Cash-out identification method based on multi-modal dynamic atlas and risk propagation

Abstract

The invention discloses a cash-out identification method based on a multi-modal dynamic map and risk propagation, and belongs to the technical field of financial science and technology and artificial intelligence crossing. The method comprises the steps of firstly integrating multi-source data to construct a dynamic heterogeneous graph; then modeling a spatial risk relationship by using a heterogeneous graph neural network of a hierarchical attention mechanism, and generating a graph structure risk representation; meanwhile, coding a time sequence operation behavior of the employee by utilizing Transform so as to capture a behavior intention; on the basis, a dynamic risk propagation mechanism is introduced, and risk signals are directionally diffused along the atlas; and finally, the violation risk probability of the employees is calculated by fusing multi-modal information such as the graph structure risk, the time sequence behavior intention, the propagation risk value and the static characteristics. According to the invention, the accuracy and timeliness of identifying the current credit card sleeve of the internal employee by a bank are effectively improved.

Description

Technical Field

[0001] This invention relates to the field of interdisciplinary technology of financial technology and artificial intelligence, and in particular to a method, apparatus, device and storage medium for identifying cash-out based on multimodal dynamic graphs and risk propagation. Background Technology

[0002] In the field of financial risk management, credit card cash advance is a long-standing illegal activity. Specifically, this behavior typically refers to cardholders directly or indirectly converting their credit card limit into cash through irregular means such as fabricated transactions (e.g., falsifying transaction backgrounds, inflating product prices, or processing cash refunds), thereby obtaining funds, engaging in revolving overdrafts, or evading regulation. Such behavior directly violates relevant regulations such as the "Supervision and Management Measures for Commercial Bank Credit Card Business," disrupting the normal operation of the credit card business. More seriously, cash advance significantly exacerbates banks' credit risk, easily leading to an increase in credit card bad debt rates; simultaneously, the potentially fabricated transaction backgrounds and concealed fund flows provide channels for money laundering and other illegal activities, posing a potential threat to financial system security.

[0003] Among the various perpetrators of cash-out schemes, bank employees, as a special group, pose a particularly serious threat due to their potential illegal cash-out activities. Because employees directly possess customer credit information, loan approval authority, merchant resources, and are familiar with risk control rules, their planned and implemented cash-out activities are often meticulously designed, employing more professional, covert, and systematic methods. This kind of "insider" misconduct not only risks greater direct financial losses due to its difficulty in detection, but also, once exposed, severely damages the bank's internal management reputation and external market credibility, resulting in a complex risk far exceeding that of cash-out schemes by ordinary customers.

[0004] However, traditional risk control methods in existing technologies have significant limitations in dealing with such highly concealed internal violations. Mainstream methods largely rely on static threshold warnings based on rule engines (such as monitoring single transaction amounts or specific merchant types) or statistical analysis of isolated historical transaction data. These methods struggle to effectively integrate multi-dimensional heterogeneous information such as employee behavior, customer networks, merchant relationships, and transaction timelines, resulting in "information silos" and "data islands." More importantly, traditional methods lack the ability to model the dynamic evolution and propagation paths of risks along entity relationship networks. They cannot deeply mine hidden patterns of collaborative crime and risk contagion chains from complex relationship graphs and behavioral timelines, leading to delays, high false positive rates, or missed detections in the identification of bank employees' credit card cash-out behavior, failing to meet the urgent needs of current refined and intelligent financial risk prevention and control. Summary of the Invention

[0005] The present invention aims to at least partially solve one of the technical problems in the related art.

[0006] To address this, this invention proposes a method for identifying bank employees engaging in illegal cash-out activities based on multimodal dynamic graphs and risk propagation. This method constructs a dynamic heterogeneous graph that integrates multiple types of entities and relationships, and employs a heterogeneous graph neural network with a hierarchical attention mechanism to extract graph structure risk representations. Combined with temporal behavior encoding and a dynamic risk propagation mechanism, it ultimately achieves accurate identification and early warning of employee illegal cash-out risks through multimodal feature fusion.

[0007] Another objective of this invention is to propose a cash-out identification device based on multimodal dynamic graphs and risk propagation.

[0008] The third objective of this invention is to provide a computer device.

[0009] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0010] To achieve the above objectives, this invention proposes a method for identifying cash-out schemes based on multimodal dynamic graphs and risk propagation, comprising: S1, construct a dynamic heterogeneous information graph, integrate multi-type entities such as employees, customers, merchants, and accounts, as well as the corresponding semantic relationships of approval, transaction, and transfer, and dynamically maintain the time-series operation sequence for employee nodes; S2 uses a heterogeneous graph neural network with a hierarchical attention mechanism to model the spatial relationships of the dynamic heterogeneous graph. It calculates the contribution weight of each neighbor node to the risk of the target employee through node-level attention and calculates the global impact weight of different relationship types on risk propagation through relationship-level attention, thereby generating a graph structure risk representation vector for the employee. S3 encodes the temporal operation sequence of employees based on the Transformer architecture, uses the self-attention mechanism to capture the long-range dependencies between operation behaviors, and generates a temporal intent vector representing the employee's behavioral intention. S4. When any node in the graph is detected to be marked as high risk, a dynamic risk propagation mechanism is activated. Based on the graph structure risk representation vector and attention weight, the risk signal is propagated in a directional manner along the graph connection edge to generate the real-time propagation risk value of the employee node. S5, perform multimodal fusion of the graph structure risk representation vector, the temporal intent vector, the real-time propagation risk value and the employee static feature vector, input the data into the classifier to calculate the employee's violation probability and output the risk score.

[0011] The cash-out identification method based on multimodal dynamic graphs and risk propagation in this invention may also have the following additional technical features: In one embodiment of the present invention, constructing a dynamic heterogeneous information graph includes: S11 uses a rules engine to clean the raw data from the credit card transaction system, core accounting system, credit approval system, and human resources system, removing invalid records and noisy data. S12 uses a graph embedding algorithm to align entities in the cleaned data, mapping the same entity in different systems to a unified identifier, and constructs semantic relationship edges for approval, transaction, and transfer through a relation extraction model.

[0012] In one embodiment of the present invention, a heterogeneous graph neural network employing a hierarchical attention mechanism includes: S21, Calculate node-level attention scores using the LeakyReLU activation function. ;in, , They are nodes , In the The layer's representation vector, It is a learnable shared weight matrix. It is a learnable attention vector; S22, the node-level attention scores are normalized using the softmax function to obtain standardized attention weights. ;in, For nodes The set of all neighbors.

