A method and system for identifying patterns of financial anomalous behavior

Abstract

The application provides a financial abnormal behavior pattern recognition method and system, the method comprising: converting behavior anchor information into a high-dimensional feature vector, calculating the projection value of each high-dimensional feature vector on different behavior intention axes, generating a preliminary intention vector, optimizing the intention vector accuracy, and generating a final behavior intention vector; embedding the behavior intention vector into a preset behavior configuration manifold, identifying the atypical pattern of the behavior intention vector, and labeling the high-risk nodes in the atypical pattern; judging the spatial distance of each behavior intention vector to the labeled high-risk nodes in the behavior configuration manifold, introducing a high-risk weight based on the spatial distance and the basic disturbance density, obtaining a weighted disturbance density, dynamically adjusting the future deduction depth, and forming a prediction result with probability distribution; performing abnormal scoring on the prediction result and triggering a warning action, the application is converted from post-recognition to pre-prediction, when the intention structure deviates, it can still be identified in the configuration manifold, and the risk of deliberately avoiding identification of financial abnormal behavior is reduced.

Description

Technical Field

[0001] This application relates to the field of data processing technology, specifically a method and system for identifying abnormal financial behavior patterns. Background Technology

[0002] The purpose of identifying abnormal financial behavior is to reduce financial risks by controlling processes before actual losses occur.

[0003] Chinese patent CN117473048B discloses a financial anomaly data monitoring and analysis system and method based on data mining. It collects financial data from various financial data sources and introduces data processing and semantic understanding algorithms in the backend to perform semantic association analysis of each data item in the financial data. Specifically, considering that if a certain financial data item is abnormal, its semantic weight in the overall financial data will be relatively small, i.e., its relevance is weak, the system further judges whether the financial data is abnormal by assessing the semantic importance of each financial data item relative to the overall financial data. Chinese patent CN117473048B determines whether the financial data is abnormal based on the data results.

[0004] However, current methods of determining whether financial data is abnormal based on data results often overlook behavioral data. This makes it difficult to effectively identify abnormal behaviors that are highly concealed and still in the process. Furthermore, the identification of abnormal behaviors that focus on result data usually occurs after the fact, making it difficult to achieve early warning and real-time intervention for abnormal financial behaviors.

[0005] Therefore, overcoming the aforementioned technical problems and defects has become a key issue that needs to be addressed. Summary of the Invention

[0006] To overcome the aforementioned problems in the prior art, this application provides a method and system, which adopts the following technical solution:

[0007] Firstly, this application provides a method for identifying patterns of abnormal financial behavior, including:

[0008] Based on preset parsing rules, the composite operation information is parsed into serialized sub-events, the serialized sub-events are atomically decomposed to generate the smallest indivisible operation unit, and each smallest operation unit is bound to the operation subject index and operation device fingerprint to generate behavior anchoring information.

[0009] The behavior anchoring information is transformed into a high-dimensional feature vector. Based on the preset rule function cluster, the projection value of each high-dimensional feature vector on different behavior intention axes is calculated to generate a preliminary intention vector. Abnormal samples are used as feedback signals to input the adaptive mechanism. The weights of the preset rule functions are adjusted according to true positives and false positives to optimize the accuracy of the intention vector and generate the final behavior intention vector.

[0010] Embed the behavioral intent vector into a preset behavioral configuration manifold, identify atypical patterns of the behavioral intent vector, and label high-risk nodes in the atypical patterns;

[0011] Determine the spatial distance of each behavioral intent vector to the high-risk nodes marked in the behavioral configuration manifold, introduce high-risk weights based on spatial distance and basic perturbation density, obtain weighted perturbation density, dynamically adjust the future inference depth, and form a prediction result with probability distribution based on the inference results;

[0012] Anomaly scores are assigned to the prediction results, and early warning actions are triggered based on the anomaly scores.

[0013] Furthermore, based on a pre-defined cluster of rule functions, the projection values ​​of each high-dimensional feature vector on different behavioral intent axes are calculated to generate a preliminary intent vector, including:

[0014] N intent axes are predefined, and a rule function is preset for each intent axis. The set of rule functions for the N intent axes is called the preset rule function cluster. When a high-dimensional feature vector is input into the preset rule function cluster, the preset rule function cluster is called in parallel.

[0015] We select feature dimensions that are semantically related to the corresponding intent axis and weight them to calculate the projection value of a financial behavior on the corresponding intent axis. Each projection value represents the relative strength or deviation of the financial behavior in the corresponding intent direction.

[0016] Once the projection values ​​of the N intent axes are calculated, all projection values ​​are combined in a predetermined order to generate a preliminary intent vector.

[0017] Furthermore, abnormal samples are used as feedback signals input to the adaptive mechanism. The weights of the preset rule function are adjusted based on true positives and false positives to optimize the accuracy of the intent vector and generate the final behavioral intent vector, including:

[0018] Abnormal samples are introduced as feedback signals into the adaptive processing flow of the preset rule function. The feedback signals include the final judgment result of a certain financial behavior and the corresponding abnormal type label, which distinguishes between true positive and false positive results.

