transactions face increasingly complex and volatile threats from abnormal transactions. Traditional real-time anti-abnormal transaction technologies for bank transactions have many limitations and are no longer sufficient to meet the current needs of financial security.

[0003] On the one hand, rule-based anti-abnormal transaction systems primarily rely on static rule bases, such as setting fixed transaction thresholds. When a transaction amount exceeds this threshold, it triggers SMS verification or manual review. However, with the continuous innovation of abnormal transaction methods, this long rule update cycle makes it difficult for the system to quickly adapt to and identify new abnormal transaction behaviors. For example, abnormal traders may use small-amount, high-frequency transactions to bypass traditional large-amount transaction threshold rules, while the rule-based system cannot detect such new abnormal transaction patterns in a timely manner.

[0004] On the other hand, while traditional machine learning models can extract historical features of accounts for anomaly detection, they often focus only on the historical data of a single account, neglecting the potential risks associated with cross-institutional funding links. In real-world financial transactions, abnormal trading behavior often involves complex fund transfers between multiple accounts, which may belong to different financial institutions, forming intricate funding chains. Judging solely based on the historical characteristics of a single account may overlook the risks hidden within these cross-institutional funding links. Summary of the Invention

[0005] In view of the above problems, this application provides a transaction processing method, apparatus, device and medium based on graph neural networks.

[0006] The first aspect of this application provides a transaction processing method based on a graph neural network. The method includes: in response to a transfer transaction occurring in a target account, updating the connection relationship between the target account node and related account nodes in an account transaction graph based on the transfer transaction; wherein the account transaction graph includes multiple account nodes, and the connection relationship between any two account nodes is determined based on the transfer frequency and time anomaly between any two account nodes, where the time anomaly characterizes the degree of deviation between the transfer transaction time and the expected transaction time between the two account nodes; the target account node is the account node corresponding to the target account, and the related account node is the account node corresponding to the account that has a transfer transaction with the target account; determining a target sub-transaction graph from the updated account transaction graph, the target sub-transaction graph including at least one connection relationship between the target account node and related account nodes; and determining accounts with transaction risks among the target account and related accounts based on the connection relationships in the target sub-transaction graph.

[0007] According to an embodiment of this application, updating the connection relationship between a target account node and associated account nodes in an account transaction graph based on transfer transactions includes: determining transaction information from the transfer transactions, the transaction information including transaction time and transaction amount; updating the transfer frequency between the target account node and associated account nodes based on the transaction information; updating the time anomaly between the target account node and associated account nodes based on the transaction time and historical transaction time data; and updating the connection relationship between the target account node and associated account nodes based on the updated transfer frequency and the re-evaluated time anomaly.

[0008] According to an embodiment of this application, updating the time anomaly degree between the target account node and the associated account node based on the transaction time and historical transaction time data includes: sampling the historical transaction time data to determine a first transaction period and a second transaction period, wherein the first transaction period is the time interval corresponding to the spectral peak in the time series corresponding to the historical transaction time data; constructing a sliding time window based on the first transaction period, wherein the window length of the sliding time window is an integer multiple of the first transaction period; calculating the deviation value between the transaction time and the expected transaction time, and the similarity between the transaction time and the historical transaction time data within the sliding time window; and determining the time anomaly degree between the target account node and the associated account node based on the deviation value and the similarity.

[0009] According to an embodiment of this application, determining a target sub-transaction graph from an updated account transaction graph includes: obtaining the connection relationships between various associated account nodes from the updated account transaction graph; and constructing a target sub-transaction graph based on the updated connection relationships between the target account node and associated account nodes, as well as the connection relationships between various associated account nodes.

[0010] According to embodiments of this application, determining accounts with transaction risks among target accounts and associated accounts based on the connection relationships in the target sub-transaction graph includes: for any account node in the target sub-transaction graph, obtaining all connection relationships of that account node in the target sub-transaction graph to obtain at least one target connection relationship; determining the indicator value of each target connection relationship based on the transfer frequency and time anomaly; determining the risk value of any account node based on the indicator value of each target connection relationship and the weight value of each target connection relationship; and determining that any account node has transaction risks if the risk value of any account node is greater than or equal to a preset risk value.

[0011] According to an embodiment of this application, the weight value of each target connection is determined as follows: obtaining the time information of the last update of each target connection; determining the weight value of each target connection based on the time information; wherein, the closer the update time represented by the time information is to the current time, the greater the weight value.