[0013] In one embodiment of the present invention, encoding a sequence of time-series operations based on the Transformer architecture includes: S31, calculate the query matrix using a multi-head self-attention mechanism. Key matrix Sum matrix The formula for calculating single-head attention is as follows: ; S32, using scaling factor The attention score is normalized to prevent the gradient from vanishing due to an excessively large inner product.

[0014] In one embodiment of the present invention, activating a dynamic risk propagation mechanism includes: S41, the initial risk value for merchant nodes that will be marked as high-risk. Set it to 1.0 and set the damping factor. Control the rate at which risk spreads and diminishes; S42, through iterative formula Multiple rounds of propagation are performed until the preset maximum number of iterations and risk value convergence are reached; among them... Any node in the diagram In the Risk value after propagation side The weight.

[0015] In one embodiment of the present invention, it further includes: S6 incrementally updates the dynamic heterogeneous graph according to the preset update cycle, and retrains the heterogeneous graph neural network and Transformer encoder based on the newly added nodes and edges to dynamically adjust the model parameters and risk propagation weights.

[0016] To achieve the above objectives, another aspect of the present invention proposes a cash-out identification device based on multimodal dynamic graphs and risk propagation, comprising: The dynamic heterogeneous graph construction module is used to construct a dynamic heterogeneous information graph, which integrates multi-type entities such as employees, customers, merchants, and accounts, as well as their corresponding semantic relationships of approval, transaction, and transfer through multi-source data, and dynamically maintains the time-series operation sequence of employee nodes. The heterogeneous graph neural network module is used to model the spatial relationships of dynamic heterogeneous graphs using a hierarchical attention mechanism. It calculates the contribution weight of each neighbor node to the risk of the target employee through node-level attention and calculates the global impact weight of different relationship types on risk propagation through relationship-level attention, generating a graph structure risk representation vector for the employee. The Transformer temporal encoding module is used to encode the temporal operation sequence of employees based on the Transformer architecture. It uses the self-attention mechanism to capture the long-range dependencies between operation behaviors and generate a temporal intent vector that represents the employee's behavioral intention. The dynamic risk propagation module is used to activate the dynamic risk propagation mechanism when any node in the graph is detected as high-risk. Based on the graph structure risk representation vector and attention weight, the risk signal is propagated in a directional manner along the graph connection edge to generate the real-time propagation risk value of the employee node. The multimodal fusion and risk scoring module is used to perform multimodal fusion of the graph structure risk representation vector, the temporal intent vector, the real-time propagation risk value and the employee static feature vector, input the data into a classifier to calculate the employee's violation probability and output a risk score.

[0017] In one embodiment of the present invention, it further includes: The incremental update module is used to incrementally update the dynamic heterogeneous graph according to a preset update cycle, and retrain the heterogeneous graph neural network and Transformer encoder based on the newly added nodes and edges to dynamically adjust the model parameters and risk propagation weights.

[0018] This invention presents a method for identifying cash-out schemes based on multimodal dynamic graphs and risk propagation. This method overcomes the limitations of traditional risk control methods that rely on isolated rules and static data, effectively solving the problems of difficulty and delay in identifying highly concealed and complex collaborative cash-out behaviors of bank employees. Through dynamic graph modeling and multimodal risk feature fusion, it achieves comprehensive and in-depth mining of employee relationship networks, temporal operational intentions, and dynamic risk propagation paths. This significantly improves the accuracy, timeliness, and comprehensiveness of the perception of internal illegal cash-out risks, providing intelligent technical support for banks to strengthen internal risk management and reduce financial losses and reputational risks.

[0019] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, for implementing a cash-out identification method based on multimodal dynamic graphs and risk propagation as described in the first aspect embodiment.

[0020] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a cash-out identification method based on multimodal dynamic graphs and risk propagation as described in the first aspect embodiment.

[0021] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0022] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a cash-out identification method based on multimodal dynamic graphs and risk propagation according to an embodiment of the present invention; Figure 2 This is a model architecture diagram of a cash-out identification method based on multimodal dynamic graph and risk propagation according to an embodiment of the present invention; Figure 3 This is a schematic diagram of a cash-out identification device based on multimodal dynamic graph and risk propagation according to an embodiment of the present invention; Figure 4 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0023] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] The following description, with reference to the accompanying drawings, describes a method, apparatus, device, and storage medium for identifying cash-out schemes based on multimodal dynamic graphs and risk propagation, according to embodiments of the present invention.

[0026] The core idea of ​​this invention is to construct a dynamic heterogeneous information graph that integrates multiple types of entities and complex semantic relationships, combining multi-source data such as employees, customers, merchants, and accounts, and dynamically maintaining their behavioral sequences. Based on this, a heterogeneous graph neural network with a hierarchical attention mechanism and a Transformer temporal encoder are comprehensively used to deeply model the spatial risk associations between entities and the long-range dependencies in employees' temporal operations, generating graph-structured risk representations and behavioral intent vectors. By introducing a dynamic risk propagation mechanism based on attention weights, the directional diffusion and real-time assessment of risk signals in the graph are achieved. Finally, the above-mentioned multimodal dynamic features are fused with employee static features, and a classifier is used to accurately calculate the probability of violations and output risk scores, thereby constructing an intelligent identification system capable of deeply mining hidden associations and dynamically perceiving risk evolution. This significantly improves the real-time detection capability and discrimination accuracy of complex cash-out behaviors of bank employees.

[0027] Example 1 To achieve the above invention, embodiments of the present invention provide a method for identifying cash-out schemes based on multimodal dynamic graphs and risk propagation, such as... Figure 1 As shown, it includes: S1 constructs a dynamic heterogeneous information graph, which integrates multi-type entities such as employees, customers, merchants, and accounts, as well as their corresponding semantic relationships of approval, transaction, and transfer through multi-source data, and dynamically maintains the time-series operation sequence for employee nodes.

[0028] Specifically, the graph construction module of this invention aims to construct a dynamic heterogeneous information graph to comprehensively depict the complex semantic relationships between bank employees and their related entities (customers, merchants, accounts, etc.), and dynamically maintain the temporal operation sequence of employees, providing a structured data foundation for subsequent risk propagation and multimodal fusion.

