Complex fund chain intelligent management and anomaly detection method based on deep learning model

Abstract

The invention discloses a complex fund chain intelligent management and anomaly detection method based on a deep learning model, and the method comprises the steps: capturing a fund flow network structure between accounts through building a fund topological relation, extracting the periodicity and trend characteristics of a transaction sequence through combining a time sequence neural network, and calculating a reconstruction error through an anomaly detection model, thereby achieving the intelligent management of a fund chain. Quantifying transaction deviations and identifying anomalies; if the abnormal score exceeds a threshold value, backtracking a risk conduction chain through a path tracking method, revealing an abnormal fund propagation path, simulating future fund transfer scale and direction by using a flow prediction model, comparing with a historical risk threshold value, judging potential fluctuation, and generating a real-time early warning signal; according to the method, full-chain analysis from anomaly detection to risk prediction is realized through multi-model fusion, the accuracy and timeliness of risk identification in financial transactions are remarkably improved, and effective technical support is provided for prevention of systematic financial risks.

Description

Technical Field

[0001] This invention relates to the field of financial management and risk control technology, and in particular discloses a method for intelligent management and anomaly detection of complex capital chains based on a deep learning model. Background Technology

[0002] In the field of financial management and risk control, intelligent management and anomaly detection of the capital chain are particularly important. This area is directly related to financial security, stable corporate operations, and the maintenance of social and economic order, and is a crucial line of defense against improper transactions. With the increasing complexity of capital flows, involving multiple parties, multi-level relationships, and cross-scenario transactions, effectively monitoring and identifying risks has become a critical issue that urgently needs to be addressed.

[0003] Currently, while many traditional methods play a role in fund management, their limitations are becoming increasingly apparent. These methods often rely on pre-set rules or manual review, making it difficult to adapt to the ever-changing patterns and hidden risks in fund flows. Especially when dealing with multi-entity, multi-level transactions, existing methods often fail to fully capture the overall flow of funds, easily overlooking deeper interconnected issues and leading to the omission or delayed detection of potential threats.

[0004] A deeper technical challenge lies in accurately reconstructing and understanding the topological relationships in fund flows—that is, the paths and structures of funds flowing between different entities. Because fund chains often involve multiple layers of transfers, cross-linking, and dynamic changes, it is difficult to fully construct a complete picture of fund flows using traditional analytical methods alone. This complexity of topological relationships directly leads to difficulties in risk identification; for example, certain abnormal behaviors may be hidden in seemingly normal transaction chains, making them difficult to detect in a timely manner.

[0005] Specifically, in actual business operations, the complex topology of the capital chain may manifest as hidden backflow behavior in multi-layered transfers. For example, a sum of money flows from Party A to Party B, and then returns to Party A through multiple intermediary accounts, forming a closed loop. This behavior may involve inflating transaction volume or evading supervision, but due to the multiple layers of transfers and the dispersed paths, it is difficult to identify this abnormal pattern manually or with simple rules.

[0006] Therefore, how to accurately characterize and analyze topological relationships in multi-level and cross-entity fund flows, and discover hidden abnormal behaviors, has become a key problem that urgently needs to be solved. Summary of the Invention

[0007] This invention provides a method for intelligent management and anomaly detection of complex capital chains based on a deep learning model, aiming to solve at least one of the defects in the existing technology.

[0008] This invention relates to a method for intelligent management and anomaly detection of complex financial chains based on a deep learning model, comprising the following steps: S100. Collect multi-entity transfer data from financial institutions, including fund transfer records between multiple accounts; S200. A graph learning model is used to process the relationships between nodes in multi-entity transfer data to obtain the fund topology, which represents the network structure of fund flow between accounts. S300. Based on the capital topology, a time-series neural network is used to capture the characteristics of transaction sequences and obtain time-series pattern. The time-series pattern reflects the periodicity and trend of capital transfer. S400: The anomaly detection model is used to reconstruct the time series pattern error and determine the anomaly detection score. The anomaly detection score is used to quantify the degree of deviation of the trading pattern. S500 If the anomaly detection score exceeds the preset threshold, the associated path is traced back through the path tracing method to obtain the risk transmission chain. The risk transmission chain reveals the propagation path of abnormal funds from the source to the downstream. S600. Based on the risk transmission chain, a liquidity forecasting model is used to simulate future capital flows and obtain capital forecasting results, which include the potential scale and direction of capital transfers. S700: By comparing the results of capital prediction with the threshold for abnormal behavior, potential fluctuations are identified and real-time early warning signals are obtained. The threshold for abnormal behavior is set based on historical risk data, and potential fluctuations refer to the magnitude of abnormal changes in capital flows.

[0009] Further, step S100 includes: S110. Obtain the original message streams distributed across different financial nodes, and parse the original message streams to generate a standardized transaction record sequence; S120. Determine the directed connection relationships between nodes based on the standardized transaction record sequence, and construct a multi-entity capital topology network; S130. The multi-entity capital topology network is sorted in time sequence by transaction timestamps to obtain a dynamic capital flow graph. S140. Aggregate continuous fund transfer chains in the dynamic fund flow graph to obtain multi-entity transfer data, which includes complete fund flow and account relationships.

[0010] Further, step S200 includes: S210. Obtain the account transaction amount and interaction frequency from the multi-entity transfer data, and construct the unprocessed graph structure data containing node feature vectors and initial edge weights; S220. Input the graph structure data to be processed into the graph neural network model, and update the node feature vectors to generate node embedding representations; S230. Establish potential related edges based on node embedding representation, and identify closed-loop paths for fund return for potential related edges to obtain the corrected network connection set. S240. Generate a fund topology relationship based on the modified network connection set. The fund topology relationship represents the network structure of fund flow between accounts.

[0011] Further, step S300 includes: S310. Extract historical transaction records based on the capital topology and generate a multi-dimensional transaction time series; S320. Input the multidimensional transaction time series into the long short-term memory network model and output the hidden state sequence. S330. Apply a self-attention mechanism to the hidden state sequence to generate a transaction sequence feature vector; S340. Perform frequency domain analysis and trend fitting on the feature vector of the transaction sequence to obtain the cycle period and long-term evolution slope of the capital flow. S350. Based on the cycle period and the slope of the long-term evolution direction, a time-series pattern is obtained, which reflects the periodicity and trend of capital transfer.

[0012] Further, step S400 includes: S410. Obtain the set of input data to be detected, which is constructed from multi-dimensional feature vectors mapped by time-series regularity patterns. S420. Input the set of input data to be detected into the deep autoencoder model to obtain reconstructed feature data. The reconstructed feature data is obtained by restoring the compressed latent feature representation. S430. Calculate the reconstruction error between the input data set to be detected and the reconstructed feature data. S440. Determine the anomaly detection score based on the statistical deviation of the reconstruction error value in the historical benchmark error distribution model. The anomaly detection score is used to quantify the degree of deviation of the trading pattern.

[0013] Further, step S500 includes: S510. If the anomaly detection score exceeds the preset threshold, the abnormal transaction account node is locked and the transaction association network topology data with the abnormal transaction account node as the vertex is extracted. S520. Based on the transaction-related network topology data, traverse downstream related nodes to generate a candidate fund propagation path set, and select key fund flow path data from the candidate fund propagation path set based on the fund transfer weight value. S530. Sort and connect the key fund flow path data according to the order of transaction occurrence to construct a directed acyclic graph data object for risk transmission. S540. Perform full-path backtracking analysis on the directed acyclic graph data objects of risk transmission to obtain the risk transmission chain. The risk transmission chain reveals the propagation path of abnormal funds from the source to the downstream.

[0014] Further, step S600 includes: S610. Obtain historical transaction time series data of nodes in the risk transmission chain, and use the long short-term memory network to extract the time series feature vector of capital fluctuation in the historical transaction time series data. S620. Construct a Markov state transition space based on the time-series feature vector of capital fluctuations, and input the current capital stock into the Markov state transition space to generate a simulated capital flow trajectory. S630. Statistically aggregate the simulated capital flow trajectory to obtain the expected value of capital flow, and determine the capital convergence trend based on the expected value of capital flow; S640. Based on the trend of capital convergence, identify the main flow branches and perform quantitative calculations to obtain capital prediction results that include the potential scale and direction of capital transfer.

[0015] Further, step S700 includes: S710. Obtain fund flow samples from historical risk data, and use the kernel density estimation method to fit the probability density function of the fund flow samples to determine the set of abnormal behavior thresholds. S720. Calculate the joint probability density value of the funding prediction results in the abnormal behavior threshold set; S730. If the joint probability density value is lower than the critical value, calculate the offset of the scale of fund transfer relative to the center point of the abnormal behavior threshold set to obtain the abnormal change range of fund flow. S740. Based on the abnormal change range, when the offset value continues to fluctuate at a high level, a real-time early warning signal is triggered to lock in a specific risk transmission chain.

[0016] The beneficial effects achieved by this invention are as follows: This invention provides a method for intelligent management and anomaly detection of complex capital chains based on deep learning models. Addressing the problem of abnormal capital flows and risk transmission hidden in multi-entity transfer data within financial institutions, it captures the network structure of capital flows between accounts by constructing capital topology relationships. It then extracts the periodicity and trend characteristics of transaction sequences using a temporal neural network. The anomaly detection model calculates reconstruction errors, quantifies transaction deviations, and identifies anomalies. If the anomaly score exceeds a threshold, a path tracing method is used to trace the risk transmission chain, revealing the abnormal capital propagation path. A flow prediction model simulates the future scale and direction of capital transfers, compares this with historical risk thresholds, assesses potential fluctuations, and generates real-time early warning signals. This invention achieves full-chain analysis from anomaly detection to risk prediction through multi-model fusion, significantly improving the accuracy and timeliness of risk identification in financial transactions and providing effective technical support for preventing systemic financial risks. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of the intelligent management and anomaly detection method for complex capital chains based on deep learning models according to the present invention. Detailed Implementation

[0018] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0019] like Figure 1 As shown, the first embodiment of the present invention proposes a method for intelligent management and anomaly detection of complex capital chains based on a deep learning model, including the following steps: Step S100: Collect multi-entity transfer data from financial institutions. Multi-entity transfer data includes fund transfer records between multiple accounts.