[0019] When generating a financial behavior intent vector based on feedback signals, the rule function and corresponding weights used are used to associate the high-dimensional feature vector, preliminary intent vector, and anomaly judgment results of a financial behavior.

[0020] For behaviors identified as true positives, the discriminative power of the projection values ​​on different intent axes is assessed. If the discriminative power is insufficient, the weight of the corresponding rule function is increased to enhance the sensitivity of that intent axis to similar abnormal behaviors.

[0021] For behaviors identified as false positives, the feature contribution during the intent projection process is identified, and the weight of the corresponding rule function is reduced to decrease the misjudgment of normal behaviors.

[0022] After the weight adjustment is completed, the updated preset rule function cluster is applied to the high-dimensional feature vector again to generate an optimized behavioral intent vector.

[0023] Furthermore, behavioral intent vectors are embedded into a predefined behavioral configuration manifold in a business-constrained manner to identify atypical patterns in the behavioral intent vectors and to label high-risk nodes within these atypical patterns, including:

[0024] Input the behavioral intent vector into the preset behavioral configuration manifold, and locate the behavioral intent vector to the corresponding structural space position of the behavioral configuration manifold through vector mapping.

[0025] The new positioning behavior intent vector is structurally compared with the historical behavior vector to obtain the structural index of the new positioning behavior intent vector in the structural space.

[0026] A comprehensive evaluation of structural indicators is conducted. If a behavioral intention vector is located in an unstable structural region of a preset behavioral configuration manifold, then the behavioral intention vector is considered an atypical pattern and is marked as a high-risk node in the preset behavioral configuration manifold.

[0027] Secondly, this application also provides a financial abnormal behavior pattern recognition system, including:

[0028] The behavior anchoring information generation module is used to parse composite operation information into serialized sub-events based on preset parsing rules, perform atomic decomposition on the serialized sub-events to generate the smallest indivisible operation unit, bind the operation subject index and operation device fingerprint to each smallest operation unit, and generate traceable behavior anchoring information.

[0029] The final behavioral intent vector generation module is used to convert behavioral anchoring information into high-dimensional feature vectors. Based on a preset set of rule functions, it calculates the projection value of each high-dimensional feature vector on different behavioral intent axes to generate a preliminary intent vector. Abnormal samples are used as feedback signals to input the adaptive mechanism. The preset rule function weights are adjusted according to true positives and false positives to optimize the accuracy of the intent vector and generate the final behavioral intent vector.

[0030] The high-risk node annotation module is used to embed behavioral intent vectors into a preset behavioral configuration manifold, identify atypical patterns of behavioral intent vectors, and annotate high-risk nodes in atypical patterns.

[0031] The prediction result acquisition module is used to determine the spatial distance of each behavioral intention vector to the high-risk nodes marked in the behavioral configuration manifold. Based on the spatial distance and the basic perturbation density, high-risk weights are introduced to obtain the weighted perturbation density, and the future inference depth is dynamically adjusted. Based on the inference results, a prediction result with a probability distribution is formed.

[0032] The early warning action triggering module is used to score the prediction results for anomalies and trigger early warning actions based on the anomaly score results.

[0033] Thirdly, this application provides an electronic device, comprising:

[0034] One or more processors; a memory; and one or more computer programs, wherein the one or more computer programs are stored in the memory, and the one or more computer programs include instructions that, when executed by the device, cause the device to perform the method as described in the first aspect.

[0035] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the method described in the first aspect.

[0036] Fifthly, this application provides a computer program that, when executed by a computer, performs the method described in the first aspect.

[0037] In one possible design, the program in the fifth aspect can be stored wholly or partially on a storage medium packaged with the processor, or it can be stored wholly or partially on a memory not packaged with the processor.

[0038] This application has the following beneficial effects:

[0039] 1. This application parses composite operation information into serialized sub-events based on preset parsing rules, performs atomic decomposition on the serialized sub-events to generate indivisible minimum operation units, binds the operation subject index and operation device fingerprint to each minimum operation unit, and generates traceable behavior anchoring information. This can transform anomaly judgments into traceable specific business behaviors, improving the reliability of anomaly identification, and transforming numerical anomalies into behavior-oriented anomalies. That is, the behavior anchoring information clearly anchors each anomaly judgment to a specific atomic event, business subject, time point, and process position, clearly indicating which type of behavior, in which business link, and due to what intention deviation was judged as an anomaly. Through behavior anchoring, the anomaly result can be directly traced back to the original transaction record and the corresponding intention dimension change path, enabling auditors to quickly understand the cause of the anomaly.

[0040] 2. This application transforms behavioral anchoring information into high-dimensional feature vectors, calculates the projection values ​​of each high-dimensional feature vector onto different behavioral intent axes based on a preset set of rule functions, generates a preliminary intent vector, and uses abnormal samples as feedback signals to input an adaptive mechanism. The weights of the preset rule functions are adjusted based on true positives and false positives to optimize the accuracy of the intent vector, generating a final behavioral intent vector. This application adaptively corrects the preliminary intent vector based on abnormal samples, and by determining which rules contribute significantly to abnormal behavior, the generated final behavioral intent vector possesses traceability, which helps in interpreting the anomaly detection results.