[0029] Specifically, this module first extracts structured and unstructured data from multiple heterogeneous data sources (such as credit card transaction systems, credit approval systems, and human resources systems), and then uses entity recognition and relation extraction technologies to identify employees... ,client Merchants Credit card account Savings Account Entities are mapped to uniform graph nodes. Each type of node has its own specific set of attributes. For example, employee nodes contain metadata such as department, job level, and years of service, while customer nodes contain attributes such as credit score and transaction frequency. (Edge set) This indicates the semantic relationship between entities, such as an approval relationship. Transaction relationship Transfer relationship Each edge carries edge attributes such as timestamp, amount, and geographic location. This is to support subsequent time series modeling and risk propagation.

[0030] Furthermore, to capture the dynamic evolution of employee behavior, the system performs [further analysis] for each employee node. Maintain a sequence of time operations Each of the operations It is encoded as a low-dimensional dense vector representing the operation type (e.g., "approval", "query"), the operation object (e.g., customer ID, merchant ID), and contextual information (e.g., operation time, IP address). This sequence is dynamically updated through a time window mechanism to ensure that the graph reflects the latest status of employee behavior.

[0031] Specifically, the mapping rules between entities and relationships need to be set during the graph construction process, such as the standardization method of entity IDs, the enumeration set of relationship types, the granularity of timestamps (e.g., accurate to the minute), and the initialization strategy of edge weights (e.g., based on node attention). Or relational attention Furthermore, the encoding dimension of temporal operation sequences is typically set to 128-256 dimensions to balance information density and computational efficiency.

[0032] Specifically, this module is widely used in internal bank risk control systems, especially in high-risk business scenarios such as credit card approval, merchant cooperation, and account transactions. By unifying the modeling of the interaction between employee behavior and its associated entities, the system can reveal hidden collusion relationships and abnormal behavior paths, providing high-quality input for subsequent HGAT and Transformer models.

[0033] Specifically, the technical effect of this step is that it constructs a semantically rich, dynamically updated, and heterogeneously integrated graph structure, laying the foundation for multi-dimensional modeling of employee risks. Compared with traditional static feature engineering, this graph can effectively capture the location and behavioral evolution of employees in complex business networks, significantly improving the ability to identify covert and organized cash-out behaviors.

[0034] Furthermore, S1 includes: S11 uses a rules engine to clean the raw data from the credit card transaction system, core accounting system, credit approval system, and human resources system, removing invalid records and noisy data.

[0035] Specifically, this step aims to improve the modeling accuracy of subsequent graph neural networks and Transformer models, and ensure the semantic integrity and data quality of nodes and edges in the graph.

[0036] Furthermore, this data cleaning process, based on predefined business rules and data quality standards, employs a distributed rule engine (such as Drools or Apache Flink CEP) to process multi-source heterogeneous data in real-time or in batches. The rule engine configures rules such as field integrity checks, timestamp consistency checks, amount anomaly detection, and approval process compliance verification according to the data structure and business logic of each system. For example, in a credit card transaction system, if the transaction amount is negative or the timestamp is earlier than the account opening time, it is considered an invalid record; in a credit approval system, if the approver and customer have no actual approval relationship or the approval time interval is less than the system's minimum approval cycle (e.g., 30 minutes), it is considered noise data.

[0037] Furthermore, cleaning rules typically include threshold settings and anomaly detection criteria. For example, the timestamp anomaly threshold could be set to... (Account activation time) and (Current time plus reasonable error time), the threshold for abnormal amounts can be set to... and Transactions exceeding this range will be filtered. Furthermore, the system will perform consistency checks based on the relationships between business entities; for example, the approval relationship between employees and customers must meet certain requirements. and ,and The approval authority needs to be consistent with The application type matches.

[0038] Specifically, this step is widely used in the data preprocessing stage of internal bank risk control systems. In credit card cash-out detection scenarios, the raw data may contain a large number of redundant, duplicate, or incorrectly formatted records, such as missing approval times in employee approval records or fictitious merchant numbers in customer transaction records. Cleaning with a rule engine ensures the semantic correctness and structural integrity of nodes (such as employees, customers, and merchants) and edges (such as approvals and transactions) in the graph, providing high-quality input for subsequent HGAT graph neural networks and Transformer encoders.

[0039] Specifically, this step significantly improves the accuracy and robustness of graph construction. By removing invalid and noisy data, interference signals during model training are reduced, improving the reliability of node representation and relation modeling. Simultaneously, the cleaned data better matches the entity and relation types defined in the graph construction module, ensuring the graph structure... Its consistency and scalability lay a solid foundation for realizing the paradigm shift in risk detection "from individual identification to network identification".

[0040] S12 uses a graph embedding algorithm to align entities in the cleaned data, mapping the same entity in different systems to a unified identifier, and constructs semantic relationship edges for approval, transaction, and transfer through a relation extraction model.

[0041] Specifically, the core objective of this step is to map entities (such as employees, customers, merchants, and accounts) from different business systems (such as credit card transaction systems, credit approval systems, and human resources systems) into a unified identifier space, thereby eliminating data silos and constructing a heterogeneous graph structure with semantic relationships.

[0042] Furthermore, entity alignment relies on graph embedding algorithms (such as TransE, GraphSAGE, Node2Vec, etc.). The basic principle is to map entities and relations to a low-dimensional vector space, so that semantically similar or identical entities have similar representations in the vector space. In practice, firstly, multi-source data is cleaned and standardized, including unifying timestamp formats, removing duplicate records, and standardizing entity names. Then, graph embedding algorithms are used to encode entities, mapping heterogeneous identifiers representing the same entity in different systems (such as "Employee ID_001" and "Employee Number E12345") to a unified vector space, thereby achieving cross-system entity recognition and alignment.

[0043] Furthermore, graph embedding algorithms typically involve key parameters such as embedding dimension (e.g., 128 or 256 dimensions), negative sampling ratio (e.g., 5:1), learning rate (e.g., 0.001), and number of training epochs (e.g., 100 epochs). In addition, a similarity threshold (e.g., cosine similarity ≥ 0.85) needs to be set during entity alignment to determine whether two entities should be merged into the same node. Relation extraction models are based on pre-trained semantic models (e.g., BERT, RoBERTa) or graph relation reasoning models (e.g., R-GCN). Their input is cleaned text or structured operation logs, and their output is the relation type between entities (e.g., "approval," "transaction," "transfer," etc.) and their edge attributes (e.g., timestamp, amount, geographical location, etc.).

[0044] Specifically, this step is widely used in internal bank risk control systems, especially when integrating employee behavior data with customer and merchant transaction data, to ensure the consistency of entities and the accuracy of relationships in the graph. For example, when employee E1 approves customer C1's credit card application in the approval system, and that customer has a large transaction with merchant M2 in the transaction system, the system needs to map E1, C1, and M2 as unified nodes in the graph and construct corresponding semantic edges.