[0020] Through channels such as financial institutions' transaction system interfaces and core business databases, comprehensive multi-entity transfer data covering various entities including enterprises, individuals, and institutions is collected. The core of this multi-entity transfer data includes fund transfer records between multiple accounts (such as transaction account ID, transaction amount, transaction time, transfer direction, transaction remarks, and account type). The collected multi-entity transfer data undergoes preprocessing such as format standardization, missing value completion, and duplicate record removal to ensure data integrity and consistency, ultimately forming a structured raw dataset of fund transactions. This step forms the data source foundation for subsequent fund chain topology construction and anomaly detection, directly determining the coverage and accuracy of subsequent analysis.

[0021] Multi-entity transfer data refers to structured transaction data collected from financial institutions' transaction systems and core business databases, containing information related to fund transfers between different types of account holders, such as enterprises, individuals, and institutions. Multi-entity transfer data includes transaction account ID, transaction amount, transaction time, transfer direction, transaction remarks, and account holder type. After preprocessing such as format standardization, missing value completion, and duplicate record removal, it forms the raw dataset used for fund chain topology construction and anomaly detection, serving as the fundamental data source for intelligent management of complex fund chains.

[0022] Step S200: Use a graph learning model to process the relationships between nodes in the multi-entity transfer data to obtain the fund topology relationship, which represents the network structure of fund flow between accounts.

[0023] The multi-entity transfer data collected in step S100 is input into a preset graph learning model (such as GCN (Graph Convolutional Network), GAT (Graph Attention Network), GraphSAGE (Graph Sampling and Aggregation), etc.). First, each transaction account is abstracted as a node in the graph model, and the fund transfer behavior between accounts is abstracted as directed edges between nodes (edge ​​attributes include transaction amount, transaction frequency, transaction time, etc.). Through the core operations of the graph learning model such as node embedding and neighborhood aggregation, hidden relationships between nodes (accounts) (such as indirect transfer relationships and high-frequency trading circles) are mined, and finally, a fund topology relationship is generated. This fund topology relationship fully represents the fund flow network structure between accounts in the form of a graph structure, covering core information such as the strength of account association, hierarchical relationship, and trading circles, which solves the pain point of traditional fund analysis that "views a single transaction in isolation and ignores network relationships".

[0024] The fund topology relationship is generated by processing multi-entity transfer data through a graph learning model. It represents the network structure and related information of fund flows between accounts in the form of a graph structure. The fund flow network structure is a directed weighted topology network formed by processing multi-entity transfer data as the data source and the graph learning model. Its core construction logic is to abstract various transaction accounts as network nodes and the fund transfer behavior between accounts as directed edges between nodes. The edge attributes include key information such as transaction amount, transaction frequency, and transaction time. This fund flow network structure can completely restore the overall topology of complex fund chains, intuitively present the fund flow direction, volume, correlation strength, and transmission path between accounts. At the same time, it carries hidden information such as indirect account correlations and high-frequency trading circles mined by the graph learning model. It solves the pain point of traditional fund analysis that looks at individual transactions in isolation and ignores network correlations, and provides structured network support for deep learning models to learn fund flow patterns and identify abnormal paths.

[0025] Step S300: Based on the capital topology, a time-series neural network is used to capture the characteristics of the transaction sequence to obtain a time-series pattern, which reflects the periodicity and trend of capital transfer.

[0026] Based on the capital topology established in step S200, time-series transaction data (such as transaction amount and frequency sequences by hour / day / week) are extracted from each account / transaction link and input into a temporal neural network (such as LSTM (Long Short-Term Memory), GRU (Gated Recurrent Unit), TCN (Temporal Convolutional Network), etc.). Utilizing the memory characteristics and sequence modeling capabilities of the temporal neural network, the temporal patterns of capital transfer are captured. These temporal patterns include the periodicity of capital flow (such as batch transfers on fixed dates each month), trends (such as gradual increases / decreases in amount), and correlations (such as linked transactions of account B within a certain period after account A's transaction). This achieves the fusion mining of the dual features of the capital chain—"spatial topology + time series"—providing multi-dimensional feature basis for anomaly detection.

[0027] The time-series pattern is a set of patterns generated by processing time-series transaction data through a time-series neural network, reflecting the periodicity, trend, and correlation characteristics of fund transfers. Its generation process is as follows: Based on the fund topology constructed in step S200, time-series transaction data (such as transaction amount and frequency sequences by hour, day, and week) for each account or transaction link is extracted and input into the time-series neural network. Utilizing the memory characteristics and sequence modeling capabilities of the time-series neural network, the core patterns of fund transfers are mined and extracted, specifically including periodicity (such as batch transfers on fixed dates each month), trend (such as gradually increasing or decreasing transaction amounts), and correlation (such as linked transactions of account B within a certain period after account A's transaction), achieving the fusion mining of the dual characteristics of the fund chain's "spatial topology + time series." This time-series pattern fully reflects the time-dimensional patterns of fund transfers, connects the spatial correlation characteristics of the fund topology, and provides multi-dimensional feature basis for subsequent fund anomaly detection. It is the core output of the time-series analysis stage in the intelligent management of complex fund chains.

[0028] Step S400: Calculate the reconstruction error of the time series pattern using the anomaly detection model to determine the anomaly detection score. The anomaly detection score is used to quantify the degree of deviation of the trading pattern.

[0029] The temporal pattern extracted in step S300 is input into an anomaly detection model (such as an autoencoder, variational autoencoder, or isolated forest). The core of the anomaly detection is based on the concept of "normal pattern reconstruction." First, the anomaly detection model learns the temporal pattern of normal capital transactions. Then, it reconstructs the input real-time trading pattern, calculating the reconstruction error (the deviation between the "normal pattern" output by the anomaly detection model and the actual input "real-time pattern"). This reconstruction error is standardized and converted into an anomaly detection score. This score quantitatively represents the degree to which the current trading pattern deviates from normal patterns—a higher score indicates a more abnormal trading pattern, and vice versa. This step transforms abnormal trading from "qualitative judgment" to "quantitative analysis," improving the objectivity of anomaly identification.

[0030] Step S500: If the anomaly detection score exceeds the preset threshold, the associated path is traced back using the path tracing method to obtain the risk transmission chain. The risk transmission chain reveals the propagation path of abnormal funds from the source to the downstream.

[0031] The anomaly detection score obtained in step S400 is compared with a preset anomaly threshold (based on industry compliance standards and historical anomaly cases). If the score does not exceed the threshold, the transaction is deemed normal and the process terminates. If the score exceeds the threshold, a risk tracing mechanism is immediately triggered. Path tracing methods (such as depth-first search and breadth-first search) are used to trace the association path of the abnormal account in the fund topology, sorting out each layer of the transfer link from the source account (initial abnormal transaction account) to the downstream related accounts, clarifying the transaction amount, time, and account relationship at each step, and finally generating a risk transmission chain. This risk transmission chain intuitively reveals the propagation path of abnormal funds, the accounts involved, and the scale of transfer, solving the problem of traditional anomaly detection "only finding anomalies but not finding the source".

[0032] The risk transmission chain refers to the structured chain set generated when the anomaly detection score exceeds a preset threshold. This chain is used to trace the relationship between abnormal accounts in the fund topology through path tracing methods. It is used to reveal the complete propagation path of abnormal funds from the source to the downstream. It covers the account associations, transaction information and transmission levels of abnormal fund transfers, and provides intuitive chain evidence for abnormal fund tracing and risk control. The generation process is as follows: The anomaly detection score obtained in step S400 is compared with a preset anomaly threshold (based on industry compliance standards and historical anomaly cases). When the anomaly detection score exceeds the threshold, a risk tracing mechanism is triggered. Path tracing methods (such as depth-first search and breadth-first search) are used to trace the association path of the abnormal account in the fund topology, sorting out each layer of the transfer link from the source account (initial abnormal transaction account) to the downstream related accounts, clarifying the transaction amount, transaction time, and account relationship at each step. The final generated risk transmission chain can intuitively reveal the propagation path of abnormal funds, the accounts involved, and the scale of transfer, solving the problem of traditional anomaly detection "only finding anomalies but not finding the source." It provides clear link support for anomaly fund tracing, risk disposal, and compliance verification, and is the core output of complex fund chain anomaly detection and risk management.

[0033] Step S600: Based on the risk transmission chain, use a liquidity forecasting model to simulate future capital flows and obtain capital forecasting results, which include the potential scale and direction of capital transfers.

[0034] Using the risk transmission chain obtained in step S500 as the core input, and combining historical capital flow data, macroeconomic financial environment, and other auxiliary information, the data is input into a flow prediction model (such as a fusion model of time series prediction model and graph attention mechanism). The flow prediction model simulates the future flow trend of abnormal funds along the risk transmission chain, quantifying and predicting the potential scale of fund transfers (such as the possible transfer amount in the next 24 hours), transfer direction (such as the possible downstream accounts / industries / regions), and transfer speed, ultimately generating the capital prediction result. This step achieves an upgrade from "post-event anomaly detection" to "pre-event risk prediction," gaining more time for risk management.

[0035] The liquidity prediction model is an intelligent prediction model that uses the risk transmission chain as its core input and combines auxiliary information to simulate future capital flows and predict the scale and direction of capital transfers. Its core function is to receive the risk transmission chain obtained in step S500 as its core input, while integrating historical capital flow data, macroeconomic financial environment, and other auxiliary information. Through the liquidity prediction model's built-in sequence modeling, correlation mining, and trend extrapolation capabilities, it simulates the future flow trends of abnormal funds along the risk transmission chain, quantifies and predicts key parameters of potential capital transfers, including the scale of capital transfers (such as the possible transfer amount in the next 24 hours), the direction of transfer (such as the possible downstream accounts, industries, and regions), and the speed of transfer, ultimately outputting standardized capital prediction results. This liquidity prediction model upgrades capital risk from "post-event anomaly detection" to "pre-event risk prediction," effectively gaining advance time for risk management and providing accurate predictive support for subsequent risk disposal decisions. It is the core carrier of the risk prediction link in the intelligent management of complex capital chains.