[0012] According to embodiments of this application, after identifying accounts with transaction risks among the target account and associated accounts, the method further includes at least one of the following: increasing the risk level of the accounts with transaction risks without changing the transaction result of the transfer transaction; stopping the execution of the transaction result of the transfer transaction until the risk verification of the accounts with transaction risks is passed; stopping the execution of the transaction result of the transfer transaction and restricting at least some of the transaction functions of the accounts with transaction risks.

[0013] A second aspect of this application provides a transaction processing apparatus based on a graph neural network. The apparatus includes: a graph update module, used to update the connection relationship between the target account node and associated account node in the account transaction graph based on the transfer transaction in response to a transfer transaction occurring in the target account; wherein the account transaction graph includes multiple account nodes, and the connection relationship between any two account nodes is determined based on the transfer frequency and time anomaly between any two account nodes, the time anomaly characterizing the degree of deviation between the transfer transaction time and the expected transaction time between the two account nodes; the target account node is the account node corresponding to the target account, and the associated account node is the account node corresponding to the account that has a transfer transaction with the target account; a sub-graph determination module, used to determine a target sub-transaction graph from the updated account transaction graph, the target sub-transaction graph including at least one connection relationship between the target account node and the associated account node; and a risk identification module, used to determine accounts with transaction risks among the target account and associated accounts based on the connection relationships in the target sub-transaction graph.

[0014] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0015] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0016] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method. Attached Figure Description

[0017] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0018] Figure 1 The illustration shows an application scenario of a transaction processing method, apparatus, device, and medium based on a graph neural network according to embodiments of this application.

[0019] Figure 2 The flowchart illustrating one of the transaction processing methods based on graph neural networks according to an embodiment of this application is shown in the illustration.

[0020] Figure 3 The flowchart illustrating the second method for transaction processing based on graph neural networks according to an embodiment of this application is shown schematically.

[0021] Figure 4 This schematically illustrates a structural block diagram of a graph neural network-based transaction processing apparatus according to an embodiment of the present application;

[0022] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a graph neural network-based transaction processing method according to an embodiment of this application. Detailed Implementation

[0023] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0024] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0025] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0026] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0027] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, application, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0028] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0029] Figure 1 The illustration schematically depicts an application scenario of a transaction processing method, apparatus, device, medium, and program product based on a graph neural network according to an embodiment of this application.

[0030] like Figure 1As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing communication links between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0031] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0032] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0033] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0034] It should be noted that the graph neural network-based transaction processing method provided in this application embodiment can generally be executed by server 105. Correspondingly, the graph neural network-based transaction processing device provided in this application embodiment can generally be located in server 105. The graph neural network-based transaction processing method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the graph neural network-based transaction processing device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0035] It should be understood that Figure 1The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0036] It should be noted that the graph neural network-based transaction processing method in this application can be applied to the fintech field, and also to cross-business scenarios between the fintech field and other related fields. For example, it can be used in scenarios such as cross-border payments, supply chain finance, insurance claims risk control, and transaction security protection for e-commerce platforms.

[0037] This application proposes a transaction processing method based on graph neural networks, aiming to address the problems of lagging rule updates, neglecting the risks of cross-institutional fund linkages, and poor user experience in traditional real-time anti-abnormal transaction technologies for financial transactions. By constructing an account transaction graph and utilizing graph neural network concepts, the method dynamically analyzes and assesses account relationships and risks during the transaction process.

[0038] The following will be based on Figure 1 The described scene, through Figures 2-3 A detailed description of the transaction processing method based on graph neural networks according to embodiments of this application is provided.

[0039] Figure 2 One of the flowcharts illustrating a graph neural network-based transaction processing method according to an embodiment of this application is shown.

[0040] like Figure 2 As shown, the transaction processing method based on graph neural networks according to the embodiments of this application includes: operations S201 to S203.

[0041] Operation S201 responds to a transfer transaction occurring in the target account by updating the connection relationship between the target account node and associated account nodes in the account transaction graph based on the transfer transaction.

[0042] In embodiments of this application, the transfer transaction can occur between two or more financial accounts, wherein the financial account can be a bank account or other application account that can support online financial transactions.

[0043] In the embodiments of this application, the account transaction graph is a graph structure composed of multiple account nodes. The nodes represent accounts, and the connection relationship between the nodes is determined based on the transfer frequency and time anomaly between accounts, which is used to intuitively present the transaction association and characteristics between accounts.