[0041] 3. This application identifies atypical patterns in behavioral intent vectors by embedding them into a predefined behavioral configuration manifold in a business-constrained manner, and marks high-risk nodes within these atypical patterns. These high-risk nodes correspond to key locations of abnormal behavior in the structural space. After marking these high-risk nodes, during result prediction, they can be used as targets to guide the deduction along high-risk defense lines, thus concentrating resources in key risk areas.

[0042] 4. This application determines the spatial distance of each behavioral intent vector to the high-risk nodes marked in the behavioral configuration manifold. Based on the spatial distance and the basic perturbation density, a high-risk weight is introduced to obtain a weighted perturbation density. The future projection depth is dynamically adjusted, and a prediction result with a probability distribution is formed based on the projection result. Anomaly scoring is applied to the prediction result, and an early warning action is triggered based on the anomaly scoring result. By dynamically adjusting the future projection depth, this application not only identifies current abnormal behavior but also predicts potential future anomalies, shifting the risk management of financial abnormal behavior from post-event detection to proactive early warning. Attached Figure Description

[0043] Figure 1 This is a flowchart of the financial abnormal behavior pattern recognition method according to an embodiment of this application;

[0044] Figure 2 This is a flowchart illustrating the decomposition of serialization sub-events according to an embodiment of this application.

[0045] Figure 3 This is a flowchart illustrating the generation of a preliminary intent vector according to an embodiment of this application.

[0046] Figure 4 This is a flowchart illustrating the generation of the final behavioral intent vector in an embodiment of this application.

[0047] Figure 5 This is a flowchart illustrating the high-risk node labeling process in an embodiment of this application.

[0048] Figure 6 This is a system flowchart of an embodiment of this application;

[0049] Figure 7 This is a schematic diagram of a computer device according to an embodiment of this application. Detailed Implementation

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0051] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0052] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0053] Please refer to Figure 1 The following is a method for identifying abnormal financial behavior patterns provided in this application embodiment, and its specific implementation process is as follows:

[0054] Step 101: Based on the preset parsing rules, the composite operation information is parsed into serialized sub-events, the serialized sub-events are atomically decomposed to generate the smallest indivisible operation unit, and each smallest operation unit is bound to the operation subject index and the operation device fingerprint to generate traceable behavior anchoring information.

[0055] It should be noted that the composite operation information, the fingerprints of the operating entity and the operating device are obtained through the original financial records, which are obtained through financial software, approval systems, or ERP systems. The composite operation information is a simplified version of the original system that compresses multiple actions into a single record. This single record contains multiple discrete operation steps, which are uploaded by different operating entities, different operating devices, or at different times, and are mixed into a single action in the original data.

[0056] The operating entity is the user who performs the operation as identified in the original financial records, thus linking the operation behavior with the operator's identity. This allows for the construction of an operator behavior baseline and the identification of abnormal cross-entity collaborative behavior.

[0057] The operational entity index maps entity information related to financial operations to identifiable identifiers, which are used to track the attribution of responsibility for each operation throughout the financial process.

[0058] Operating device fingerprints include device identification, client characteristics, network address, and geographic location information, establishing a traceable operating environment.

[0059] The operation subject index is associated with the operation device fingerprint to ensure that each operation unit has a traceable operator and operation environment.

[0060] In this embodiment, composite operation information is parsed into serialized sub-events based on preset parsing rules. Please refer to [link / reference]. Figure 2 ,include:

[0061] Step 21: Obtain the original transaction records containing complex operations. Each transaction record contains multiple operation steps, approval nodes, and context information.

[0062] Step 22: Based on the preset parsing rules, identify each independent action in the composite operation and parse it into discrete operation nodes.

[0063] Preset parsing rules include operation order, role dependency, or field identifiers, which can be selected according to actual needs. For example, expense submission - department approval - financial payment can be parsed into three discrete operation nodes.

[0064] Step 23: Assign original timestamps to operation nodes, sort them according to time order, and form serialized sub-events.

[0065] In one possible implementation scenario, please refer to Table 1 for a list of compound operations involved in a single expense reimbursement process:

[0066] Operational node Human Original time Description Submit reimbursement application Employee A 2025-10-11 09:55 Upload reimbursement form Department preliminary review Department supervisor B 2025-10-11 10:30 Review reimbursement items Financial review Financial C 2025-10-11 13:35 Check amount, attachments Fund payment Cashier D 2025-10-11 15:20 Transfer funds to employee account

[0067] Each operation node retains its original timestamp. The operation nodes are then sorted according to their timestamps to form serialized sub-events.

[0068] Sub-event 1: Employee A submits reimbursement application on 2025-10-11 at 09:55

[0069] Sub-event 2: Department Preliminary Review by Department Head B (October 11, 2025, 10:30 AM)

[0070] Sub-event 3: Financial Review (Finance C, 2025-10-11 13:35)

[0071] Sub-event 4: Cashier D (Funds Payment) 2025-10-11 15:20

[0072] In this embodiment, serialized sub-events are atomically decomposed to generate indivisible minimum operation units. Each minimum operation unit is then bound to an operation subject index and an operation device fingerprint to generate traceable behavior anchoring information, including:

[0073] The serialized sub-event is evaluated. If it contains multiple separable actions, the serialized sub-event is decomposed. If the serialized sub-event contains only one action, the current serialized sub-event is regarded as the smallest unit of operation.