[0036] Step S700: By comparing the fund prediction results with the abnormal behavior threshold, potential fluctuations are judged and real-time early warning signals are obtained. The abnormal behavior threshold is set based on historical risk data, and potential fluctuations refer to the abnormal change range of fund flows.

[0037] The fund prediction results (potential fund transfer scale, direction, and magnitude) obtained in step S600 are compared with preset abnormal behavior thresholds (set based on historical risk data and regulatory requirements, such as single-account single-day abnormal transfer amount threshold and cross-regional transfer magnitude threshold) to determine whether there are potential fluctuations in fund flows exceeding the thresholds (i.e., abnormal changes in fund flows). If potential fluctuations are determined to exist, a real-time early warning signal is immediately generated (divided into Level 1 / Level 2 / Level 3 warnings according to risk level, including the warning account, potential risk scale, and expected impact range), and pushed to the financial institution's risk control system or regulatory platform. If the thresholds are not exceeded, the normal transaction baseline is updated, and the threshold parameters of the subsequent abnormal detection model are optimized. This step forms a complete closed loop of "detection-source tracing-prediction-early warning," realizing intelligent management and real-time risk control of complex fund chains.

[0038] Furthermore, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S100 as follows: Step S110: Obtain the original message streams distributed across different financial nodes, and parse the original message streams to generate a standardized transaction record sequence.

[0039] The standardized transaction record sequence is derived using the following formula: (1) In formula (1), Represents a standardized sequence of transaction records. arrive This indicates the transaction record generated after parsing. This represents the total number of transaction records. The control logic of formula (1) is to parse the raw message streams obtained from different financial nodes, extract and standardize the transaction information, and then organize it into an ordered sequence of transaction records according to time order or logical order. This provides unified and structured input data for subsequent deep learning models. The ordered sequence structure completely preserves the temporal relationship of transaction behavior, providing a foundation for time series analysis and deep learning modeling. In scenarios such as financial risk control, anti-fraud, and complex capital chain management, this is the primary data preprocessing step in building an intelligent analysis system.

[0040] Standardized transaction records are derived using the following formula: (2) In formula (2), This indicates the generated number after parsing. One transaction record, Represents an analytic function. Indicates the first in the original message stream Each message. The control logic of formula (2) processes the heterogeneous original messages through analytical functions, extracts key transaction information and unifies the format, generates standardized transaction records, and provides unified input for subsequent sequence organization and deep learning modeling. It is a key transformation step from raw data to usable analytical data in the intelligent management and anomaly detection system of complex capital chains.

[0041] In the financial sector, acquiring raw message streams distributed across different financial nodes is fundamental to constructing fund flow analysis. Raw message streams typically consist of original data records generated by nodes such as banks and payment institutions during transactions, containing information such as transaction amounts, account information, and timestamps. Assuming a bank system processes millions of transactions daily, these raw message streams are stored as logs in various formats, including text and XML. When parsing these raw message streams, customized parsing tools are used to extract data from different formats into a standardized sequence of transaction records. For example, each transaction could be formatted as "Account A transferred 1000 yuan to Account B at 2023-10-01 10:00:00". This standardization facilitates subsequent analysis and reduces errors caused by data heterogeneity.

[0042] Step S120: Determine the directed connection relationships between nodes based on the standardized transaction record sequence, and construct a multi-entity capital topology network.

[0043] The following formula is used to construct directed edge sets of the network based on a distance threshold to form a multi-agent funding topology network structure: (3) In formula (3), Represents nodes in a multi-entity funding topology network. arrive The elements of the directed adjacency matrix indicate whether there are slave nodes in the topology network. To the node A directed edge, where 1 indicates its existence and 0 indicates its non-existence. Represents a node and nodes Distance metrics between standardized transaction record sequences are used to quantify the similarity or correlation strength of transaction behaviors between two financial nodes, such as cosine similarity and dynamic time warping (DTW). The connection threshold is the critical value used to determine whether there is a directed connection between nodes. When the distance is less than the connection threshold, the two nodes are considered to be significantly related. The control logic of formula (3) is based on a standardized transaction record sequence. It evaluates the correlation strength between financial nodes through distance measurement, and then selects significantly related directed edges according to the preset threshold, thereby constructing a multi-entity capital topology network. In scenarios such as intelligent management of complex capital chains, financial risk control and anti-fraud, it is the core technology for constructing transaction networks and analyzing capital flows and risk transmission.

[0044] Determining the directed connections between nodes based on standardized transaction record sequences is crucial for constructing a multi-entity fund topology network. Nodes can be accounts or institutions, and directed connections represent fund flows. For example, if account A transfers 500 yuan, 300 yuan, and 200 yuan to account B three times in one day, a directed edge from A to B can be constructed with a weight of 1000 yuan. By traversing all transaction records, a multi-entity fund topology network containing multiple accounts and flow relationships is gradually built. This multi-entity fund topology network intuitively reflects the path of fund flows, helping to identify key nodes and potential risks.

[0045] Step S130: Perform time-series sorting of the multi-entity capital topology network in conjunction with transaction timestamps to obtain a dynamic capital flow graph.

[0046] The dynamic capital flow map is derived using the following formula: (4) In formula (4), Indicates the deadline A dynamic graph of fund flows. Represents a multi-subject node set. Representing the subject To the main body The fund transfer edges and their weights, with directed edges representing funds flowing from the main body. Flow to the main body Weight Typically, it refers to the transaction amount or frequency. This represents the transaction timestamp, corresponding to the time when the fund transfer edge occurred. The formula constructs the edge set by filtering based on time conditions. The control logic of formula (4) is based on a multi-entity fund topology network, filtering edges that occur at the deadline using timestamp conditions. All previous transactions are analyzed to construct a dynamic graph reflecting the state of the capital network at a specific point in time. In scenarios such as intelligent management of complex capital chains and financial risk control, this is the core data structure for analyzing the temporal patterns of capital flows and the transmission paths of risks.

[0047] By combining transaction timestamps with the topology of multi-entity funds, a dynamic fund flow graph is generated through time-series sorting. The timestamp provides a time dimension for each transaction. For example, in the above example, three transfers from account A to B occurred at 10:00, 12:00, and 14:00 respectively. Time-series sorting creates a timeline of fund flows, dynamically showing how funds move through the network over time. This dynamic fund flow graph can help regulatory agencies or banks monitor abnormal fund flows in real time, such as alerting to the risk of improper trading behavior through high-frequency transfers within a short period.

[0048] The dynamic fund flow graph combines transaction timestamps to sequentially sort the fund topology network of multiple entities, and generates an edge set through time-based edge selection. It dynamically displays a structured graph showing the flow of funds over time. This dynamic fund flow graph can present the temporal patterns and dynamic changes of fund flows in real time, connecting the multi-entity fund topology network with subsequent time-series analysis, and providing a dynamic and visualized foundation for detecting fund anomalies.

[0049] Step S140: Aggregate continuous fund transfer chains in the dynamic fund flow graph to obtain multi-entity transfer data, which includes complete fund flow and account relationships.

[0050] Multi-entity transfer data is derived using the following formula: (5) In formula (5), This indicates multi-entity transfer data. Indicates the first A continuous chain of fund transfers, The formula represents the total number of consecutive fund transfer chains. It aggregates all consecutive fund transfer chains through a union operation. The control logic of formula (5) is to first identify all fund transfer chains consisting of consecutive transactions in the dynamic fund flow graph, and then aggregate these independent chains into a complete dataset through a union operation. This fully depicts the fund flow and account relationship between multiple entities. In scenarios such as intelligent management of complex fund chains and financial risk control, it is the core data foundation for discovering abnormal fund flows and locking risk transmission chains.

[0051] Aggregating continuous fund transfer chains in a dynamic fund flow graph allows for the acquisition of multi-entity transfer data. For example, assuming funds flow from account A to account B, and then from B to C, forming an ABC chain, aggregation can extract the complete fund flow and account relationships. Such chain analysis can reveal the final destination of funds. For instance, in scenarios involving the identification of improper financial transactions, if funds flow through multiple accounts and ultimately end up in a suspicious account, timely warnings can be issued. Aggregating fund transfer chains also reduces data redundancy and improves analytical efficiency.

[0052] Furthermore, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S200 as follows: Step S210: Obtain the account transaction amount and interaction frequency in the multi-entity transfer data, and construct the unprocessed graph structure data containing node feature vectors and initial edge weights.

[0053] In financial fraud detection scenarios, the collected multi-entity transfer data contains a large amount of transaction amounts and interaction frequency between accounts. This information can be directly used to characterize account behavior. For example, if an account transfers funds to ten different accounts within seven days, with a cumulative outflow of 500,000 yuan to the same receiving account and an average interaction frequency of more than twice per day, then the node feature vector of this account can include dimensions such as total outflow amount, average single transaction amount, number of interacting accounts, and maximum daily interaction frequency, thus forming a high-dimensional feature representation. Specifically, after organizing this raw transaction data, a graph structure is constructed for processing, where each node corresponds to an account. The initial edge weight is usually the cumulative transfer amount, and the interaction frequency can be added as an auxiliary weight. For example, if account A transfers a cumulative 300,000 yuan to account B in ten transactions, then the initial edge weight from A to B is 300,000 yuan, and the interaction frequency is marked as ten times. This graph structure data fully preserves the strength and frequency information of fund flows, providing a reliable foundation for subsequent deep learning modeling.

[0054] Step S220: Input the graph structure data to be processed into the graph neural network model and update the node feature vectors to generate node embedding representations.

[0055] The node embedding representation is derived using the following formula: (6) In formula (6), Represents a node Embedded representation, The function representing a graph neural network, Represents a node The initial feature vector, Represents a node All neighbors The initial feature vector set. The control logic of formula (6) is to use graph neural network to aggregate and update the initial features of the node itself and the features of its neighboring nodes to generate a node embedding representation that integrates local topological structure information. In scenarios such as intelligent management of complex capital chains, financial risk control and anti-fraud, it is the core technology for node-level analysis and risk assessment.