[0044] The account transaction graph includes multiple account nodes. The connection between any two account nodes is determined based on the transfer frequency and time anomaly between the two account nodes. The time anomaly represents the degree of deviation between the transfer transaction time and the expected transaction time between the two account nodes. The target account node is the account node corresponding to the target account, and the associated account node is the account node corresponding to the account that has a transfer transaction with the target account.

[0045] In the embodiments of this disclosure, the transfer frequency is used as an indicator to measure the number of transfer transactions between two account nodes within a certain period of time. It is used to characterize the frequency of transactions between accounts and is one of the factors in determining the connection relationship between account nodes.

[0046] In embodiments of this disclosure, the time anomaly score is a numerical indicator that measures the degree of deviation between the time of a current or historical transfer and the expected transaction time, and its value is in the range [0,1]. For example, a high time anomaly score indicates that the transaction occurred during an unusual time period (such as a large transfer late at night), which may be an abnormal transaction signal.

[0047] Operation S202: Determine the target sub-transaction graph from the updated account transaction graph. The target sub-transaction graph includes the connection relationship between at least one target account node and its associated account node.

[0048] Specifically, when a transfer transaction occurs in the target account, the connection relationships between the target account node and related account nodes in the account transaction graph are immediately updated based on that transfer transaction. This ensures that the account transaction graph can reflect the latest transaction information in real time. The account transaction graph contains multiple account nodes, and the connection relationship between any two account nodes is determined by the transfer frequency and time anomaly. Time anomaly measures the deviation of the transfer transaction time between two account nodes from the expected transaction time. From the updated account transaction graph, a target sub-transaction graph is determined, which contains the connection relationships between at least one target account node and related account nodes. By focusing on the sub-graph related to the target account, computational load can be reduced and the efficiency of risk analysis can be improved.

[0049] For example, in a banking system, account A transfers a certain amount of funds to account B. After detecting this transaction, the system obtains the target account node corresponding to account A and the associated account node corresponding to account B. The account transaction graph already records the connections between various account nodes based on past transfer frequencies and time anomalies. Based on this transaction, the system updates the connection relationship between account A and account B. For example, if account A and account B previously transferred funds every two weeks, the transfer frequency will be updated accordingly after this transaction. Simultaneously, the time anomaly is updated by comparing the transaction time with the expected time of previous transactions between the two. Then, from the updated account transaction graph, centered on account A, a portion containing the connection relationship between account A and account B, as well as other closely related associated account node connections, is selected to define the target sub-transaction graph. Finally, based on the connections in this target sub-transaction graph, it is determined whether there is any transaction risk between account A and account B.

[0050] Operation S203 identifies accounts with transaction risks among the target account and related accounts based on the connection relationships in the target sub-transaction graph.

[0051] Specifically, for any account in the target sub-transaction graph, each connection can be assigned a corresponding function value based on the corresponding transfer frequency and time anomaly. By combining the function values ​​corresponding to all connections of an account, a risk score is determined, thereby determining whether the account has transaction risks.

[0052] For example, in the past month, there were a total of 8 transfer transactions between account X and account Y. (Transfer frequency function) = (t represents the number of transfers within a month), then according to this function, the function value corresponding to the transfer frequency is... 0.8. Analysis of historical transaction time data determined that the expected transaction time between account X and account Y is typically between 9:00 AM and 5:00 PM on weekdays. This transaction occurred at 8:00 PM, and the calculated time anomaly is 0.7. Assume a time anomaly function is defined. ( (where the time anomaly is the degree of anomaly), then the function value corresponding to the degree of time anomaly. Furthermore, the function values ​​corresponding to the connection relationships. = (where x is the transfer frequency function value and y is the time anomaly function value), then the function value corresponding to the connection between account X and account Y is 0.8 * 0.7 = 0.56. The risk scoring function is set as follows: (n is the number of account connections, The function value corresponding to each connection relationship.

[0053] By employing the above methods, and constructing an account transaction graph and dynamically updating its connections, the transaction relationships and changes between accounts can be comprehensively and intuitively reflected. Based on this graph, target sub-transaction graphs can be identified and risks assessed. Compared to traditional methods, this approach is more effective at capturing complex transaction risk relationships, improving the accuracy and comprehensiveness of transaction risk identification. This helps financial institutions promptly detect potential abnormal transactions and safeguard funds.

[0054] According to an embodiment of this application, in operation S201, the connection relationship between the target account node and the associated account node in the account transaction graph is updated based on the transfer transaction, including operations S2011 to S2013.

[0055] Operation S2011 retrieves transaction information from transfer transactions, including transaction time and transaction amount.