[0045] Specifically, through entity alignment and relation extraction, a dynamic heterogeneous graph with a clear structure and rich semantics is constructed. This provides a solid data foundation for subsequent graph neural network modeling and risk propagation. Simultaneously, this step significantly improves the system's ability to identify covert group fraud and solves the problem of missing relational information caused by data fragmentation in traditional methods.

[0046] S2 employs a heterogeneous graph neural network with a hierarchical attention mechanism to model the spatial relationships of a dynamic heterogeneous graph. It calculates the contribution weight of each neighbor node to the risk of the target employee through node-level attention and calculates the global impact weight of different relationship types on risk propagation through relationship-level attention, thereby generating a graph-structured risk representation vector for the employee.

[0047] Specifically, the core of this mechanism lies in adaptively weighting and aggregating heterogeneous nodes and relationships in the graph, thereby more accurately characterizing the degree of risk exposure of employees in complex business networks.

[0048] Furthermore, HGAT first calculates the contribution weight of each neighboring node to the risk of the target employee at the node level. Specifically, for employee nodes... Each neighbor node The model uses a shared weight matrix Its representation vector and target node Perform a linear transformation and then concatenate the results. These are combined into a single joint feature vector. This vector is then combined with the learnable attention vector. After performing the dot product operation, through The activation function generates the raw attention score. The calculation formula is as follows: .

[0049] Furthermore, the attention scores of all neighboring nodes are normalized using the Softmax function to obtain standardized attention weights. Its expression is: .

[0050] Furthermore, at the relationship level, the model calculates the global impact weights of different relationship types (such as approval, transaction, and colleague relationships) on risk propagation. For each relationship type... First, calculate its average representation. Then through learnable parameters and Perform a nonlinear transformation to generate relation importance scores. Its formula is: .

[0051] Specifically, the relational attention weights are ultimately obtained through Softmax normalization. It is used to weight and aggregate neighbor information of different relationship types.

[0052] Specifically, in node-level attention Usually The trainable weight matrix, where The node embedding dimension is typically set to 128 or 256. This is used in relation-level attention. for dimensional vector, These are relation-specific bias terms. The activation function is selected... To enhance the nonlinear expressive power of the model.

[0053] Specifically, it is applicable to heterogeneous graphs composed of bank employees, customers, merchants, and approval processes, and has significant advantages, especially in identifying covert behaviors such as group cash-out schemes and collusive fraud. By introducing an attention mechanism, the model can automatically identify high-risk associated nodes and relationship types, avoiding the hard-coded dependence on relationships in traditional methods and improving the model's interpretability and generalization ability.

[0054] Specifically, this step enables **fine-grained modeling** of the risks associated with the employee graph structure, and its output vector... It can effectively reflect the risk exposure level of employees in the business network, providing key input for subsequent multimodal fusion and classification, and significantly improving the accuracy and recall rate of fraud detection.

[0055] Furthermore, S2 includes: S21, Calculate node-level attention scores using the LeakyReLU activation function. ;in, , They are nodes , In the The layer's representation vector, It is a learnable shared weight matrix. It is a learnable attention vector.

[0056] Specifically, in the collaborative computing module of this invention, the calculation of node-level attention scores is based on the attention mechanism in graph neural networks (GNNs), used to quantify the risk association strength between any two nodes in the graph. Specifically, this step uses the LeakyReLU activation function to perform a nonlinear transformation on the concatenated features of the node pairs, thereby obtaining the original attention scores. Its mathematical expression is: ; in, and Representing nodes respectively and In the The layer's representation vectors, which are typically aggregated from the graph attention mechanism of the previous layer, contain local structural information and semantic features of the nodes. It is a shared, learnable weight matrix used to map different types of nodes (such as employees, customers, and merchants) to a unified feature space, ensuring that attention mechanisms are comparable in heterogeneous graphs. It is a learnable attention vector used to measure the global importance of spliced ​​features. This represents a vector concatenation operation, which concatenates the transformed representations of two nodes into a joint feature vector, which serves as the input for attention computation.

[0057] Furthermore, this step is typically performed in each layer of the graph neural network as a preprocessing step for neighbor information aggregation. LeakyReLU was introduced to enhance the model's robustness to negative inputs, with its slope parameter... It is typically set to 0.2 to avoid the vanishing gradient problem. The non-linear nature of this function allows the model to adaptively amplify or suppress potential risk signals between certain node pairs, thereby improving its sensitivity to fraudulent behavior.

[0058] Specifically, this step operates on the adjacency structure of heterogeneous graphs, making it suitable for modeling complex relationships between bank employees and entities such as customers, merchants, and approval records. For example, when an employee node... With multiple merchant nodes When an approval relationship exists, this formula can calculate the contribution of each merchant to employee risk, providing a basis for subsequent graph structure representation updates.

[0059] Specifically, by introducing an attention mechanism, the model can automatically identify neighboring nodes that contribute significantly to the risk of the target node, thereby achieving accurate modeling of risk propagation paths in heterogeneous graphs. Compared to the fixed-weight aggregation method of traditional graph convolutional networks (GCNs), the attention mechanism of this invention has stronger expressive power and adaptability, significantly improving the ability to identify covert group fraudulent activities.

[0060] S22, the node-level attention scores are normalized using the softmax function to obtain standardized attention weights. ;in, For nodes The set of all neighbors.

[0061] Specifically, this step aims to quantify the relative contribution of each neighbor node in the graph to the risk of the target employee node, thereby achieving adaptive weighted aggregation of risk signals in complex relationship networks.

[0062] Furthermore, node-level attention scores It is by targeting the node Its neighboring nodes After concatenating the representation vectors, the data is processed via a shared weight matrix. A linear transformation was performed, and the result was calculated using the LeakyReLU activation function. The original attention score reflects the neighboring nodes. In the current layer China The potential impact of this is considered. However, due to the varying importance of different neighbors, normalization is necessary to ensure the interpretability and stability of their weight distribution.

[0063] Furthermore, the attention scores of all neighbors are normalized using the softmax function to obtain standardized attention weights. Its mathematical expression is: ; in, Represents a node The set of all neighbors. This formula ensures the attention weight of each neighbor. Falling Within the interval, and with the sum of the weights of all neighbors being 1, a soft allocation of the risk impact on neighbor nodes is achieved.