[0056] The graph structure data to be processed is input into a graph neural network model, which updates the node feature vectors through a multi-layer message passing mechanism. At each layer, the graph neural network model aggregates the features of neighboring nodes and edge weights, generating more semantically expressive node embeddings after iteration. For example, after three layers of aggregation, the embedding of account A, which originally only reflected direct transactions, will gradually incorporate the fund flow patterns of its second- and third-level related accounts, thereby capturing more complex contextual relationships. This embedding representation better reflects the account's role in the entire fund network compared to the original features.

[0057] Step S230: Establish potential related edges based on node embedding representation, and identify closed-loop paths for fund return for potential related edges to obtain the corrected network connection set.

[0058] Based on the generated node embeddings, potential connections are established by calculating node similarity or inner product. For example, if Account C and Account D have no direct transfer records in the original data, but their embedding vector cosine similarity exceeds 0.95, a potential financial connection can be inferred, and a potential edge with a small weight is added. This method effectively compensates for the missing connections in the original transaction data caused by cross-institutional or hidden paths. For all potential connections, closed-loop fund return paths are further identified. Specifically, when it is found that after Account E transfers funds, some funds eventually return to Account E or its closely related accounts after passing through several intermediate accounts, a closed loop is formed. For example, Account E transfers 200,000 yuan to Account F, Account F transfers 180,000 yuan to Account G, and Account G transfers 150,000 yuan to Account H, which is related to Account E, forming a return loop of length three. By traversing the paths between highly similar nodes in the embedding space, such abnormal structures can be efficiently discovered, thus obtaining a corrected set of network connections. This corrected set of network connections eliminates noisy edges while strengthening real connections with return risk. In node embedding-based fund network analysis, potential connection edges refer to virtual connections added to the network by the algorithm based on the similarity calculation of node embedding vectors (such as cosine similarity, inner product, Euclidean distance, etc.) to determine that there is a high degree of correlation between nodes (accounts) that do not exist in the original transaction data as direct transfer / transaction records. These edges are not physically existing transaction records, but rather "implicit fund connections" inferred by algorithms based on the behavioral characteristics of accounts (such as transaction time, amount, counterparty preference, transaction frequency, etc.). They are usually assigned relatively small weights to distinguish them from real transaction edges.

[0059] Core features and generation logic of potential related edges: 1. Prerequisite for generation: There are no direct transaction records between the two nodes in the original network (no explicit edges). The node's embedding vector reflects the core behavioral characteristics of the account (the embedding representation is trained from data such as transaction behavior and attributes).

[0060] 2. The core determination method, most commonly cosine similarity (value range [-1, 1], the closer to 1, the higher the similarity), can also be chosen based on the scenario, such as inner product or Euclidean distance: Cosine similarity formula: ,in , Let be the embedding vectors of the two nodes. Indicates the inner product. This represents the L2 norm of a vector.

[0061] Threshold setting: An empirical threshold (such as 0.95) is usually set. If the similarity exceeds the threshold, it is determined that there is a potential association.

[0062] Step S240: Generate a fund topology relationship based on the modified network connection set. The fund topology relationship represents the network structure of fund flow between accounts.

[0063] Generating a fund topology based on the corrected network connection set clearly presents the true fund flow network structure between accounts. Fund topology refers to the network topology structure formed in the fund transaction network corrected based on node embedding and loopback identification, with accounts as nodes and actual transaction edges and potential connection edges as connections. This structure can completely and structurally represent the fund flow direction, connection strength, and path structure between accounts. For example, in this fund topology, loopback is marked as a high-risk subgraph, allowing regulators to quickly locate groups of accounts suspected of layered fund transfers. This method enhances potential relationship mining through graph neural networks and combines it with a loopback identification mechanism, effectively improving the detection capability of hidden fund circulation paths and providing a more accurate network view for timely blocking of illegitimate transaction chains.

[0064] Preferably, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S300 as follows: Step S310: Extract historical transaction records based on the capital topology and generate a multi-dimensional transaction time series.

[0065] Multidimensional transaction time series are derived using the following formula: (7) In formula (7), Indicates funds In time Multidimensional transaction time series, Indicates the length of the time window. Indicates funds In time Extracted historical transaction records This represents the transaction records retrieved at a past moment. The control logic of formula (7) is based on the capital topology, using the current time... The endpoint is , and the length of the cut is . The historical time window stacks transaction records of consecutive time steps within the window vertically in reverse (or forward) time order to generate a multi-dimensional transaction time series containing time series context information. The standardized matrix-form sequence is compatible with various analysis models such as deep learning and time series statistics, and is a key data conversion link connecting the capital topology network with subsequent quantitative analysis.

[0066] funds In time Extracted historical transaction records This can be derived from the following formula: (8) In formula (8), Indicates funds In time Extracted historical transaction records Indicates funds and funds Topological weights between them Indicates funds and funds Topological weights between them Indicates funds In time The original historical transaction records, For normalization, this formula extracts historical transaction records by weighting based on the capital topology. The control logic of formula (8) is to sum the original transaction records of related entities by weighting based on the connection strength of the capital topology network, and generate a comprehensive transaction record that integrates the topology relationship. This provides a key data conversion method for connecting the static topology network and dynamic time series analysis, and is one of the core technologies for intelligent management of complex capital chains.

[0067] funds and The topological weights between them are derived using the following formula: (9) In formula (9), Indicates funds and funds The topological relationship weights between them Indicates funds Feature vectors, funding entities Features such as node embedding and transaction statistics are used to represent characteristics. Indicates funds eigenvectors, The Gaussian kernel bandwidth parameter is a hyperparameter that controls the rate of weight decay and determines the degree of "smoothing" of similarity. The control logic of formula (9) is based on the Gaussian kernel function, which converts the Euclidean distance between the financial entities in the feature space into topological weights, thereby quantifying the correlation strength between them. As a bridge connecting feature representation and topological network, it provides a core technology for evaluating the correlation strength in intelligent management of complex financial chains.

[0068] In financial fraud detection scenarios, historical transaction records are extracted based on fund topology relationships to generate multidimensional transaction time series, revealing behavioral patterns over time from the fund flow network between accounts. Specifically, assuming a particular account's transaction records with other accounts over the past 30 days are extracted, data dimensions include daily transfer amounts, transaction frequency, and the number of transaction partners, forming a multidimensional transaction time series. This multidimensional transaction time series not only reflects changes in the magnitude of fund flows but also demonstrates fluctuations in transaction frequency, laying the foundation for subsequent analysis.

[0069] Step S320: Input the multidimensional transaction time series into the long short-term memory network model and output the hidden state sequence.

[0070] The hidden state sequence is derived using the following formula: (10) In formula (10), Represents the hidden state sequence, Indicates the first The hidden state at all times Indicates the length of the time series. Indicates funds In time Multidimensional transaction time series, This represents the Long Short-Term Memory network model. The control logic of formula (10) is to input the multidimensional transaction time series into the LSTM model step by step, and use its gating mechanism (input gate, forget gate, output gate) to selectively memorize and forget historical transaction information, generating a hidden state sequence that integrates the temporal context. In scenarios such as intelligent management of complex capital chains, financial risk control and time series prediction, it is the core technology connecting multidimensional transaction time series with downstream tasks.

[0071] When multidimensional transaction time series are input into a Long Short-Term Memory (LSTM) network model, the temporal dependencies of fund flows are captured. Through its gating mechanism, the LTM network can remember transaction patterns over a longer time span. For example, if an account experiences large outflows at the beginning of the month and frequent small inflows at the end, this regularity is recorded in the hidden state sequence by the LTM model. The hidden state sequence is a set of sequences generated by the LTM model through its gating mechanism after the multidimensional transaction time series are input, incorporating temporal context information. The hidden state sequence acts like a dynamic "memory unit," storing the temporal context information of the account's transaction behavior.

[0072] Step S330: Apply a self-attention mechanism to the hidden state sequence to generate a transaction sequence feature vector.

[0073] The feature vector of a transaction sequence is derived using the following formula: (11) In formula (11), This represents the feature vector of the generated transaction sequence. This represents the sequence of hidden states after the attention mechanism is applied. This represents the first-layer weight matrix. Indicates the first layer bias. This represents the second-layer weight matrix. This indicates the second layer bias. Represents the ReLU activation function. This represents a feedforward neural network. The control logic of formula (11) is to first weight the LSTM hidden state sequence with global key information through a self-attention mechanism, and then input the weighted sequence into a two-layer feedforward neural network (including ReLU nonlinear activation) to complete the deep feature transformation and fusion, and finally generate a transaction sequence feature vector with both global correlation and nonlinear expression. This completes the key transformation from "temporal hidden state" to "core features that can be directly used for downstream tasks", which is the core link of feature extraction in the complex capital chain anomaly detection model.

[0074] Hidden state sequence after attention mechanism application This can be derived from the following formula: (12) In formula (12), This represents the sequence of hidden states after the attention mechanism is applied. Represents the query matrix. Represents the key matrix, This represents the transpose of the key matrix. Represents a value matrix, The dimension of the key vector. Represents the self-attention function. denoted as Softmax function. The control logic of formula (12) is to calculate the correlation between each time step in the hidden state sequence and all other time steps through the self-attention mechanism, and then perform weighted fusion of the sequence according to the correlation to generate a new hidden state sequence that highlights key information. As the core module connecting the LSTM hidden state and the feedforward neural network, it provides a powerful feature extraction capability for time series analysis in the intelligent management of complex capital chains.

[0075] Query Matrix , representing the key matrix Sum matrix This can be derived from the following formula: (13) In formula (13), Represents the query matrix. Represents the hidden state sequence, This represents the query weight matrix. Represents the key matrix, Represents the key weight matrix. Represents a value matrix, The value weight matrix is ​​represented by the control logic of formula (13). Through three sets of learnable linear transformations, the unified hidden state sequence is mapped to three different vector spaces to generate the query matrix, key matrix and value matrix required by the self-attention mechanism. As a pre-module of the self-attention mechanism, it provides the core preprocessing capability for the extraction of time-series features in the intelligent management of complex capital chains.