[0056] Operation S2012 updates the transfer frequency between the target account node and the associated account node based on the transaction information; and updates the time anomaly between the target account node and the associated account node based on the transaction time and historical transaction time data.

[0057] In the embodiments of this disclosure, historical transaction time data is a record of the time when the target account and associated account made transfer transactions in the past, serving as an important reference for assessing the abnormality of the current transaction time.

[0058] Operation S2013 updates the connection relationship between the target account node and the associated account node based on the updated transfer frequency and the reassessed time anomaly.

[0059] Specifically, after a transfer transaction occurs in the target account, the transaction time and amount are extracted as transaction information. On one hand, the transfer frequency between the target account node and related account nodes is updated based on information such as transaction amount and number of transactions to reflect changes in the frequency of transactions between accounts. On the other hand, the time anomaly between the target account node and related account nodes is updated by combining the current transaction time with historical transaction time data. Finally, based on the updated transfer frequency and the reassessed time anomaly, the connection relationship between the target account node and related account nodes is comprehensively updated, enabling the account transaction graph to more accurately reflect the transaction relationships between accounts.

[0060] By employing the aforementioned methods, the frequency of transfers and time anomalies are updated based on transaction time and amount, thereby updating the connectivity relationships. This allows the account transaction graph to more accurately reflect the dynamic changes in transaction behavior between accounts. This refined update method enhances the graph's ability to characterize transaction features, providing a more accurate data foundation for subsequent risk assessment.

[0061] According to an embodiment of this application, in operation S202, the time anomaly degree between the target account node and the associated account node is updated based on the transaction time and historical transaction time data, including steps one to four.

[0062] Step 1: Sample the historical trading time data to determine the first trading period and the second trading period. The first trading period is the time interval corresponding to the spectral peak in the time series of the historical trading time data.

[0063] Specifically, by using a periodogram algorithm to analyze the non-uniform sampling period of historical transaction time data, and fitting the periodic components of the non-uniform sampling data using the least squares method, the trading habit cycles (such as daily or weekly cycles) between accounts can be accurately identified. For example, if two accounts typically make large transfers on Friday afternoons, but a transaction occurs in the early morning of Monday, this deviation can be identified through cycle detection. In some scenarios, the frequency grid range can be set from daily (1 / 24Hz) to monthly (1 / 30Hz), and a dynamic frequency step size adjustment strategy can be adopted to achieve a balance between computational efficiency and accuracy.

[0064] Step 2: Based on the first trading period, construct a sliding time window. The length of the sliding time window is an integer multiple of the first trading period.

[0065] Specifically, a sliding time window is constructed based on the detected period T, with the window length being an integer multiple of the main period T and the step size being T / 2.

[0066] Step 3: Within the sliding time window, calculate the deviation between the transaction time and the expected transaction time, as well as the similarity between the transaction time and historical transaction time data.

[0067] Step 4: Based on the deviation value and similarity, determine the temporal anomaly between the target account node and the associated account node.

[0068] Specifically, within the sliding window, a dynamic weight adjustment mechanism is used to calculate the deviation between the current trading time and the expected trading time, and the time anomaly degree is calculated using the following formula:

[0069] ;

[0070] in, It is the time anomaly degree of account node i. It is the deviation between the current trading time and the expected trading time; The time decay factor is 0 < <1; This is a measure of the similarity between the current transaction time and historical transaction time series. The similarity attenuation coefficient is 0 < <1.

[0071] By introducing a time decay factor and similarity attenuation coefficient This scheme allows recent transactions to have a greater impact on the calculation of time anomalies, while suppressing the interference of historical outliers. For example, when two accounts suddenly make frequent transfers outside of trading hours, The parameters will give higher weight to this recent behavior, while The parameters will reduce the impact of similarity in historical non-trading periods.

[0072] According to an embodiment of this application, determining a target sub-transaction graph from an updated account transaction graph includes: obtaining the connection relationships between various associated account nodes from the updated account transaction graph; and constructing a target sub-transaction graph based on the updated connection relationships between the target account node and associated account nodes, as well as the connection relationships between various associated account nodes.

[0073] Specifically, after the account transaction graph is updated based on transfer transactions, the connections between various related account nodes are obtained from the updated graph. Then, by combining the updated connection relationships between the target account node and related account nodes, this information is used to construct a target sub-transaction graph. In this way, the target sub-transaction graph can more comprehensively reflect the transaction network situation related to the target account, including the relationships between related accounts that have direct transaction dealings with the target account.