[0064] Furthermore, in practical applications, this step is typically performed independently in each layer of the graph neural network to dynamically adjust the relational weights between nodes. For example, in a multi-layer HGAT architecture, nodes... The neighbor set may contain heterogeneous entities such as customers, merchants, and other employees. Through softmax normalization, the model can automatically identify which entities have a stronger indicative role in employee risk in the current context.

[0065] Specifically, by introducing an attention mechanism, the system can overcome the limitation of traditional graph neural networks that aggregate all neighbors with equal weights, enabling fine-grained modeling of complex relationships in heterogeneous graphs. In the scenario of detecting credit card cash-out by bank employees, this mechanism helps identify abnormal associations between employees and high-risk merchants or customers, thereby improving the ability to identify covert group fraud.

[0066] S3 encodes the temporal operation sequence of employees based on the Transformer architecture, uses the self-attention mechanism to capture the long-range dependencies between operation behaviors, and generates a temporal intent vector representing the employee's behavioral intention.

[0067] Specifically, this step is the core component of time dimension modeling in the entire system, and it has significant technological innovation and practicality.

[0068] Furthermore, the employee's operational behavior was modeled as a time series. Each of the operations This corresponds to a specific action (such as "approving a credit card" or "querying customer information") and is transformed into a low-dimensional dense vector by the embedding layer. This embedding vector not only encodes the operation type but also includes the operation object (such as customer or merchant) and contextual information (such as timestamps and geographic locations). Subsequently, this sequence is fed into a standard Transformer encoder, whose core is a multi-head self-attention mechanism. In single-head attention, the query matrix... Key matrix Sum matrix The attention weights are obtained from the embedding vectors in the sequence through different linear transformations, and are calculated using the following formula: ; in, The dimension of the key vector is used to scale the dot product result, preventing the inner product from becoming too large and causing gradient vanishing. The multi-head mechanism enhances the model's ability to perceive different behavioral patterns by computing multiple attention heads in parallel. Finally, the vector corresponding to the first special marker [CLS] in the Transformer output sequence is taken as the temporal intent representation vector for the entire sequence. This vector can summarize employees' behavioral patterns and underlying intentions over time.

[0069] Specifically, the Transformer model typically employs a stacked structure of 6 to 12 layers, with each layer containing a multi-head self-attention module and a feedforward neural network (FFN). The hidden layer dimension is 512 to 1024, the number of attention heads is 8 to 16, and the scaling factor is [not specified]. Consistent with the embedding dimension. During training, the cross-entropy loss function is used, the optimizer is AdamW, and the learning rate is set to... to It combines a learning rate warm-up strategy with a linear decay strategy.

[0070] Specifically, it can be deployed within a bank's internal employee behavior monitoring system to receive real-time operation logs from modules such as credit approval, customer management, and transaction systems, performing sequence encoding and intent extraction. Its technical advantage lies in its ability to effectively identify abnormal behavioral patterns among employees with causal relationships over time, such as the temporal correlation between "abnormal approvals" and "abnormal fund flows," thereby improving the detection capability of covert and planned cash-out behaviors. Compared to traditional methods based on static features, this step significantly enhances the model's ability to dynamically model behavioral intent, providing a crucial temporal dimension representation for subsequent multimodal fusion and risk decision-making.

[0071] Furthermore, S3 includes: S31, calculate the query matrix using a multi-head self-attention mechanism. Key matrix Sum matrix The formula for calculating single-head attention is as follows: .

[0072] Specifically, the mechanism is based on the Transformer architecture and aims to capture long-range dependencies between employees' operational behaviors over time, thereby revealing their potential intent to violate regulations.

[0073] Furthermore, the employee's time-sequence operation sequence It consists of its historical operational behavior in the banking system, each operation It is mapped to a low-dimensional dense vector, encoding the operation type, object, and context information. This sequence serves as the input to the Transformer encoder, first generating... , and Three matrices. Specifically, each operation vector By using different learnable weight matrices , , It is projected onto the subspaces of query, key, and value, forming , , .

[0074] Furthermore, the formula for calculating single-head attention is: ; in, This is the dimension of the key vector, used to scale the dot product result and prevent the inner product value from becoming too large, which could lead to gradient vanishing. The attention weights are normalized using the softmax function, ensuring that each operation... It can dynamically weight and aggregate information based on its correlation with other operations in the sequence, thereby extracting discriminative behavioral patterns.

[0075] Specifically, positional encoding can be optionally incorporated to preserve temporal information, and a multi-head attention mechanism can be further employed to enhance the model's ability to perceive different behavioral patterns. Each attention head independently calculates its attention weights, and the outputs of all heads are concatenated and linearly transformed to form a richer behavioral intent representation vector. .

[0076] Specifically, through this mechanism, the system can effectively identify causal relationships such as "approving high-risk clients in a short period of time" and "subsequent abnormal fund flows in the employee's account," thereby revealing potential violations by employees in the time dimension and providing key inputs for subsequent multimodal fusion and risk prediction.

[0077] S32, using scaling factor The attention score is normalized to prevent the gradient from vanishing due to an excessively large inner product.

[0078] Specifically, the technical principle behind this step lies in controlling the numerical range of the attention weights to prevent dimensionality issues during the inner product operation. Increasing the value of attention score leads to an explosion, thereby avoiding gradient vanishing or gradient saturation problems and ensuring that the model can converge stably during training.

[0079] Specifically, in the self-attention mechanism, the query matrix AND key matrix Perform a dot product operation on the transpose of the matrix to obtain the attention score matrix. .because and All dimensions are ,when When the variance is large, the variance of the dot product increases significantly, causing the output of the softmax function to tend towards extreme values ​​(close to 0 or 1), thereby suppressing gradient propagation. To alleviate this problem, this invention introduces a scaling factor. Normalizing the dot product results makes the distribution of attention scores smoother and enhances the model's ability to model long-range dependencies.

[0080] Furthermore, this scaling factor is embedded in the attention calculation formula, namely: ; in, , , They are obtained by applying different linear transformation layers to the input sequence. The extracted query, key, and value matrix. This represents the dimension of the key vector. It is determined by dividing by... This can effectively control the scale of the attention score, making it numerically closer to the standard normal distribution, thereby improving the gradient stability of the softmax output.

[0081] Specifically, this step is deployed in the encoding process of employee temporal operation sequences. For example, when employees form complex temporal dependencies in operations such as approval, inquiry, and transaction, the Transformer encoder, through this normalization mechanism, can more accurately identify potential connections between key operations, such as the causal chain between "increasing credit limits for multiple customers" and "abnormal inflow of funds into employee accounts." This mechanism is typically used in conjunction with multi-head attention in the model, where each attention head independently calculates and normalizes its attention score, and finally, a comprehensive temporal representation vector is obtained through concatenation and linear transformation. .