[0076] When applying self-attention mechanisms to hidden state sequences, the aim is to highlight the characteristics of key time points in a multidimensional transaction time series. For example, if an account's transaction history shows a sudden surge in transfers to 1 million yuan on a particular day, while other time points saw transfers in the thousands of yuan range, the self-attention mechanism will assign a higher weight to this day, resulting in a transaction sequence feature vector that focuses more on the time points of the abnormal behavior. This method helps subsequent analysis more accurately pinpoint abnormal fluctuations in fund flows.

[0077] Step S340: Perform frequency domain analysis and trend fitting on the feature vector of the transaction sequence to obtain the cycle period and long-term evolution slope of the capital flow.

[0078] The cycle of capital flow is derived using the following formula:

[0079] In formula (14), It indicates the cycle of capital flow. Indicates the length of the transaction sequence. The first characteristic vector of the transaction sequence represents the... One portion, This represents the frequency index in the frequency domain. The formula calculates the reciprocal of the frequency corresponding to the peak value of the power spectrum using the discrete Fourier transform, thus obtaining the cycle period of capital flow. Represents the power spectral density. The upper limit of the frequency index is indicated. The control logic of formula (14) is to convert the transaction sequence from the time domain to the frequency domain by using Discrete Fourier Transform (DFT), calculate the power spectral density of each frequency component, find the dominant frequency with the strongest energy, and its reciprocal is the cycle of capital flow. In scenarios such as intelligent management of complex capital chains, financial risk control and market analysis, it is the core technical means to understand the laws of capital flow and predict future trends.

[0080] The slope of the long-term evolution of capital flows is derived using the following formula:

[0081] In formula (15), The slope representing the long-term evolution of capital flows. Indicates the sequence length. The first characteristic vector of the transaction sequence represents the... One portion, Represents a timestamp. The formula represents the time series mean. It fits the trend slope using least-squares linear regression, with positive values ​​indicating an upward trend and negative values ​​indicating a downward trend. The control logic of formula (15) is to use least-squares linear regression to fit the feature vector of the trading sequence, calculating the slope representing the long-term evolution direction of capital flows, and relating it to the cycle period. By combining these methods, we can comprehensively depict the dual patterns of "cyclicality + trend" in capital flows, providing core indicators for anomaly detection and risk warning.

[0082] When performing frequency domain analysis and trend fitting on the feature vectors of transaction sequences, the patterns of capital flows are understood from two perspectives: periodicity and long-term variation. Frequency domain analysis reveals whether there are fixed cycles in capital transfers. For example, analysis showing a large transfer to an account approximately every 7 days indicates periodic capital relocation. Trend fitting, on the other hand, reflects the long-term direction of capital flows. For instance, a continuously declining account balance over the past 90 days suggests that funds are being gradually transferred. This analysis provides important clues for identifying potential capital shifting activities.

[0083] Step S350: Based on the cycle period and the slope of the long-term evolution direction, the time sequence pattern is obtained. The time sequence pattern reflects the periodicity and trend of capital transfer.

[0084] The temporal pattern is derived using the following formula: (16) In formula (16), Representing the time sequence pattern in time The value, Indicates amplitude, It indicates the cycle of capital flow. The slope representing the long-term evolution of capital flows. Represents a timestamp. Indicates the intercept. Represents a periodic term. The formula (16) represents the trend term. It combines periodicity and trend to describe the time-series pattern of capital transfer. The control logic of formula (16) is to superimpose the periodic fluctuations obtained from frequency domain analysis with the long-term trend obtained from linear regression to construct a time-series pattern that can simultaneously depict the "periodicity + trend" of capital flow. When the deviation between the actual value and the pattern value exceeds the threshold, a risk warning is triggered.

[0085] The temporal patterns derived from cyclical cycles and the slope of long-term evolution can provide regulators with an intuitive view of fund transfer patterns. For example, if analysis reveals that a group of accounts experiences a fund inflow every 10 days, while the total account balance shows a downward trend, this temporal pattern indicates that funds are gradually flowing out through multiple accounts. This combination of periodicity and trend provides a comprehensive picture of fund flows, helping regulators more efficiently identify abnormal transaction paths.

[0086] Furthermore, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S400 as follows: Step S410: Obtain the set of input data to be detected. The set of input data to be detected is constructed from multi-dimensional feature vectors mapped by time-series regularity patterns.

[0087] The set of input data to be tested is obtained by the following formula: (17) In formula (17), This represents the set of input data to be detected. Indicates the first A multidimensional feature vector, This represents the total number of multidimensional feature vectors. The control logic of formula (17) is to convert the temporal pattern... and related characteristics (such as cycle period) Trend slope The system maps and encodes data using methods such as node embedding to generate a series of multidimensional feature vectors. These vectors are then organized into an ordered data set to provide standardized input for subsequent anomaly detection. As a key link connecting time series pattern analysis and anomaly detection, this system provides efficient and reliable anomaly detection input for complex financial chain intelligent management and anomaly detection systems.

[0088] No. The multidimensional feature vectors are obtained through the following formula: (18) In formula (18), Indicates the first A multidimensional feature vector, Represents a mapping function. Indicates the first A time-series regularity pattern in time The value of . The control logic of formula (18) is through the mapping function. , to the time sequence pattern The system encodes and transforms its derived information (such as periodic terms, trend terms, historical deviations, topological correlations, etc.) to generate multidimensional feature vectors for anomaly detection. As a key data conversion link connecting time-series pattern analysis and anomaly detection, it improves the detection accuracy and efficiency of intelligent management and anomaly detection systems for complex capital chains.

[0089] The system acquires the input data to be detected, which consists of multi-dimensional feature vectors mapped from time-series patterns. Specifically, these multi-dimensional feature vectors condense the periodic fluctuations, trend directions, and key time point weights in the account's historical transaction sequence, forming a fixed-dimensional vector representation used to capture the overall behavioral profile of fund flows. For example, in monitoring unfair trading behavior, the feature vector of a suspicious account group includes multiple dimensions such as the intensity of large outflow cycles every 7 days over the past 90 days, the statistics of the frequency of small inflows at the end of the month, and the overall balance decline slope.

[0090] Step S420: Input the set of input data to be detected into the deep autoencoder model to obtain reconstructed feature data. The reconstructed feature data is obtained by restoring the compressed latent feature representation.

[0091] The reconstructed feature data is obtained using the following formula: (19) In formula (19), This represents reconstructed feature data. This represents a deep autoencoder model. The input data set to be detected is represented by the control logic of formula (19). The input data set to be detected is input into the deep autoencoder model. First, the high-dimensional features are compressed into low-dimensional latent representations by the encoder, and then the latent representations are restored into reconstructed feature data by the decoder. In this way, the normal pattern of the data is captured. As the core anomaly detection module of the complex capital chain intelligent management and anomaly detection system, it can efficiently process high-dimensional time series features and accurately locate abnormal transactions.

[0092] The input data to be detected is fed into a deep autoencoder model to obtain the corresponding reconstructed feature data. The deep autoencoder model compresses the high-dimensional input into a low-dimensional latent space through the encoder, and then the decoder attempts to reconstruct the original input. The deep autoencoder model uses a multi-layer fully connected network combined with ReLU activation, and the latent layer dimension is set to about one-fifth of the original dimension, thus forcing the deep autoencoder model to prioritize learning the most fundamental patterns in fund transfer. The reconstructed feature data is essentially a "reconstructed version" of the deep autoencoder model's understanding of normal trading patterns.

[0093] Step S430: Calculate the reconstruction error value between the input data set to be detected and the reconstructed feature data.

[0094] The reconstruction error between the input dataset to be detected and the reconstructed feature data is obtained by the following formula:

[0095] In formula (20), This represents the reconstruction error value. This indicates the number of elements in the input data set to be tested. Indicates the first element in the input data set to be detected. One element, Represents the corresponding first element in the reconstructed feature data. Each element. The control logic of formula (20) is to quantify the degree of deviation of each sample from the normal pattern by calculating the mean absolute error (MAE) between the input data to be detected and the reconstructed feature data. The larger the error, the higher the degree of abnormality. As the core indicator of anomaly detection in deep autoencoder model, it provides accurate anomaly scoring and risk judgment basis for intelligent management and anomaly detection system of complex capital chain.

[0096] The reconstruction error between the input data to be detected and the reconstructed feature data is calculated. Mean squared error or cosine distance is typically used as a metric. This reconstruction error directly reflects the degree to which the input data deviates from the normal distribution learned by the model. For example, the reconstruction error of normal accounts is mostly concentrated in the range of 0.02 to 0.08, while the error of accounts with abnormal fund transfers suddenly jumps to over 0.25.

[0097] Step S440: Determine the anomaly detection score based on the statistical deviation of the reconstruction error value in the historical benchmark error distribution model. The anomaly detection score is used to quantify the degree of deviation of the trading pattern.

[0098] The anomaly detection score is calculated using the following formula: (twenty one) In formula (21), This represents the anomaly detection score. The cumulative distribution function represents the historical baseline error distribution model. The value represents the reconstruction error. The control logic of formula (21) compares the current reconstruction error with the historical normal error distribution, calculates its statistical deviation through the cumulative distribution function, and obtains a standardized anomaly detection score, which serves as the core output of the complex capital chain intelligent management and anomaly detection system, providing a key basis for abnormal transaction identification, risk warning and decision support.

[0099] Anomaly detection scores are determined based on the statistical deviation of the reconstruction error value from the historical baseline error distribution model. The historical baseline error distribution model is fitted using reconstruction errors from a large number of confirmed normal accounts and typically approximates a Gaussian or log-normal distribution. In one embodiment, the z-score of the current error relative to the distribution mean is calculated. If the z-score exceeds 3, the anomaly detection score is set above 0.95, indicating a significant deviation from normal behavior in the trading pattern. If the z-score is between 1 and 2, the score falls within the 0.6 to 0.8 range, suggesting further monitoring is needed. For example, an account whose reconstruction error was previously stable at around 0.05 recently detected at 0.32, with a z-score reaching 3.8; in this case, the anomaly detection score is set at 0.97. This high score directly points to a possible gradual outflow of funds through splitting, multi-level transfers, etc., highly consistent with the characteristic of "returning funds every 10 days but with a continuously decreasing total balance" found in previous time-series patterns, thus providing quantitative evidence for regulators to identify key suspicious paths.