[0074] For example, after account A transfers funds to account B, the account transaction graph is updated. From the updated graph, in addition to obtaining the connection relationship between account A and account B, the connection relationships between other account nodes associated with account A and account B are also obtained. For example, account C is connected to account B, and account D is connected to account A. Based on these connection relationships, a target sub-transaction graph is constructed. This target sub-transaction graph not only includes the connection between account A and account B, but also the connection relationships between account C and account B, and account D and account A, comprehensively displaying the local transaction network structure related to this transfer transaction of account A.

[0075] By using the above methods, the connection relationships between various associated account nodes can be obtained, and the target sub-transaction graph can be constructed by combining the connection relationships between the target account node and associated account nodes, which can present the transaction network related to the target account more comprehensively and completely.

[0076] Figure 3 The flowchart illustrating the second method for transaction processing based on graph neural networks according to an embodiment of this application is shown schematically.

[0077] According to an embodiment of this application, based on the connection relationship in the target sub-transaction graph, accounts with transaction risks in the target account and associated accounts are identified, including operations S301 to S304.

[0078] Operation S301: For any account node in the target sub-transaction graph, obtain all the connection relationships of any account node in the target sub-transaction graph, and obtain at least one target connection relationship.

[0079] Operation S302 determines the indicator value for each target connection relationship based on transfer frequency and time anomaly.

[0080] In the embodiments of this application, the indicator value is a value calculated for each target connection based on the transfer frequency and time anomaly, which comprehensively reflects the degree of impact of the transaction characteristics represented by the connection on account risk.

[0081] Operation S303 determines the risk value of any account node based on the indicator value and weight value of each target connection.

[0082] In the embodiments of this application, the weight value is a numerical value assigned to each target connection relationship to measure the relative importance of the connection relationship in determining the risk value of the account node, and is used together with the indicator value to calculate the risk value of the account node.

[0083] Specifically, for any account node, the value calculated by comprehensively considering the indicator value and weight value of its target connection relationship is used to determine whether the account node has transaction risks. When the risk value is greater than or equal to the preset risk value, it is determined that there is a risk.

[0084] Operation S304 determines that any account node has a transaction risk if the risk value of any account node is greater than or equal to the preset risk value.

[0085] For example, taking account A in the target sub-transaction graph as an example, account A has connections with accounts B and D in the graph; these two connections are the target connections. For the target connection between account A and account B, based on the transfer frequency (e.g., 6 times a month) and time anomaly (e.g., 0.6), the indicator value is calculated to be 3.6 using a specific formula (e.g., indicator value = transfer frequency × time anomaly × time decay coefficient). Similarly, the indicator value for the target connection between account A and account D is calculated. Assuming the weight value of the connection between account A and account B is 0.6, and the weight value of the connection between account A and account D is 0.4, the risk value of account A is calculated by weighted calculation (risk value = indicator value of account A and account B × weight value + indicator value of account A and account D × weight value) as 3.6 × 0.6 + another indicator value × 0.4. If the preset risk value is 2, and the calculated risk value is greater than the preset risk value, then account A is determined to have transaction risk.

[0086] By employing the above method, for each account node in the target sub-transaction graph, indicator values ​​for the target connection relationship are determined based on transfer frequency and time anomaly. These values ​​are then combined with weighted values ​​to calculate a risk value, which is finally compared with a preset risk value to assess risk. This multi-factor comprehensive evaluation fully considers all aspects of the transaction relationship between accounts. Compared to single-factor judgment, it can more comprehensively and accurately identify the transaction risk of an account.

[0087] According to an embodiment of this application, the weight value of each target connection is determined as follows: obtaining the time information of the last update of each target connection; determining the weight value of each target connection based on the time information; wherein, the closer the update time represented by the time information is to the current time, the greater the weight value.

[0088] In the embodiments of this disclosure, time information represents the time record of the last update of each target connection relationship, which is used to determine the weight value of the connection relationship and reflect the timeliness of the connection relationship.

[0089] For example, regarding the target connection between account A and account B, assume its last update time was yesterday, while the target connection between account A and account D was last updated a week ago. The weight values ​​are determined based on the time information. Since yesterday is closer to the current time, the weight value for the connection between account A and account B is set to 0.6, and the weight value for the connection between account A and account D is set to 0.4. As time progresses, if a new transaction occurs between account A and account D today, their connection will be updated. At this time, the weight value of that connection will increase, for example, to 0.7, while the weight value for account A and account B may remain unchanged because it has not been updated, or it may decrease slightly according to the set rules.