[0074] For example, operations involving multiple roles in a serialized sub-event can be broken down into the smallest operational units of a single role and a single action; multi-stage approval can be decomposed into single-stage events, making each operation node the smallest unit of analysis to determine the approval position.

[0075] Assuming the initial approval is treated as a serialized sub-event, the smallest unit of operation can be decomposed into login verification, approval status update, and approval comment entry. Login verification, approval status update, and approval comment entry are the smallest units of operation with a time sequence.

[0076] It should be noted that each approval stage is recorded with a corresponding timestamp, operator, and approval result, which can be used to reconstruct the operation sequence.

[0077] In this embodiment of the application, a unique event ID is assigned to each smallest operation unit, and a mapping index with the original serialized sub-event is established; an operation subject index and an operation device fingerprint are bound to each smallest operation unit.

[0078] After completing the binding of the smallest operation unit, the behavior anchor information is output. Each behavior anchor information is a logically indivisible smallest operation unit. The fields included in the behavior anchor information are: operation type and stage, operation subject index, timestamp, approval chain position, operation device fingerprint, and context information.

[0079] Step 102: Convert the behavior anchoring information into a high-dimensional feature vector, calculate the projection value of each high-dimensional feature vector on different behavior intent axes based on the preset rule function cluster, generate a preliminary intent vector, input abnormal samples as feedback signals into the adaptive mechanism, adjust the weight of the preset rule function according to true positives and false positives, optimize the accuracy of the intent vector, and generate the final behavior intent vector.

[0080] In this embodiment of the application, the behavior anchoring information is converted into a high-dimensional feature vector, including:

[0081] Numerical fields are normalized to unify values ​​of different magnitudes into a standard range; discrete fields are mapped and encoded; and numerical and discrete fields are transformed into high-dimensional feature vectors. For example, transaction amount and operation duration are normalized, and transaction type and accounting subject are mapped and encoded. Normalization of numerical fields can be achieved using existing technologies and will not be elaborated further. Operation type and stage, operation subject index, operation device fingerprint, and context information are discrete fields, while timestamp and approval chain position are numerical fields. For example, operation type and fields can be classified using one-hot encoding. The operation subject index is identified through feature embedding, such as employee ID and role code. The operation device fingerprint uses MAC address fingerprints for feature association analysis, and the context information can be text-encoded, using Word2Vec to describe the business type.

[0082] It should be noted that a corresponding rule function is set for each intent. By inputting the high-dimensional feature vector into the preset rule function, a scalar data is output, which represents the projection intensity of the current behavior on the corresponding intent axis.

[0083] Specifically, based on a pre-defined cluster of rule functions, the projection values ​​of each high-dimensional feature vector on different behavioral intent axes are calculated to generate a preliminary intent vector. Please refer to [link / reference needed]. Figure 3 ,include:

[0084] Step 31: Predefine N intent axes, and pre-define a rule function for each intent axis. The set of rule functions for the N intent axes constitutes a pre-defined rule function cluster. When a high-dimensional feature vector is input into the pre-defined rule function cluster, the pre-defined rule function cluster is invoked in parallel. In this application, intent axes include at least concealed intent axes, bypass intent axes, circumvented intent axes, and collaborative intent axes.

[0085] It should be noted that different rule functions use different feature vectors during the calculation process and predefine the index of the feature vectors. When using different rule functions for calculation, the corresponding values ​​are extracted from the high-dimensional feature vectors according to the predefined index of the rule function.

[0086] Step 32: Select feature dimensions that are semantically related to the corresponding intent axis and perform a weighted combination to calculate the projection value of a financial behavior on the corresponding intent axis. Each projection value represents the relative strength or deviation of a financial behavior in the corresponding intent direction. For example, when calculating avoidance intent, the proximity of the transaction amount and the threshold is given a higher weight.

[0087] It should be noted that for a single intent axis, when there are multiple rule functions, the output results of each rule function are summarized according to preset weights to form the final projection value of the corresponding intent axis.

[0088] Step 33: After the projection values ​​of the N intent axes are calculated, all projection values ​​are combined in a predetermined order to generate a preliminary intent vector. The preliminary intent vector is the original configuration coordinate of a financial transaction in multidimensional space, representing the degree of risk tendency of the financial transaction based on the current rules.

[0089] It should be noted that the initial intent vector is a one-dimensional numerical value or list, where each element represents an intent axis. Assuming the calculated stealth tendency is 0.8, bypass tendency is 0.2, avoidance tendency is 0.5, and cooperation tendency is 0.9, then the initial intent vector = [0.8, 0.2, 0.5, 0.9].