[0100] Preferably, when the reconstruction error remains consistently high and the anomaly detection score exceeds 0.9 for several consecutive days, a secondary verification is performed using periodic indicators from the time-series pattern to further confirm whether it constitutes a systemic fund transfer. This tiered anomaly quantification method significantly improves the accuracy and interpretability of detection, effectively reduces false alarms, and enhances the ability to identify covert illegitimate trading methods. It should be noted that the magnitude of the reconstruction error is closely related to the degree of potential space compression; appropriate compression helps filter out noise, highlight structural anomalies, and thus makes the anomaly detection score more reliably reflect the true risk level.

[0101] Furthermore, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S500 as follows: Step S510: If the anomaly detection score exceeds the preset threshold, then lock the abnormal transaction account node and extract the transaction association network topology data with the abnormal transaction account node as the vertex.

[0102] Extract transaction-related network topology data using the following formula: (twenty two) In formula (22), This represents the network topology data associated with the transaction. This indicates the subgraph extraction operation. This indicates an abnormal transaction account node. Indicates Let be the set of neighboring nodes of a vertex. The control logic of formula (22) is to extract a subgraph containing the abnormal account node and all its direct neighbors in the global transaction network, and form transaction association network topology data focusing on the abnormal node. This serves as a key analysis module after anomaly detection, providing accurate risk positioning and transmission analysis capabilities for complex capital chain intelligent management and anomaly detection systems.

[0103] When an anomaly detection score exceeds a preset threshold, an abnormal transaction account node can be immediately identified. This abnormal transaction account node typically exhibits a significantly high reconstruction error, indicating that its fund flow pattern has severely deviated from the normal distribution. For example, if an account's anomaly detection score reaches 0.96, far exceeding the preset threshold of 0.85, the complex fund chain intelligent management and anomaly detection system automatically marks it as an abnormal transaction account node and extracts transaction-related network topology data based on this node. Specifically, the transaction-related network topology data includes all direct outgoing relationships originating from this abnormal transaction account node, as well as connection information for downstream multi-level receiving accounts, forming a network graph containing the abnormal transaction account node and directed edges. In one implementation, the network extraction scope is limited to all transfer records occurring within the past 60 days, and the edge weight is determined by the proportion of a single transfer amount to the total outgoing amount.

[0104] Step S520: Based on the transaction-related network topology data, traverse the downstream related nodes to generate a candidate fund propagation path set, and select key fund flow path data from the candidate fund propagation path set based on the fund transfer weight value.

[0105] The set of candidate funding propagation paths is derived using the following formula:

[0106] In formula (23), This represents the set of candidate funding propagation paths. Represents the set of downstream associated nodes. Indicates from the source node Traversing the network topology To the node The path generation function. The control logic of formula (23) is to start from the abnormal node in the transaction association network, traverse all reachable downstream association nodes, generate all possible candidate fund propagation paths, and merge these paths into a candidate fund propagation path set for subsequent key path screening. As the core data foundation for risk transmission analysis, it provides accurate risk positioning and blocking capabilities for complex fund chain intelligent management and anomaly detection system.

[0107] Key fund flow path data is derived using the following formula: (twenty four) In formula (24), This indicates key data on fund flow paths. Indicates candidate paths, Represents the set of candidate paths. The weight values ​​representing the paths through which funds are transmitted. The threshold value represents the selection threshold. The control logic of formula (24) is to filter candidate fund propagation paths based on path weights, retaining only paths with weights exceeding the preset threshold, thereby locking in the core channels of fund propagation as the final output of risk transmission analysis, providing a directly executable basis for risk blocking and source tracing for intelligent management and anomaly detection systems of complex fund chains.

[0108] Weight values ​​of fund transmission paths This can be derived from the following formula: (25) In formula (25), The weight values ​​representing the paths through which funds are transmitted. Indicates the path of fund dissemination. Represents the edges in the path. The value of the funds transferred by an edge is represented by . The control logic of formula (25) is to sum the value of the funds transferred by all edges on the fund propagation path to obtain the total fund flow of the entire path. This is used as the weight value of the path and as the core quantitative indicator for risk transmission analysis. It provides an executable basis for risk blocking and source tracing for intelligent management and anomaly detection system of complex fund chains.

[0109] The downstream related nodes are traversed based on the transaction-related network topology data to generate a set of candidate fund propagation paths. For example, starting from an abnormal node A, a path A→B→C→D is formed through B, C, and D. Simultaneously, multiple branch paths exist, such as A→E→F. All these paths together constitute the set of candidate fund propagation paths. The traversal process uses a breadth-first search approach to control depth and avoid generating too many low-relevance paths. Preferably, key fund flow path data is selected from the set of candidate fund propagation paths based on fund transfer weight values. The fund transfer weight values ​​comprehensively consider the cumulative transfer amount, transfer frequency, and time concentration. For example, if a candidate fund propagation path has a cumulative transfer amount of 1.2 million yuan, concentrated within 15 days, its fund transfer weight value is significantly higher than that of dispersed small-amount paths. In this case, the candidate fund propagation path is prioritized as a key path, while candidate fund propagation paths with fund transfer weight values ​​below 0.1 are eliminated.

[0110] Step S530: Sort and connect the key fund flow path data according to the order of transaction occurrence time to construct a directed acyclic graph data object for risk transmission.

[0111] A directed acyclic graph (DAG) data object for risk transmission is constructed by topologically sorting and connecting key fund flow path data according to the chronological order of transactions. This DAG data object is a structured data object with a strictly consistent time sequence and no loops, built by topologically sorting and connecting key fund flow path data according to transaction time. In this embodiment, key fund flow path data is used as the core data source. The accounts and transaction information in the path are topologically sorted and connected strictly according to the chronological order of each transaction, ultimately constructing a DAG data object. The core feature of this DAG is ensuring a strictly consistent time sequence, avoiding logical confusion caused by loops. The nodes in the graph structure are labeled with account identifiers, and the edges are labeled with the timestamps and amounts of corresponding transfers, forming a clear time progression structure. This structured DAG data object can intuitively present the transmission sequence of risk funds from source to downstream, involving accounts and transaction details, connecting key fund flow path data with subsequent risk handling and source tracing analysis, providing structured and visualized data support for regulators to quickly understand the transmission path of risk funds and accurately control abnormal risks.

[0112] Step S540: Perform full-path backtracking analysis on the directed acyclic graph data objects of risk transmission to obtain the risk transmission chain. The risk transmission chain reveals the propagation path of abnormal funds from the source to the downstream.

[0113] By performing full-path backtracking analysis on directed acyclic graph (DAG) data objects related to risk transmission, a complete risk transmission chain is obtained. This chain begins with an abnormal source account and reveals how funds gradually propagate downstream through multiple accounts, relaying and other methods. For example, source account A transfers a large sum of money to B and C at the beginning of the month. Three days later, B splits this transfer into multiple transactions and transfers to D and E. Finally, the funds converge in downstream account F and are quickly withdrawn, forming a typical hierarchical outflow chain. Through this full-path backtracking, regulators can directly see the complete propagation trajectory of abnormal funds from the starting point to the final destination, thereby accurately identifying the core path and key transit accounts of illicit trading groups. This method effectively improves the targeting of case investigations, significantly reduces the workload of ineffective investigations of irrelevant accounts, and provides reliable evidence for subsequent freezing and recovery.

[0114] Furthermore, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S600 as follows: Step S610: Obtain historical transaction time series data of nodes in the risk transmission chain, and use the Long Short-Term Memory Network to extract the time series feature vector of capital fluctuations in the historical transaction time series data.

[0115] The time-series feature vector of capital fluctuations is derived using the following formula:

[0116] In formula (26), This represents the extracted time-series feature vector of capital fluctuations. Represents the feature extraction function. Indicates time The sequence of capital fluctuations, The sequence length is indicated. The control logic of formula (26) is to input the historical capital fluctuation sequence of the risk transmission chain node into the LSTM model, use its gating mechanism to encode the time series information, and generate a feature vector that integrates the historical fluctuation pattern. As the core feature extraction module for risk transmission analysis, it provides accurate risk prediction and assessment capabilities for the intelligent management and anomaly detection system of complex capital chains.

[0117] When analyzing historical transaction time-series data of nodes in the risk transmission chain, the system first extracts continuous fund inflow and outflow data from the account's transaction records, focusing on the time intervals and changes in transaction amounts. For example, if an account has frequent large inflows and outflows over the past 90 days, the system will compile this data into a historical transaction time-series, recording daily changes in the fund balance. This method of compiling historical transaction time-series data helps to capture the cyclical and sudden characteristics of fund flows, laying the foundation for subsequent analysis.

[0118] When using Long Short-Term Memory (LSTM) networks to extract time-series feature vectors of fund fluctuations, the system learns long-term dependencies and short-term fluctuation patterns from historical transaction data. For example, based on the transaction records of the aforementioned account, the LTM network identifies a regular pattern of large funds being transferred in at the end of each month and then quickly withdrawn at the beginning of the next month. This time-series feature vector of fund fluctuations can reflect the potential patterns of fund flows, providing an important basis for subsequent predictions.

[0119] Step S620: Construct a Markov state transition space based on the time-series feature vector of capital fluctuations, and input the current capital stock into the Markov state transition space to generate a simulated capital flow trajectory.

[0120] When constructing the Markov state transition space, the capital stock is divided into three intervals: high, medium, and low. The transition probability between each state is calculated based on historical transaction time-series data. Assuming the current account capital stock is 500,000 yuan, belonging to the high-stock state, the complex capital chain intelligent management and anomaly detection system simulates a 60% probability of future transition to the medium-stock state through the transition space, generating a corresponding simulated capital flow trajectory. This simulated capital flow trajectory can intuitively show the direction of capital flow.

[0121] Step S630: Statistically aggregate the simulated capital flow trajectory to obtain the expected value of capital flow, and determine the capital convergence trend based on the expected value of capital flow.