[0090] By employing the above method, weight values ​​are determined based on the update time information of connection relationships, fully considering the timeliness of transaction relationships. Recently updated connection relationships have a greater impact on current transaction risk and are given higher weight values, enabling risk assessment to reflect the latest transaction dynamics more promptly. This avoids misjudgments of risk due to ignoring recent transaction changes, improving the timeliness and accuracy of risk assessment.

[0091] According to embodiments of this application, after identifying the target account and associated accounts with transaction risks, the method further includes at least one of the following.

[0092] Method 1: Increase the risk level of accounts with transaction risks without changing the transaction outcome.

[0093] For example, without changing the outcome of this transfer transaction, the risk level of account A is upgraded from "low risk" to "medium risk". Record the time and reason for the risk level upgrade (this transfer transaction triggered the risk assessment), etc. Subsequently, the monitoring frequency for medium-risk accounts will be increased; for example, instead of a monthly routine risk assessment for low-risk accounts, account A will now be assessed every two weeks.

[0094] Option 2: Stop executing the transfer transaction until the risk verification of the account with transaction risk is passed.

[0095] For example, upon determining that account A poses a transaction risk, the execution of the current transfer transaction is immediately suspended, and the account is temporarily placed in a suspended transaction state. A notification is sent to the user of account A, informing them that the transaction is suspended due to risk reasons and requiring them to complete risk verification through a specific channel (such as the risk verification process in the mobile banking app). For example, the user may be required to provide additional identity verification information, such as recent spending receipts and explanations of the source of funds. After uploading the relevant supporting documents to the mobile banking app, the user of account A undergoes a review. If the review is successful, confirming that the transaction risk has been eliminated, the transfer transaction is resumed, and the funds are transferred to account B; if the review fails, the transaction remains suspended.

[0096] Method 3: Stop executing the transaction results of the transfer and restrict at least some of the transaction functions of the account with transaction risks.

[0097] For example, once it is determined that account A poses a transaction risk, the execution of the current transfer transaction should be immediately halted, and certain transaction function restrictions should be imposed on account A. For instance, the daily outward transfer limit for account A could be reduced from 100,000 yuan to 10,000 yuan, and cross-border transfers could be prohibited. A notification should be sent to account A's user explaining the reason for the transaction halt and the restricted transaction functions. If account A does not trigger any further risk warnings within a subsequent period (e.g., one month), the account risk can be reassessed to determine whether to restore its original transaction functions.

[0098] In the embodiments of this disclosure, the above three methods for handling accounts with transaction risks among the target account and associated accounts can be determined based on the degree to which the risk value exceeds a preset risk value. For example, when the risk value exceeds a first preset risk value, the risk level of the account with transaction risks is increased without changing the transaction result of the transfer transaction. Another example is that when the risk value exceeds a second preset risk value, the execution of the transfer transaction is stopped until the risk verification of the account with transaction risks is passed. Yet another example is that when the risk value exceeds a third preset risk value, the execution of the transfer transaction is stopped, and at least some of the transaction functions of the account with transaction risks are restricted. Wherein, the third preset risk value is greater than the second preset risk value, which is greater than the first preset risk value.

[0099] Based on the above-mentioned graph neural network-based transaction processing method, this application provides a graph neural network-based transaction processing apparatus, which will be described below in conjunction with... Figure 4 The device is described in detail.

[0100] Figure 4 A schematic block diagram of a graph neural network-based transaction processing apparatus according to an embodiment of this application is shown.

[0101] like Figure 4 As shown, the graph neural network-based transaction processing device 400 of this embodiment includes a graph update module 410, a sub-graph determination module 420, and a risk identification module 430.

[0102] According to an embodiment of this application, the graph update module 410 is used to update the connection relationship between the target account node and the associated account node in the account transaction graph based on the transfer transaction in response to a transfer transaction of the target account; wherein, the account transaction graph includes multiple account nodes, and the connection relationship between any two account nodes is determined based on the transfer frequency and time anomaly between any two account nodes, and the time anomaly characterizes the degree of deviation between the transfer transaction time and the expected transaction time between the two account nodes; the target account node is the account node corresponding to the target account, and the associated account node is the account node corresponding to the account that has a transfer transaction with the target account; the sub-graph determination module 420 is used to determine the target sub-graph from the updated account transaction graph, and the target sub-graph includes at least one connection relationship between the target account node and the associated account node; the risk identification module 430 is used to determine the target account and the associated account that have transaction risks based on the connection relationship in the target sub-graph.