[0090] In this embodiment, abnormal samples are used as feedback signals input to the adaptive mechanism. The weights of the preset rule function are adjusted based on true positives and false positives to optimize the accuracy of the intent vector and generate the final behavioral intent vector. Please refer to [link / reference]. Figure 4 ,include:

[0091] Step 41: Abnormal samples are introduced as feedback signals into the adaptive processing flow of the preset rule function. The feedback signals include the final judgment result of a certain financial behavior and the corresponding abnormal type label, distinguishing between true positive and false positive results.

[0092] Step 42: When generating a financial behavior intent vector based on feedback signals, the rule function and corresponding weights used are used to associate the high-dimensional feature vector, preliminary intent vector, and anomaly judgment result of a financial behavior.

[0093] Step 43: For behaviors determined to be true positive, determine the discriminative power of the projection values ​​on different intent axes. If the discriminative power is insufficient, increase the weight of the corresponding rule function to enhance the sensitivity of the intent axis to similar abnormal behaviors.

[0094] Step 44: For behaviors identified as false positives, identify the feature contribution in the intent projection process, reduce the weight of the corresponding rule function, and reduce misjudgments of normal behaviors.

[0095] Step 45: After weight adjustment, the updated preset rule function cluster is applied to the high-dimensional feature vector again to generate an optimized behavioral intent vector. The behavioral intent vector includes the behavioral purpose, responsibility attribution, process location, and budget constraint strength.

[0096] Step 103: Embed the behavioral intent vector into a preset behavioral configuration manifold in a business-constrained manner, identify atypical patterns of the behavioral intent vector, and mark high-risk nodes in the atypical patterns.

[0097] It should be noted that the behavioral configuration manifold describes the overall structural state under the combined effect of intention and constraints. It can represent the stable state of normal behavior in the overall structural state and serves as a reference benchmark for identifying deviations from abnormal behavior.

[0098] The behaviors here refer to complete financial actions, such as an expense reimbursement, a payment, or a budget adjustment. Each behavior is mapped to a behavioral intent vector. A configuration is the state and role of a behavior within the overall structure. For example, whether a payment behavior is close to similar payment behaviors or maintains a reasonable distance from its preceding and following steps describes the structural state of the behavior within the overall behavior. A manifold represents that behaviors are not randomly scattered, but rather continuous structural regions formed by normal behaviors in a high-dimensional intent space. The overall structural form is shaped by rules and historical behaviors. Normal behaviors correspond to different structural regions in different business scenarios. Changes in normal behaviors are gradual, while abnormal behaviors will jump out of their corresponding structural regions.

[0099] The behavior configuration manifold carries the behavior intention vector. Each behavior is embedded in the manifold and occupies a structural position. The structural boundary of normal behavior is defined by the overall distribution shape. The movement path of the behavior intention vector in the manifold is, for example, when it suddenly moves away from the normal path, it is a partial rationality principle; when multiple behaviors constitute an abnormal structure, it is a cooperative anomaly.

[0100] By observing the behavior intention vector in the behavior configuration manifold, we can determine whether the behavior intention vector is in an abnormal structural position and understand the overall shape of the behavior set.

[0101] Specifically, behavioral intent vectors are embedded into a predefined behavioral configuration manifold in a business-constrained manner. Atypical patterns in the behavioral intent vectors are identified, and high-risk nodes within these atypical patterns are labeled. (Please refer to...) Figure 5 ,include:

[0102] Step 51: Input the behavioral intent vector into the preset behavioral configuration manifold, and locate the behavioral intent vector to the corresponding structural space position of the behavioral configuration manifold through vector mapping.

[0103] Step 52: Perform a structural comparison between the new positioning behavior intent vector and the historical behavior vector to obtain the structural indicators of the new positioning behavior intent vector in the structural space. The structural indicators include the average distance to the nearest neighbor behavior, the density of the area, the offset relative to the historical center trajectory, and the displacement trend within a preset time period.

[0104] Step 53: Conduct a comprehensive evaluation of structural indicators. If the behavioral intention vector is located in an unstable structural region of the preset behavioral configuration manifold, then the behavioral intention vector is an atypical pattern and is marked as a high-risk node in the preset behavioral configuration manifold.

[0105] The comprehensive evaluation includes: comparing the average distance between the current behavior and its K nearest neighbor behaviors with the distance distribution of the behavior in historical samples to calculate the average distance deviation of the behavior in the historical distribution; calculating the density within the neighborhood of the current behavior and comparing it with the average density of the behavior within the historical window to obtain the local density deviation value; using the historical center trajectory of similar behaviors as a reference to calculate the structural distance from the current behavior to the historical center trajectory to obtain the center trajectory offset magnitude; and calculating the consistency of displacement direction and cumulative displacement length for continuous intention vectors of the same behavioral subject within a preset time period to obtain the displacement trend.

[0106] The system performs rule mapping on the average distance deviation, local density deviation, center trajectory offset, and displacement trend, outputting risk scores for different rules. Different rule mappings are achieved by setting thresholds, with each rule corresponding to a risk score.

[0107] The risk scores of different rules are weighted and summed to obtain a comprehensive score. When the comprehensive score is lower than the first threshold, the current behavioral intention vector is judged to deviate from the stable structure region. When the comprehensive score is in the second threshold range, the behavioral intention vector is marked as marginal behavior. When the comprehensive score is higher than the first threshold, the behavioral intention vector is judged to be normal behavior.