[0082] Specifically, it significantly improves the model's numerical stability when handling high-dimensional vectors and enhances the attention mechanism's ability to capture long-distance dependencies, thereby improving the modeling accuracy of employee behavioral intentions. In this invention, the normalization strategy is a key preliminary step for achieving multimodal fusion and risk prediction, providing high-quality temporal feature inputs for subsequent dynamic risk propagation and classification decisions.

[0083] S4. When any node in the graph is detected to be marked as high risk, a dynamic risk propagation mechanism is activated. Based on the graph structure risk representation vector and attention weight, the risk signal is propagated in a directional manner along the graph connection edge to generate the real-time propagation risk value of the employee node.

[0084] Specifically, this step is the core link in realizing the "one-point discovery, network-wide early warning" capability in this invention. Its technical implementation principle is based on the integration of the attention mechanism in graph neural networks and the label propagation algorithm.

[0085] Specifically, this mechanism first relies on the heterogeneous graph structure defined in the graph construction module. , where the set of nodes It includes entities such as employees, customers, merchants, credit card accounts, and debit card accounts, and is a collection of... It describes the semantic relationships between entities (such as approval, transaction, transfer, etc.), edge attributes It includes key information such as timestamps, amounts, and geographic locations. When a certain node (e.g., a merchant)... When identified as high-risk by external intelligence or internal investigation, the system will set its initial risk value. Setting it to 1.0 indicates that it has the greatest risk.

[0086] Furthermore, the system initiates a dynamic risk diffusion process based on label propagation. This process iteratively updates the risk values ​​of nodes, enabling risk signals to propagate directionally along the connection edges in the graph. Specifically, nodes... In the The risk value update formula for this step is: ; in, It is a damping factor used to control the degree to which a node retains its historical risk, and is usually set to 0.85 to avoid the excessive spread of risk signals; It is the edge The weights can be initialized as node-level attention. , representing a node For nodes The intensity of the risk impact; It is a node The set of neighbors.

[0087] Specifically, this mechanism can be deployed in a bank's real-time risk control system. When external regulatory agencies release a list of high-risk merchants or internal audits discover abnormal transactions, the system can immediately trigger a propagation mechanism to transmit risk signals along the approval and transaction pathways to relevant customer and employee nodes. For example, if a merchant is flagged as a cash-out operation, the customer nodes that transact with it will be assigned a propagation risk value, further affecting the risk score of the employee nodes that approved that customer.

[0088] Specifically, by combining attention weights in the graph structure with the propagation algorithm, the system can achieve proactive reasoning and real-time response to risks, significantly improving its ability to identify covert and coordinated fraudulent activities. Simultaneously, it propagates risk values. As a real-time risk signal for employee nodes, and a graph structure representation vector Behavioral Intent Vector and static features Together, the data is input into the integrated decision-making module to form a comprehensive risk assessment of employees, thereby enhancing the robustness and timeliness of the model's early warning.

[0089] Furthermore, S4 includes: S41, the initial risk value for merchant nodes that will be marked as high-risk. Set it to 1.0 and set the damping factor. Control the rate at which risk spreads.

[0090] Specifically, this step aims to enhance the system's ability to identify covert and collaborative fraudulent activities by enabling real-time risk assessment and early warning of employee nodes through risk signal transmission in the graph structure.

[0091] Specifically, this step is based on the label propagation concept in graph neural networks (GNNs), but introduces an attention mechanism to enhance the semantic awareness of the propagation. When the system confirms a merchant node through external intelligence or internal investigation... When a node is considered high-risk, its initial risk value is... The risk value is set to 1.0, indicating that the node has the highest risk. The system then initiates a risk propagation process, spreading this risk value along the edges of the graph to its neighboring nodes (such as customers, employees, etc.). During the propagation process, the weight of each edge is... Node-level attention calculated from the preorder graph neural network Initialization indicates the influence of this edge on risk transmission.

[0092] Furthermore, damping factor This is an adjustable parameter between 0 and 1, used to control the degree to which a node retains its historical risk value during propagation. Specifically, the propagation formula is: ; in, Represents a node In the Risk value after propagation It is its set of neighbors. The closer the value is to 1, the more likely the node is to retain its historical risk state, and the slower the propagation process; conversely, the closer the value is to 1, the more likely the node is to retain its historical risk state, and the slower the propagation process. The smaller the value, the easier it is for risk signals to spread, making it suitable for scenarios requiring rapid response to high-risk events. In actual deployment, It is usually set through cross-validation or business experience, and the typical value range is [0.6, 0.9].

[0093] Specifically, this step is widely used in real-time monitoring systems for credit card cash-out by bank employees. For example, when a merchant is reported by regulatory agencies as a cash-out den, the system can immediately trigger the risk propagation process at that merchant node, transmitting the risk signal to the customer node with which it transacted, and then further to the employee node that approved the customer's credit card. In this way, the system can achieve rapid response to new and covert fraudulent activities without retraining the model.

[0094] Specifically, by introducing a dynamic risk propagation mechanism, the system can achieve the risk transmission capability of "one-point detection, network-wide early warning," significantly improving the detection sensitivity and response speed for employees' participation in cash-out behavior. At the same time, by combining the propagation method of attention weights, the risk transmission has semantic awareness capabilities, avoiding the "one-size-fits-all" problem in traditional label propagation, and enhancing the interpretability and practicality of the model.

[0095] S42, through iterative formula Multiple rounds of propagation are performed until the preset maximum number of iterations and risk value convergence are reached; among them... Any node in the diagram In the Risk value after propagation side The weight.

[0096] Specifically, the dynamic risk propagation steps described in this invention employ an iterative formula. Achieving targeted dissemination and continuous updating of risk signals in heterogeneous spectra is a key technical aspect of the system's ability to "detect at one point and provide early warning across the entire network".

[0097] Specifically, this step is based on the principle of label propagation, combined with the node-level attention weights already learned in the graph neural network. As edge weight The initial values ​​were used to construct a dynamic mechanism with adaptive propagation capabilities. Specifically, when the system detects a node (such as a merchant), it... Once marked as high risk, its initial risk value is... Let 1.0 represent the highest probability of risk. Then, using the iterative formula described above, this risk value is progressively propagated to the client nodes connected to it. and employee nodes ,in Represents a node The neighborhood group, Represents a node For nodes Influence weight, It is a damping factor used to control the proportion of a node that retains its historical risk value in each round of propagation, preventing the risk value from being amplified without limit during propagation. Typically, The value range is [0.1, 0.9], and in this invention, it is preferably 0.6 to balance the propagation speed and stability.