[0103] According to an embodiment of this application, the graph update module 410 is further configured to determine transaction information from the transfer transaction, the transaction information including transaction time and transaction amount; update the transfer frequency between the target account node and the associated account node according to the transaction information; update the time anomaly between the target account node and the associated account node according to the transaction time and historical transaction time data; and update the connection relationship between the target account node and the associated account node according to the updated transfer frequency and the re-evaluated time anomaly.

[0104] According to an embodiment of this application, the graph update module 410 is further configured to sample and process historical transaction time data to determine a first transaction period and a second transaction period, wherein the first transaction period is the time interval corresponding to the spectral peak in the time series corresponding to the historical transaction time data; based on the first transaction period, a sliding time window is constructed, the window length of which is an integer multiple of the first transaction period; within the sliding time window, the deviation value between the transaction time and the expected transaction time, as well as the similarity between the transaction time and the historical transaction time data, are calculated; based on the deviation value and the similarity, the time anomaly degree between the target account node and the associated account node is determined.

[0105] According to an embodiment of this application, the sub-graph determination module 420 is further configured to obtain the connection relationship between each associated account node from the updated account transaction graph; and construct the target sub-transaction graph based on the updated connection relationship between the target account node and the associated account node, as well as the connection relationship between each associated account node.

[0106] According to an embodiment of this application, the risk identification module 430 is further configured to: obtain all connection relationships of any account node in the target sub-transaction graph to obtain at least one target connection relationship; determine the indicator value of each target connection relationship based on the transfer frequency and time anomaly; determine the risk value of any account node based on the indicator value of each target connection relationship and the weight value of each target connection relationship; and determine that any account node has transaction risk if the risk value of any account node is greater than or equal to a preset risk value.

[0107] According to an embodiment of this application, the risk identification module 430 is further configured to determine the weight value of each target connection relationship; specifically, it is configured to obtain the time information of the last update of each target connection relationship; and determine the weight value of each target connection relationship based on the time information; wherein, the closer the update time represented by the time information is to the current time, the greater the weight value.

[0108] According to an embodiment of this application, the graph neural network-based transaction processing apparatus 400 further includes a risk processing module.

[0109] According to an embodiment of this application, the risk processing module is used to, after identifying accounts with transaction risks among the target account and associated accounts, increase the risk level of the accounts with transaction risks without changing the transaction result of the transfer transaction; or stop executing the transaction result of the transfer transaction until the risk verification of the accounts with transaction risks is passed; or stop executing the transaction result of the transfer transaction and restrict at least some of the transaction functions of the accounts with transaction risks.

[0110] According to embodiments of this application, any plurality of modules among the map update module 410, sub-map determination module 420, and risk identification module 430 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in one module. According to embodiments of this application, at least one of the map update module 410, sub-map determination module 420, and risk identification module 430 can be at least partially implemented as hardware circuitry, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuitry, or implemented in software, hardware, or firmware, or in any appropriate combination of any of these three implementation methods. Alternatively, at least one of the map update module 410, sub-map determination module 420, and risk identification module 430 can be at least partially implemented as a computer program module, which, when run, can perform corresponding functions.

[0111] Figure 5 A block diagram schematically illustrates an electronic device suitable for implementing a graph neural network-based transaction processing method according to an embodiment of this application.

[0112] like Figure 5 As shown, an electronic device 500 according to an embodiment of this application includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage portion 508 into a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0113] RAM 503 stores various programs and data required for the operation of electronic device 500. Processor 501, ROM 502, and RAM 503 are interconnected via bus 504. Processor 501 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 502 and / or RAM 503. It should be noted that programs may also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in one or more memories.

[0114] According to embodiments of this application, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to a bus 504. The electronic device 500 may also include one or more of the following components connected to the input / output (I / O) interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 510 as needed so that computer programs read from it can be installed into the storage section 508 as needed.

[0115] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the graph neural network-based transaction processing method according to the embodiments of this application.

[0116] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 502 and / or RAM 503 and / or one or more memories other than ROM 502 and RAM 503 described above.

[0117] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the graph neural network-based transaction processing method provided in the embodiments of this application.