[0108] For example, taking the procurement-payment process, we obtain historical compliant financial samples and map each financial transaction to a behavioral intent vector. For normal procurement and payment transactions, due to consistency in behavioral purpose, responsibility attribution, process position, and budget constraint strength, they are embedded in the same structural space, forming stable structural regions. These different structural regions collectively constitute the behavioral manifold within the procurement and payment scenario. For instance, contract signing is typically distributed in regions with clear procurement intent, moderate budget constraint strength, and early process positions. Payment execution is concentrated in regions of fund release, responsibility confirmation completion, and later process positions.

[0109] New payment actions are mapped onto the aforementioned predefined behavioral manifold. Generally, new payment actions conform to the normal procurement process, and their vector space falls within the stable structural region of the behavioral manifold. When a payment action occurs before the contract is completed, the payment action vector deviates from the stable structural region of the corresponding behavioral manifold, representing a disruption of the manifold structure. Consequently, this payment action is identified as a high-risk anomaly. The behavioral manifold, through the stable structural benchmark of historical normal actions within the intention space, enables the identification of anomalies.

[0110] Step 104: Determine the spatial distance of each behavioral intent vector to the high-risk nodes marked in the behavioral configuration manifold. Introduce high-risk weights based on spatial distance and basic perturbation density, obtain weighted perturbation density, dynamically adjust the future inference depth, and form a prediction result with probability distribution based on the inference results.

[0111] It should be noted that determining the spatial distance of each behavioral intent vector to the high-risk nodes already labeled in the behavioral configuration manifold includes:

[0112] Based on the behavioral configuration manifold, the relationship between the behavioral intent vector and the intent vector of high-risk nodes is judged. When the judgment result meets the preset conditions, it is determined that the current behavior and the high-risk node have a high-risk proximity relationship in the behavioral configuration manifold.

[0113] Assume the current behavioral intent vector is: The intent vector of high-risk nodes is The relationship between behavioral intent vectors and high-risk node intent vectors includes:

[0114] Based on the relative positional relationship between intent vectors, determine whether the current behavior falls within a preset high-risk neighborhood. To preset the neighborhood radius, when If so, the current behavior is determined to be within the neighborhood of a high-risk node.

[0115] In this embodiment, a high-risk weight is introduced based on spatial distance and basic perturbation density to obtain the weighted perturbation density, which can be expressed as: ,in For weighted perturbation density, Based on the basic perturbation density, The spatial attenuation coefficient, Risk level weights for high-risk nodes.

[0116] In this embodiment of the application, dynamically adjusting the future extrapolation depth includes: when the weighted perturbation density is greater than a preset threshold, increasing the extrapolation depth and performing multi-step temporal extrapolation of the behavioral intent vector along the high-risk cycle to capture structural risks on a long scale; when the weighted perturbation density is not greater than the preset threshold, performing limited extrapolation on short-term changes.

[0117] After the deduction is completed, the future behavioral states obtained from the multi-step deduction are combined into a future abnormal trajectory sequence, and different trajectory sequences are assigned corresponding occurrence probabilities to form a prediction result with a probability distribution.

[0118] Step 105: Calculate anomaly scores for the prediction results and trigger an early warning action based on the anomaly scores.

[0119] It should be noted that the early warning actions include manual review, transaction blocking, and audit records.

[0120] In this embodiment of the application, an anomaly score is given to the prediction result, and an early warning action is triggered based on the anomaly score result, including:

[0121] Extract the abnormal indicators of the future abnormal trajectory sequences from the prediction results, perform a weighted summation of the abnormal indicators to obtain the abnormal score of each abnormal trajectory sequence, determine the abnormal score, and trigger an early warning action when the abnormal score is greater than a preset threshold.

[0122] It should be noted that the abnormal indicators include the distance of the future abnormal trajectory from the historical normal behavior configuration manifold, the acceleration of the future abnormal trajectory on the high-risk axis, etc., and the abnormal indicators can be set according to actual needs.

[0123] Please refer to Figure 6 A financial abnormal behavior pattern recognition system provided in this application includes:

[0124] The behavior anchoring information generation module 601 is used to parse composite operation information into serialized sub-events based on preset parsing rules, perform atomic decomposition on the serialized sub-events to generate indivisible minimum operation units, bind the operation subject index and operation device fingerprint to each minimum operation unit, and generate traceable behavior anchoring information.

[0125] The final behavior intent vector generation module 602 is used to convert behavior anchoring information into high-dimensional feature vectors, calculate the projection value of each high-dimensional feature vector on different behavior intent axes based on a preset rule function cluster, generate a preliminary intent vector, input abnormal samples as feedback signals into an adaptive mechanism, adjust the weight of the preset rule function according to true positives and false positives, optimize the accuracy of the intent vector, and generate the final behavior intent vector.

[0126] The high-risk node annotation module 603 is used to embed the behavioral intent vector into a preset behavioral configuration manifold, identify atypical patterns of the behavioral intent vector, and annotate high-risk nodes in the atypical patterns.