[0122] When statistically aggregating simulated fund flow trajectories to obtain the expected value of fund flow, the average value and distribution range of multiple trajectories are calculated. For example, if the simulation results show that the expected outflow of funds in the next 7 days is 300,000 yuan, and the probability of outflow is concentrated at certain specific time points, the complex fund chain intelligent management and anomaly detection system can use this to determine that the fund convergence trend points to a certain downstream account. This analysis of expected fund flow helps to identify risk points of concentrated fund flows in advance.

[0123] Step S640: Based on the trend of capital convergence, identify the main flow branches and perform quantitative calculations to obtain capital prediction results that include the potential scale and direction of capital transfer.

[0124] When identifying and quantifying major fund flows based on trends, the system prioritizes paths with higher outflow rates. For example, if a simulated fund flow trajectory shows 70% of funds flowing to a specific branch account, the system will further calculate the potential transfer scale of funds involved in that branch as 250,000 yuan and predict its main direction is a specific downstream node. This quantitative result provides a precise reference direction for subsequent supervision, significantly improving the targeting of risk warnings.

[0125] In the preferred embodiment, the intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment includes step S700 as follows: Step S710: Obtain fund flow samples from historical risk data, and use kernel density estimation method to fit the probability density function of fund flow samples to determine the abnormal behavior threshold set.

[0126] The set of thresholds for abnormal behavior is determined using the following formula:

[0127] In formula (27), This represents the threshold for abnormal behavior, a density threshold used to determine whether fund flows are abnormal. Samples below this value are considered abnormal. This represents the probability level of anomalies, the preset proportion of abnormal samples (e.g., 5%), and the expectation of minimizing the probability of abnormal samples. The proportion of samples was determined to be abnormal. This indicates the number of fund transfer samples, representing the total number of fund transfer samples in historical risk data. Indicates the first The probability density estimate of a sample of fund flows is obtained by kernel density estimation (KDE). The corresponding probability density. This indicates an indicator function that takes the value 1 when the condition inside the parentheses is true, and 0 otherwise. This represents a candidate density threshold, used for traversing candidate density values. This represents the infimum operation, where the minimum value satisfying the condition is selected. The control logic of formula (27) is to fit the probability distribution of historical capital flow samples through kernel density estimation, and then find the minimum density threshold so that the proportion of samples with a density lower than the threshold reaches the preset abnormal probability level. As the core judgment criterion of the anomaly detection system, it provides an objective and accurate basis for anomaly identification in the intelligent management of complex capital chains.

[0128] No. The probability density function estimate for each sample of fund flows is obtained using the following formula:

[0129] In formula (28), Indicates the first The probability density estimate of the nth sample of capital flow, the th Individual capital flow sample values The lower the probability density at a given point, the more the sample deviates from the normal distribution. This represents the number of fund flow samples in historical risk data, the total number of samples used to fit the distribution. The hyperparameter representing the kernel density estimation bandwidth and controlling the smoothness determines the "width" of the kernel function. Kernel function, a non-negative symmetric weighting function, such as Gaussian kernel or uniform kernel, is used to measure the similarity between samples. Indicates the first The first sample value of fund flow, the first in historical risk data. One sample. Indicates the evaluation point, i.e., the th The current position of the capital flow sample value is the location for calculating the density. The control logic of formula (28) is to obtain the first value by weighting and summing all historical samples using a kernel function. Individual capital flow sample values The probability density estimate at a given location serves as the core probability modeling module of the anomaly detection system, providing a data-driven basis for anomaly judgment in the intelligent management of complex capital chains.

[0130] Kernel density estimation bandwidth This can be derived from the following formula:

[0131] In formula (29), The hyperparameter representing the kernel density estimation bandwidth controls the "width" of the kernel function and determines the smoothness of the density estimation. This represents the estimated standard deviation of the sample of fund flows, and the standard deviation of the historical fund flow sample, reflecting the degree of dispersion of the data. The number of samples in the historical risk data represents the total number of samples used to fit the distribution. The control logic of formula (29) adopts the Silverman rule of thumb to automatically calculate the optimal bandwidth based on the sample standard deviation and sample size, so as to balance the bias and variance of the kernel density estimation. As the core hyperparameter of kernel density estimation, the reasonable selection of bandwidth directly determines the accuracy of the anomaly detection threshold, providing a reliable distribution modeling capability for intelligent management of complex capital chains.

[0132] When acquiring samples of fund flows from historical risk data, representative fund flow data is extracted from account transaction records over the past year, with a focus on accounts frequently exhibiting large transactions. Specifically, assuming an account has multiple single fund transfers exceeding 1 million yuan within the past year, the complex fund chain intelligent management and anomaly detection system will compile these transaction data into a sample set for subsequent analysis. This sample extraction method covers fund flow characteristics across different time periods, ensuring data comprehensiveness.

[0133] When using kernel density estimation to fit the probability density function of a fund flow sample to determine the threshold set for abnormal behavior, distribution analysis of the sample data is performed to identify the normal range and abnormal boundaries of fund flows. Simply put, kernel density estimation is a statistical method used to estimate the probability distribution of data. Suppose that analysis reveals that under normal circumstances, daily fund flows are between 100,000 and 500,000 yuan, while transactions exceeding 800,000 yuan account for an extremely low percentage. A complex intelligent fund chain management and anomaly detection system would set 800,000 yuan as the upper limit threshold for abnormal behavior. This method helps to accurately delineate the boundary between normal and abnormal behavior, providing a basis for subsequent judgments.

[0134] Step S720: Calculate the joint probability density value of the funding prediction results in the abnormal behavior threshold set.

[0135] The joint probability density value is obtained by the following formula: (30) In formula (30), This represents the joint probability density value and the funding forecast result. In the abnormal behavior threshold set The marginal probability density reflects the overall probability of anomalies in the prediction results. This indicates the result of capital flow forecasting, which is the predicted value of capital flow obtained from time-series patterns or other models. This represents the set of anomalous behavior thresholds, comprising all anomalous thresholds determined by kernel density estimation. The parameter space that is formed. Representing the integral variable, traversing the set of abnormal behavior thresholds. All abnormal thresholds . Represents the conditional probability density, given an anomaly threshold. Under these conditions, the funding forecast results The probability density. Represents the prior density, given an anomaly threshold. The prior probability distribution reflects its credibility in historical data. The control logic of formula (30) is to integrate the set of abnormal behavior thresholds, and then sum the conditional probability density of the prediction result under all thresholds with the prior density of the thresholds in a weighted manner to obtain the marginal joint probability density of the prediction result. As the core link of the combination of capital prediction and anomaly detection, it provides accurate risk assessment and decision-making basis for the intelligent management and anomaly detection system of complex capital chains.

[0136] When calculating the joint probability density value of the predicted fund flow results within the abnormal behavior threshold set, the system compares the predicted fund flow data with the established threshold range. For example, if the prediction indicates that an account may experience a transfer of 900,000 yuan within the next 7 days, and this value exceeds the upper limit of the abnormal threshold, the complex fund chain intelligent management and anomaly detection system will calculate its joint probability density value and find that it is far below the value within the normal distribution range. This analysis method can quickly identify potential abnormal signals.

[0137] Step S730: If the joint probability density value is lower than the critical value, calculate the offset value of the scale of fund transfer relative to the center point of the abnormal behavior threshold set to obtain the abnormal change range of fund flow.

[0138] The magnitude of abnormal changes in capital flows is calculated using the following formula: (31) In formula (31), It indicates the magnitude of abnormal changes in fund flows, quantifies the degree to which fund transfers deviate from normal patterns, and the larger the value, the more significant the abnormality. This represents a calculation function used to calculate the offset. Mapping to functions with abnormal amplitudes, such as absolute value, normalization, etc. The offset value represents the deviation of the scale of fund transfer relative to the center point of the abnormal behavior threshold set. The control logic of formula (31) is that when the joint probability density value is lower than the critical value, the offset of the scale of fund transfer relative to the center point of the abnormal threshold is calculated and mapped to an interpretable abnormal change range. As a key link between anomaly detection and risk disposal, it improves the response efficiency and disposal accuracy of the intelligent management and anomaly detection system for complex capital chains.

[0139] Offset value This can be derived from the following formula: (32) In formula (32), This represents the offset value, the absolute distance by which the scale of fund transfer deviates from the center of the normal pattern, and reflects the degree of deviation. This indicates the scale of fund transfers, specifically the amount of fund transfers currently pending evaluation. The center point of the abnormal behavior threshold set is represented by the center value of the abnormal behavior threshold set, which represents the typical level of historical normal capital flow. The control logic of formula (32) is to calculate the absolute difference between the current capital transfer scale and the center point of the abnormal behavior threshold set to obtain the offset of capital flow from the center of the normal pattern. This offset serves as the core input for calculating the abnormal change amplitude, providing accurate deviation assessment capability for complex capital chain intelligent management and abnormal detection systems.

[0140] If the joint probability density value is below the critical value, the degree of abnormality is further quantified when calculating the offset of the scale of fund transfers relative to the center point of the abnormal behavior threshold set. Assuming the abnormal threshold center point is 400,000 yuan, while the predicted transfer amount is 900,000 yuan, the offset is as high as 500,000 yuan, indicating a significant abnormality in fund flows. This offset analysis can intuitively reflect the magnitude of abnormal changes and provide an important reference for risk assessment.

[0141] Step S740: Based on the abnormal change range, when the offset value continues to be in the high-level oscillation range, a real-time early warning signal is triggered to lock the specific risk transmission chain.

[0142] The following formula is used to define the criteria for determining whether a stock is in a high-level oscillation range: (33) In formula (33), This is an indicator function that indicates high-level oscillation. It takes a value of 1 when the offset is within the high-level oscillation range, and 0 otherwise. This represents the average offset, the mean value of the offset over a period of time, reflecting the overall level of deviation. This represents the high-level threshold, a critical value used to determine whether the offset is at a high level. It represents the lower bound of the high-level oscillation range, and the lower standard deviation for determining whether oscillation exists. This represents the upper limit of the high-level oscillation range, and the upper standard deviation for determining whether oscillation exists. The standard deviation of the offset is the standard deviation of the offset values ​​over a period of time, reflecting the degree of fluctuation. The control logic of formula (33) is to simultaneously satisfy the two conditions of "the mean of the offset is higher than the high threshold" and "the standard deviation of the offset is within the oscillation range" to determine that the offset is in the high oscillation range. Through the dual conditions of mean and standard deviation, the high-risk state of "high oscillation" can be accurately identified to avoid false alarms or missed alarms. It provides clear triggering conditions for risk warning, enabling the system to automatically identify and respond to high-risk scenarios. As the core judgment logic for monitoring the risk transmission chain, it improves the real-time warning capability and risk handling efficiency of the intelligent management and anomaly detection system for complex capital chains.