[0118] When the computer program is executed by the processor 501, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0119] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and may be downloaded and installed via the communication section 509, and / or installed from a removable medium 511. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0120] In such an embodiment, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by processor 501, it performs the functions defined in the system of this application embodiment. According to embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0121] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, C, or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0122] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0123] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

Claims

1. A transaction processing method based on graph neural networks, characterized in that, The method includes: In response to a transfer transaction occurring in the target account, the connection relationship between the target account node and associated account nodes in the account transaction graph is updated based on the transfer transaction; The account transaction graph includes multiple account nodes. The connection between any two account nodes is determined based on the transfer frequency and time anomaly between the two account nodes. The time anomaly represents the degree of deviation between the transfer transaction time and the expected transaction time between the two account nodes. The target account node is the account node corresponding to the target account, and the associated account node is the account node corresponding to the account that has a transfer transaction with the target account. A target sub-transaction graph is determined from the updated account transaction graph, wherein the target sub-transaction graph includes at least one connection relationship between the target account node and the associated account node; Based on the connection relationships in the target sub-transaction graph, accounts with transaction risks among the target account and the associated accounts are identified.

2. The method according to claim 1, characterized in that, The connection relationship between the target account node and associated account node in the account transaction graph is updated based on the transfer transaction, including: Transaction information is determined from the transfer transaction, including the transaction time and transaction amount; Based on the transaction information, update the transfer frequency between the target account node and the associated account node; and based on the transaction time and historical transaction time data, update the time anomaly between the target account node and the associated account node. Based on the updated transfer frequency and the reassessed time anomaly, the connection relationship between the target account node and the associated account node is updated.

3. The method according to claim 2, characterized in that, Based on the transaction time and historical transaction time data, update the time anomaly degree between the target account node and the associated account node, including: The historical transaction time data is sampled and processed to determine the first transaction period and the second transaction period, wherein the first transaction period is the time interval corresponding to the spectral peak in the time series corresponding to the historical transaction time data; Based on the first transaction period, a sliding time window is constructed, wherein the window length of the sliding time window is an integer multiple of the first transaction period; Within the sliding time window, the deviation between the transaction time and the expected transaction time, as well as the similarity between the transaction time and the historical transaction time data, are calculated. Based on the deviation value and the similarity, the temporal anomaly degree between the target account node and the associated account node is determined.

4. The method according to claim 1, characterized in that, The step of determining the target sub-transaction graph from the updated account transaction graph includes: Obtain the connection relationships between each associated account node from the updated account transaction graph; Based on the updated connection relationships between the target account node and associated account nodes, as well as the connection relationships between each associated account node, the target sub-transaction graph is constructed.

5. The method according to claim 1 or 4, characterized in that, Based on the connections in the target sub-transaction graph, accounts with transaction risks among the target account and associated accounts are identified, including: For any account node in the target sub-transaction graph, obtain all the connection relationships of the account node in the target sub-transaction graph to obtain at least one target connection relationship; Based on the transfer frequency and the time anomaly, determine the indicator value for each target connection relationship; The risk value of any account node is determined based on the indicator value of each target connection and the weight value of each target connection. If the risk value of any account node is greater than or equal to a preset risk value, then the account node is determined to have transaction risk.

6. The method according to claim 5, wherein the weight value of each target connection is determined in the following manner: Obtain the time information of the last update of each target connection relationship; Based on the time information, a weight value for each target connection is determined; wherein, The closer the update time of the time information representation is to the current time, the greater the weight value.

7. The method according to claim 1, characterized in that, After identifying the target account and the associated accounts that pose a transaction risk, the method further includes at least one of the following: Without changing the transaction outcome of the transfer, increase the risk level of the account with transaction risk; The transaction result of the transfer will be suspended until the risk verification of the account with transaction risk is passed; The transaction result of the transfer is stopped, and at least some of the transaction functions of the account with transaction risk are restricted.

8. A transaction processing device based on a graph neural network, characterized in that, The device includes: The graph update module is used to update the connection relationship between the target account node and the associated account node in the account transaction graph based on the transfer transaction in response to a transfer transaction of the target account. The account transaction graph includes multiple account nodes. The connection between any two account nodes is determined based on the transfer frequency and time anomaly between the two account nodes. The time anomaly represents the degree of deviation between the transfer transaction time and the expected transaction time between the two account nodes. The target account node is the account node corresponding to the target account, and the associated account node is the account node corresponding to the account that has a transfer transaction with the target account. The sub-graph determination module is used to determine a target sub-transaction graph from the updated account transaction graph, wherein the target sub-transaction graph includes at least one connection relationship between the target account node and the associated account node; The risk identification module is used to identify accounts with transaction risks among the target account and the associated accounts based on the connection relationships in the target sub-transaction graph.

9. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 7.

Images