[0127] The prediction result acquisition module 604 is used to determine the spatial distance of each behavioral intention vector to the high-risk nodes marked in the behavioral configuration manifold, introduce high-risk weights based on spatial distance and basic perturbation density, obtain weighted perturbation density, dynamically adjust the future inference depth, and form a prediction result with probability distribution based on the inference result.

[0128] The early warning action triggering module 605 is used to score the prediction results for anomalies and trigger early warning actions based on the anomaly score results.

[0129] This application transforms behavioral anchoring information into high-dimensional feature vectors, calculates the projection value of each high-dimensional feature vector on different behavioral intent axes, generates a preliminary intent vector, optimizes the accuracy of the intent vector, and generates a final behavioral intent vector. The behavioral intent vector is embedded into a preset behavioral configuration manifold, atypical patterns of the behavioral intent vector are identified, and high-risk nodes in the atypical patterns are marked. The spatial distance of each behavioral intent vector to the marked high-risk nodes in the behavioral configuration manifold is determined, and high-risk weights are introduced based on the spatial distance and the basic perturbation density to obtain a weighted perturbation density. The future inference depth is dynamically adjusted to form a prediction result with a probability distribution. Anomaly scoring is applied to the prediction results, and an early warning action is triggered. This application transforms post-event identification into pre-event prediction. Even when the intent structure shifts, it can still be identified in the configuration manifold, reducing the risk of deliberate avoidance in identifying abnormal financial behavior.

[0130] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 7 , Figure 7 This is a basic structural block diagram of the computer device in this embodiment.

[0131] The computer device 7 includes a memory 7a, a processor 7b, and a network interface 7c that are interconnected via a system bus. It should be noted that only the computer device 7 with components 7a-7c is shown in the figure; however, it should be understood that it is not required to implement all the shown components, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0132] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0133] The memory 7a includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 7a may be an internal storage unit of the computer device 7, such as the hard disk or memory of the computer device 7. In other embodiments, the memory 7a may also be an external storage device of the computer device 7, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 7. Of course, the memory 7a may include both the internal storage unit and its external storage device of the computer device 7. In this embodiment, the memory 7a is typically used to store the operating system and various application software installed on the computer device 7, such as the program code of a financial abnormal behavior pattern recognition method. In addition, the memory 7a can also be used to temporarily store various types of data that have been output or will be output.

[0134] In some embodiments, the processor 7b may be a central processing unit (CPU), controller, microcontroller, microprocessor, or other data processing chip. The processor 7b is typically used to control the overall operation of the computer device 7. In this embodiment, the processor 7b is used to run program code stored in the memory 7a or process data, for example, to run the program code of the financial abnormal behavior pattern recognition method.

[0135] The network interface 7c may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 7 and other electronic devices.

[0136] This application also provides another embodiment, namely, a non-volatile computer-readable storage medium storing a program for a financial abnormal behavior pattern recognition method, which can be executed by at least one processor to perform the steps of the financial abnormal behavior pattern recognition method as described above.

[0137] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0138] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A method for identifying patterns of abnormal financial behavior, characterized in that, include: Based on preset parsing rules, the composite operation information is parsed into serialized sub-events. The serialized sub-events are atomically decomposed to generate the smallest indivisible operation unit. Each smallest operation unit is bound to the operation subject index and the operation device fingerprint to generate behavior anchoring information. The composite operation is a reimbursement operation. The behavior anchoring information is transformed into a high-dimensional feature vector. Based on the preset rule function cluster, the projection value of each high-dimensional feature vector on different behavior intention axes is calculated to generate a preliminary intention vector. Abnormal samples are used as feedback signals to input the adaptive mechanism. The weights of the preset rule functions are adjusted according to true positives and false positives to optimize the accuracy of the intention vector and generate the final behavior intention vector. Embed the behavioral intent vector into a preset behavioral configuration manifold, identify atypical patterns of the behavioral intent vector, and label high-risk nodes in the atypical patterns; Determine the spatial distance between each behavioral intent vector and the labeled high-risk nodes in the behavioral configuration manifold. Based on the spatial distance and the basic perturbation density, introduce high-risk weights to obtain the weighted perturbation density. Dynamically adjust the future inference depth and form a prediction result with a probability distribution based on the inference results. Anomaly scores are assigned to the prediction results, and early warning actions are triggered based on the anomaly scores.

2. The method for identifying abnormal financial behavior patterns according to claim 1, characterized in that, Based on preset parsing rules, composite operation information is parsed into serialized sub-events, including: Retrieve the original transaction records containing complex operations; Based on preset parsing rules, identify each independent action in the composite operation and parse it into discrete operation nodes; The operation nodes are assigned original timestamps and sorted in chronological order to form serialized sub-events.

3. The method for identifying abnormal financial behavior patterns according to claim 1, characterized in that, The serialized sub-events are atomically decomposed to generate indivisible minimum operation units. Each minimum operation unit is bound to an operation subject index and an operation device fingerprint, generating traceable behavior anchoring information, including: The serialized sub-event is evaluated. If it contains multiple separable actions, the serialized sub-event is decomposed. If the serialized sub-event contains only one action, the current serialized sub-event is regarded as the smallest unit of operation. Assign a unique event ID to each smallest operation unit and establish a mapping index with the original serialized sub-events; bind the operation subject index and operation device fingerprint to each smallest operation unit; After completing the binding of the smallest unit of operation, output the behavior anchoring information.