[0143] Real-time warning signals are derived using the following formula:

[0144] In formula (34), This represents a real-time early warning signal. It is an indicator function that takes the value of 1 (triggers an early warning) when the condition of continuous high-level oscillation is met, and 0 otherwise. This indicates the number of consecutive steps, which determines the continuous time step required for sustained high-level oscillation. Indicates the past Step offset value, from the current time A sequence of historical offsets traced back. This indicates the lower limit of the high-level fluctuation range. This indicates the upper limit of the high-level fluctuation range. This represents the high-level oscillation range, a critical interval jointly defined by the high-level threshold and the oscillation standard deviation range. The control logic of formula (34) is that if and only if the past continuous A real-time warning signal is triggered only when the offset values ​​of all time steps are in the high-level oscillation range. By using the "continuous multi-step" condition, false alarms caused by single fluctuations are effectively filtered out, improving the reliability of the warning. It accurately locks the risk transmission chain that is continuously oscillating at a high level, so that monitoring resources are concentrated on the most threatening risk points. As the core triggering mechanism for system risk response, it provides real-time and accurate risk warning capabilities for intelligent management of complex capital chains.

[0145] Based on the magnitude of abnormal changes, when the offset value remains within a high-level oscillation range, the system triggers a real-time early warning signal to lock onto a specific risk transmission chain. The high-level oscillation range is defined by a high threshold, a lower bound, and an upper bound. Constrained by both the average and standard deviation of the offset, it defines a critical range where the offset is generally high but the fluctuation is stable. Specifically, if the predicted outflow amount offset for an account exceeds 400,000 yuan for three consecutive days, and the fluctuation range remains high, the complex capital chain intelligent management and anomaly detection system will automatically lock onto the capital flow path of that account and issue an early warning to regulators. This real-time early warning mechanism can promptly capture risk signals, facilitating rapid response to potential threats. For example, from the overall process perspective, the above steps are closely integrated, from historical data sample extraction to the determination of the anomaly threshold, to the probability analysis of the prediction results and the calculation of the offset, ultimately forming a real-time early warning signal. This complete chain can effectively identify abnormal patterns in capital flows, while improving the accuracy of risk warnings through multi-dimensional analysis, providing strong support for subsequent risk management.

[0146] The intelligent management and anomaly detection method for complex capital chains based on deep learning models provided in this embodiment achieves the following beneficial effects compared with existing technologies: 1. By integrating graph learning and temporal neural networks into a model, we can analyze the spatial topology of the funding chain and capture the time-series patterns of transactions, thereby improving the accuracy of anomaly detection.

[0147] 2. The key steps are anomaly score quantification, risk transmission chain tracing, and capital flow prediction, forming a closed-loop risk control process of "anomaly detection - risk source tracing - future prediction - real-time early warning".

[0148] 3. Compared with traditional fund management methods, it breaks through the limitations of "isolated analysis and ex-post handling", realizes intelligent and forward-looking control of complex fund chains, and adapts to the regulatory needs of large-scale and highly dynamic fund transactions in financial scenarios.

[0149] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various alterations and modifications to the invention without departing from its spirit and scope. Thus, if these modifications and modifications of the invention fall within the scope of the claims and their equivalents, the invention is also intended to include these modifications and modifications.

Claims

1. A method for intelligent management and anomaly detection of complex capital chains based on a deep learning model, characterized in that, Includes the following steps: S100. Collect multi-entity transfer data from financial institutions, wherein the multi-entity transfer data includes fund transfer records between multiple accounts; S200. A graph learning model is used to process the relationships between nodes in the multi-entity transfer data to obtain the fund topology relationship, which represents the fund flow network structure between accounts. S300. Based on the aforementioned capital topology, a time-series neural network is used to capture transaction sequence features to obtain a time-series pattern, which reflects the periodicity and trend of capital transfer. S400. The anomaly detection model is used to reconstruct the time series pattern error and determine the anomaly detection score. The anomaly detection score is used to quantify the degree of deviation of the trading pattern. S500. If the anomaly detection score exceeds a preset threshold, the associated path is traced back using a path tracing method to obtain the risk transmission chain, which reveals the propagation path of abnormal funds from the source to the downstream. S600. Based on the risk transmission chain, a liquidity forecasting model is used to simulate future capital flows to obtain capital forecasting results, which include the potential scale and direction of capital transfers. S700. By comparing the predicted capital flow results with the abnormal behavior threshold, potential fluctuations are determined and a real-time early warning signal is obtained. The abnormal behavior threshold is set based on historical risk data, and the potential fluctuations refer to the abnormal change range of capital flow.

2. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 1, characterized in that, Step S100 includes: S110. Obtain the original message streams distributed across different financial nodes, and parse the original message streams to generate a standardized transaction record sequence; S120. Determine the directed connection relationships between nodes based on the standardized transaction record sequence, and construct a multi-entity fund topology network; S130. The multi-entity capital topology network is sorted in time sequence by combining transaction timestamps to obtain a dynamic capital flow graph. S140. In the dynamic fund flow graph, continuous fund transfer chains are aggregated to obtain multi-entity transfer data, which includes complete fund flow and account relationships.

3. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 2, characterized in that, Step S200 includes: S210. Obtain the account transaction amount and interaction frequency from the multi-entity transfer data, and construct the unprocessed graph structure data containing node feature vectors and initial edge weights; S220. Input the graph structure data to be processed into the graph neural network model, and update the node feature vector to generate a node embedding representation; S230. Establish potential related edges based on the node embedding representation, and identify closed-loop paths for fund return for the potential related edges to obtain a corrected set of network connections. S240. Generate a fund topology relationship based on the modified network connection set, wherein the fund topology relationship represents the fund flow network structure between accounts.

4. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 1, characterized in that, Step S300 includes: S310. Extract historical transaction records based on the capital topology and generate a multi-dimensional transaction time series; S320. Input the multidimensional transaction time series into the long short-term memory network model and output the hidden state sequence. S330. Apply a self-attention mechanism to the hidden state sequence to generate a transaction sequence feature vector; S340. Perform frequency domain analysis and trend fitting on the feature vector of the transaction sequence to obtain the cycle period and long-term evolution slope of the capital flow. S350. Based on the cycle period and the slope of the long-term evolution direction, a time-series pattern is obtained, which reflects the periodicity and trend of capital transfer.

5. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 4, characterized in that, Step S400 includes: S410. Obtain the input data set to be detected, wherein the input data set to be detected is constructed from a multi-dimensional feature vector mapped by a time-series regularity pattern. S420. Input the set of input data to be detected into a deep autoencoder model to obtain reconstructed feature data, which is obtained by restoring the compressed latent feature representation; S430. Calculate the reconstruction error value between the input data set to be detected and the reconstructed feature data; S440. Determine the anomaly detection score based on the statistical deviation of the reconstructed error value in the historical benchmark error distribution model. The anomaly detection score is used to quantify the degree of deviation of the trading pattern.

6. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 5, characterized in that, Step S500 includes: S510. If the anomaly detection score exceeds the preset threshold, then lock the abnormal transaction account node and extract the transaction association network topology data with the abnormal transaction account node as the vertex. S520. Based on the transaction-related network topology data, traverse downstream related nodes to generate a candidate fund propagation path set, and filter out key fund flow path data from the candidate fund propagation path set based on the fund transfer weight value. S530. Perform topological sorting and connection on the key fund flow path data according to the order of transaction occurrence time to construct a directed acyclic graph data object for risk transmission. S540. Perform full-path backtracking analysis on the risk transmission directed acyclic graph data object to obtain the risk transmission chain, which reveals the propagation path of abnormal funds from the source to the downstream.

7. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 1, characterized in that, Step S600 includes: S610. Obtain historical transaction time series data of nodes in the risk transmission chain, and use a long short-term memory network to extract the capital fluctuation time series feature vector from the historical transaction time series data; S620. Construct a Markov state transition space based on the time-series feature vector of fund fluctuations, and input the current fund stock into the Markov state transition space to generate a simulated fund flow trajectory. S630. Statistically aggregate the simulated capital flow trajectory to obtain the expected value of capital flow, and determine the capital convergence trend based on the expected value of capital flow; S640. Based on the aforementioned capital convergence trend, identify the main flow branches and perform quantitative calculations to obtain capital prediction results that include the potential scale and direction of capital transfer.

8. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 1, characterized in that, Step S700 includes: S710. Obtain a sample of fund flows from historical risk data, and use the kernel density estimation method to fit the probability density function of the fund flow sample to determine the set of abnormal behavior thresholds. S720. Calculate the joint probability density value of the funding prediction results in the set of abnormal behavior thresholds; S730. If the joint probability density value is lower than the critical value, calculate the offset value of the scale of fund transfer relative to the center point of the abnormal behavior threshold set to obtain the abnormal change range of fund flow. S740. Based on the abnormal change amplitude, when the offset value continues to be in the high-level oscillation range, a real-time early warning signal is triggered to lock the specific risk transmission chain.

9. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 8, characterized in that, In step S740, the following formula is used to define the judgment condition for being in a high-level oscillation range: in, This indicates a high-level consolidation. This represents the average offset. Indicates the high-order threshold. This indicates the lower limit of the high-level fluctuation range. This indicates the upper limit of the high-level fluctuation range. This represents the standard deviation of the offset.

10. The method for intelligent management and anomaly detection of complex capital chains based on deep learning models as described in claim 9, characterized in that, In step S740, the real-time warning signal is obtained using the following formula: in, Indicates a real-time early warning signal. Indicates the number of consecutive steps. Indicates the past Step offset value.

Images