[0098] Furthermore, in the formula Attention weights at the node level in a graph neural network can be used as a basis. Dynamic adjustments are made to ensure that the propagation process reflects the true influence relationships between nodes in the graph. A maximum number of iterations is typically set for the propagation process. The number of rounds is 10-20, with the specific value adjusted based on the graph size and computing resources. In actual deployment, the system monitors the change in node risk values. When the change in risk values ​​of all nodes is less than a preset threshold in two consecutive iterations, the system will initiate a new round. If the risk value has converged, the transmission process can be terminated early.

[0099] Specifically, this step is widely used in real-time risk monitoring systems for bank employees. For example, when a merchant is flagged as high-risk due to a large number of abnormal transactions reported by regulatory agencies, the system will automatically trigger a risk propagation mechanism, spreading the merchant's risk signal through its associated customer nodes to the employee nodes that approved the customer's credit card. In this way, the system can identify potential collusion risks in advance, before fraudulent activities are fully exposed, enabling proactive early warning of covert group fraud.

[0100] Specifically, by introducing a dynamic propagation mechanism, the system can respond in real time to changes in risk nodes in the graph, disseminating risk signals to relevant entities in a structured and weighted manner, thereby significantly improving the ability to identify new and covert fraudulent activities. Compared to traditional static models, this method has stronger temporal sensitivity and network awareness capabilities, providing a solid foundation for banks to build proactive and defensive risk control systems.

[0101] S5, perform multimodal fusion of the graph structure risk representation vector, the temporal intent vector, the real-time propagation risk value and the employee static feature vector, input the data into the classifier to calculate the employee's violation probability and output the risk score.

[0102] Specifically, this step significantly improves the model's ability to identify covert fraudulent activities by jointly modeling structured information and dynamic behavior.

[0103] Furthermore, this fusion process employs vector concatenation to integrate feature vectors from different modalities into a single high-dimensional feature vector. Specifically, It is a structural risk representation of employee nodes in the graph extracted through a heterogeneous graph neural network (HGAT) with a hierarchical attention mechanism. Its dimension is typically [missing information]. It encodes the topological structure and risk propagation relationships between employees and their associated entities (such as customers and merchants); It is the behavioral intent vector output by the Transformer encoder, and its dimension is... It captured employees' operational patterns and underlying intentions over time. It is a scalar value calculated in real time through a dynamic risk propagation algorithm, reflecting the immediate impact of external risk events on employees; It is the static feature vector of an employee, containing personnel information such as job level, department, and length of service, with the following dimensions: Combine these four pieces of information as follows: ; in, This represents the vector concatenation operation, the final result is... It is a dimension The fused feature vector.

[0104] Furthermore, this feature vector is then fed into a fully connected neural network classifier, whose structure typically contains several hidden layers, each using the ELU activation function to enhance non-linear expressiveness. The final output of the classifier is the employee... probability of violation The calculation formula is as follows: ; in, The weight matrix of the classifier. For bias terms, The Sigmoid activation function maps the output to... The range represents the likelihood of an employee violating regulations.

[0105] Specifically, this step is deployed in the bank's real-time risk control system to continuously monitor and score the daily operational behavior of employees. The system can set thresholds (such as...). This triggers an early warning mechanism for high-risk employees, assisting in manual review and subsequent handling.

[0106] Specifically, by employing a multimodal fusion strategy, static attributes, temporal behavior, graph structure relationships, and real-time risk signals are modeled in a unified manner, thereby achieving a comprehensive assessment of employee risk. Compared to traditional methods, this significantly improves the model's robustness and generalization ability, especially when facing new and covert credit card cash-out behaviors, demonstrating stronger adaptability and detection accuracy.

[0107] S6 incrementally updates the dynamic heterogeneous graph according to the preset update cycle, and retrains the heterogeneous graph neural network and Transformer encoder based on the newly added nodes and edges to dynamically adjust the model parameters and risk propagation weights.

[0108] Specifically, this step involves incremental updates to the dynamic heterogeneous graph and collaborative retraining of the Heterogeneous Graph Neural Network (HGAT) and the Transformer encoder, which is a crucial step in achieving continuous learning and adaptive risk identification of the system. In actual operation, the system is set with a preset update cycle. Typically, the time window is 24 hours or shorter depending on business needs (such as hourly updates) to ensure that the map and model can respond promptly to the latest business behaviors and risk signals.

[0109] Furthermore, incremental updates first acquire newly added nodes (such as newly registered employees, customers, or merchants) and edges (such as new approvals, transactions, or transfers) through the data acquisition module, and then align them structurally and fuse their attributes with the existing graph. The attribute information of newly added nodes (such as an employee's department, job level, and approval permissions) must meet unified data standards, such as field naming conventions and data type consistency (such as integer, floating-point, and enumeration types), to ensure the semantic consistency of the graph. New edges must carry metadata such as timestamps, relationship types, and operation contexts to construct the time-series graph structure.

[0110] Furthermore, the system inputs the updated graph into a heterogeneous graph neural network (HGAT) and a Transformer encoder for incremental training. HGAT uses node-level and relation-level attention mechanisms to learn the embeddings of newly added nodes and edges, updating their risk representation vectors. Specifically, it follows the formula below: ; ; ; in, For shared linear transformation weights, For attention vectors, Attention weights at the relation level. This is the ELU activation function. The Transformer encoder processes the temporal sequence of operations performed by the employees. Perform self-attention processing to extract behavioral intent representation vectors. Its core mechanism is: ; in, This is the query, key, and value matrix obtained through linear transformation. This represents the dimension of the key vector. Through this mechanism, the model can capture long-range dependencies of employee behavior over time, such as the causal relationship between approval actions and subsequent cash flows.

[0111] Specifically, this step is applicable to scenarios where the bank's internal risk control system is updated daily or in real-time. Especially when facing new types of fraudulent activities, the system can quickly adapt to changes through a continuous learning mechanism, improving its ability to identify covert cash-out behaviors. Its technical effect lies in the fact that by dynamically updating the graph and model parameters, the system achieves real-time perception and adaptive adjustment of employee risk, significantly enhancing the model's robustness and generalization ability, reducing false positive rates, and increasing fraud detection rates.