4. The method for identifying abnormal financial behavior patterns according to claim 1, characterized in that, Based on a pre-defined cluster of rule functions, the projection values ​​of each high-dimensional feature vector on different behavioral intent axes are calculated to generate a preliminary intent vector, including: N intent axes are predefined, and a rule function is preset for each intent axis. The set of rule functions for the N intent axes is called the preset rule function cluster. When a high-dimensional feature vector is input into the preset rule function cluster, the preset rule function cluster is called in parallel. Select feature dimensions that are semantically related to the corresponding intent axis and combine them in a weighted manner to calculate the projection value of a financial behavior on the corresponding intent axis. Each projection value represents the relative strength or deviation of the financial behavior in the corresponding intent direction. Once the projection values ​​of the N intent axes are calculated, all projection values ​​are combined in a predetermined order to generate a preliminary intent vector.

5. The method for identifying abnormal financial behavior patterns according to claim 1, characterized in that, Abnormal samples are used as feedback signals to input into the adaptive mechanism. The weights of the preset rule function are adjusted based on true and false positives to optimize the accuracy of the intent vector, generating the final behavioral intent vector, including: Abnormal samples are introduced as feedback signals into the adaptive processing flow of the preset rule function; When generating a financial behavior intent vector based on feedback signals, the rule function and corresponding weights used are used to associate the high-dimensional feature vector, preliminary intent vector, and anomaly judgment results of a financial behavior. For behaviors identified as true positives, the discriminative power of the projection values ​​on different intent axes is assessed. If the discriminative power is insufficient, the weight of the corresponding rule function is increased to enhance the sensitivity of that intent axis to similar abnormal behaviors. For behaviors identified as false positives, the feature contribution during the intent projection process is identified, and the weight of the corresponding rule function is reduced to decrease the misjudgment of normal behaviors. After the weight adjustment is completed, the updated preset rule function cluster is applied to the high-dimensional feature vector again to generate an optimized behavioral intent vector.

6. The method for identifying abnormal financial behavior patterns according to claim 1, characterized in that, The behavioral intent vector is embedded into a predefined behavioral configuration manifold in a business-constrained manner. Atypical patterns of the behavioral intent vector are identified, and high-risk nodes in the atypical patterns are marked, including: Input the behavioral intent vector into the preset behavioral configuration manifold, and locate the behavioral intent vector to the corresponding structural space position of the behavioral configuration manifold through vector mapping. The new positioning behavior intent vector is structurally compared with the historical behavior vector to obtain the structural index of the new positioning behavior intent vector in the structural space. A comprehensive evaluation of structural indicators is conducted. If a behavioral intention vector is located in an unstable structural region of a preset behavioral configuration manifold, then the behavioral intention vector is an atypical pattern and is marked as a high-risk node in the preset behavioral configuration manifold.

7. The method for identifying abnormal financial behavior patterns according to claim 1, characterized in that, Determine the spatial distance of each behavioral intent vector to the labeled high-risk nodes in the behavioral configuration manifold, including: Based on the behavioral configuration manifold, the relationship between the behavioral intent vector and the intent vector of high-risk nodes is judged. When the judgment result meets the preset conditions, it is determined that the current behavior and the high-risk node have a high-risk proximity relationship in the behavioral configuration manifold.

8. A financial abnormal behavior pattern recognition system, used to implement the method described in any one of claims 1-7, characterized in that, include: The behavior anchoring information generation module is used to parse composite operation information into serialized sub-events based on preset parsing rules, perform atomic decomposition on the serialized sub-events to generate indivisible minimum operation units, bind the operation subject index and operation device fingerprint to each minimum operation unit, and generate traceable behavior anchoring information; the composite operation is a reimbursement operation. The final behavioral intent vector generation module is used to convert behavioral anchoring information into high-dimensional feature vectors. Based on a preset set of rule functions, it calculates the projection value of each high-dimensional feature vector on different behavioral intent axes to generate a preliminary intent vector. Abnormal samples are used as feedback signals to input the adaptive mechanism. The preset rule function weights are adjusted according to true positives and false positives to optimize the accuracy of the intent vector and generate the final behavioral intent vector. The high-risk node annotation module is used to embed behavioral intent vectors into a preset behavioral configuration manifold, identify atypical patterns of behavioral intent vectors, and annotate high-risk nodes in atypical patterns. The prediction result acquisition module is used to determine the spatial distance between each behavioral intent vector and the labeled high-risk nodes in the behavioral configuration manifold. Based on the spatial distance and the basic perturbation density, high-risk weights are introduced to obtain the weighted perturbation density, and the future inference depth is dynamically adjusted. Based on the inference results, a prediction result with a probability distribution is formed. The early warning action triggering module is used to score the prediction results for anomalies and trigger early warning actions based on the anomaly score results.

9. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, When executed by the processor, this instruction implements the steps of the method as described in any one of claims 1-7.

Images