[0112] This invention presents a method for identifying cash-out schemes based on multimodal dynamic graphs and risk propagation. This method effectively overcomes the core limitations of traditional risk control methods in identifying the covert and organized cash-out activities of bank employees, such as "information silos" and "relationship fragmentation." By constructing a dynamic heterogeneous graph and deeply integrating multimodal features such as graph structure risk, temporal behavioral intent, real-time propagation risk, and static attributes, it achieves a three-dimensional and accurate characterization of employees' risk exposure and behavioral intent within complex business networks. This significantly improves the real-time performance, accuracy, and interpretability of monitoring internal illegal cash-out activities, providing solid technical support for banks to build proactive and intelligent internal risk management systems.

[0113] Example 2 To achieve the above invention, embodiments of the present invention also provide a model architecture for a cash-out identification method based on multimodal dynamic graphs and risk propagation, such as... Figure 2 As shown, it includes: Logically, this system mainly comprises three core modules: a graph construction module, a collaborative computing module, and a fusion decision module. Its data processing flow is as follows: Raw multi-source data first enters the graph construction module, where it is integrated into a unified attribute heterogeneous graph. Subsequently, this graph and its temporal sequences are sent to the collaborative computing module for deep feature extraction of spatial relationships and temporal patterns, respectively. Finally, the fusion decision module fuses the extracted multimodal features and, combined with dynamic risk propagation signals, calculates the final risk score and profile. Specifically, this includes: In one embodiment of the present invention, there is a map construction module.

[0114] Specifically, this module aims to construct a dynamic attribute heterogeneous graph that comprehensively reflects entities and their relationships from scattered multi-source data both inside and outside the bank. It cleanses, aligns, and correlates data from multiple channels and types, including credit card transaction systems, core accounting systems, credit approval systems, and human resources systems, to build a unified and scalable attribute heterogeneous graph, formally defined as: ; Furthermore, : Represents the set of all nodes in the graph. This invention includes at least the following types of nodes: employees. ,client Merchants Credit card account Savings card account Each employee has a sequence of time-based operations. Each Each vector is a low-dimensional dense vector obtained through an embedding layer. This vector encodes the type of operation (such as "login to system", "query customer information", "approve credit card"), the object of the operation, and the context information.

[0115] Furthermore, : Represents the set of all edges in the graph, used to represent the rich relationships between nodes, such as approval relationships. Transaction relationship Transfer relationship Having a relationship wait.

[0116] Furthermore, : Represents the set of attributes of a node, such as the department, job level, and years of service of an employee node.

[0117] Furthermore, : Represents the set of attributes of an edge, such as timestamp, amount, and geographical location on a transaction edge.

[0118] In one embodiment of the present invention, a collaborative computing module is included.

[0119] Specifically, this module is the intelligent core of the algorithm. It performs two major analysis tasks in parallel, characterizing employee risk from the two dimensions of "space" and "time".

[0120] Specifically, heterogeneous graph neural networks based on attention mechanisms (spatial relationship modeling) This section analyzes an employee's position and associated risks within their business relationship network. Its operational mechanism can be summarized as "layered attention aggregation," targeting specific employee nodes. Its network Layer representation Update using the following method: Furthermore, node-level attention: for Each neighbor node (Regardless of whether they are customers, merchants, or other types), first calculate an initial attention score. It represents the neighbors For employees The importance of; ;in, It is a node and In the The layer's representation vector. It is a learnable shared weight matrix used to linearly transform different types of nodes to the same feature space. It is a learnable attention vector. This indicates a vector concatenation operation. For activation functions; use The function normalizes the attention scores of all neighbors to obtain standardized attention weights. : ;in, It is a node The set of all neighbors, The larger the value, the stronger the neighboring node. Judging employees The greater the risk contribution.

[0121] Furthermore, relationship-level attention: Considering that the importance of "approval" relationships and "colleague" relationships for risk assessment may be drastically different, therefore, attention is paid to each relationship type defined in the diagram. (e.g., approve, transact, colleague) Calculate a global attention weight. ; Calculate the importance score for each relationship. : ;in, Through relationships The average representation of all connected node pairs is used to summarize the relationship. Global features. and These are relation-specific learnable parameters. It is a globally learnable attention vector; similarly, through Normalization yields relational attention weights : .

[0122] Specifically, the representation aggregation: combining the two attention mechanisms mentioned above, for employee nodes... The representation is updated, and its neighbor information is aggregated: ;in, Through relationships and A set of connected neighbors. It is a non-linear activation function After propagation through multiple layers of such graph attention networks, the final employee node representation is obtained. It is a graph structure representation vector that condenses its local network structure and risk information.

[0123] Furthermore, the Transformer-based temporal behavior encoding (time series modeling) is responsible for interpreting the employee's operational behavior sequence to gain insight into their underlying intentions. Its core technology is the self-attention mechanism. This mechanism allows any operational behavior in the sequence to directly interact and compare with all other behaviors in the sequence (regardless of distance). In this way, the model can automatically discover and focus on key operational patterns that have risk indication significance, such as long-range dependencies like "approving high-limit credit cards for multiple high-risk customers in a short period" followed by "abnormal fund flows in the employee's own account." Ultimately, the entire operational sequence is encoded into a fixed-length behavioral intention representation vector, which condenses the employee's behavioral patterns and intention information in the time dimension; this process transforms the employee's temporal operational sequence... Input a Transformer encoder. The core of the Transformer is the multi-head self-attention mechanism, whose single-head computation is as follows: ;in, They are respectively composed of sequences The query, key, and value matrices are obtained through different linear transformations. It is a scaling factor. This mechanism allows each operation token in the sequence to interact with all other tokens in the sequence, thereby capturing long-range dependencies and complex patterns.

[0124] Specifically, the representation vector corresponding to the first special marker [CLS] in the Transformer encoder output sequence is taken as a summary of the entire sequence, i.e., the employee's behavioral intention representation vector. .

[0125] In one embodiment of the present invention, a fusion decision module is included.

[0126] Specifically, this module is the information aggregation and decision-making layer, which introduces dynamic signals and integrates all features to make the final judgment.

[0127] Specifically, dynamic risk propagation: This mechanism endows the system with real-time early warning and proactive reasoning capabilities. When external intelligence or internal verification confirms a node in the graph (e.g., a specific merchant) as a high-risk node, the system immediately initiates a risk propagation process. The risk signal from this high-risk node will spread like ripples along the connecting edges of the graph to other nodes directly or indirectly related to it (e.g., customers transacting at this merchant, employees approving these customers). The intensity of the propagation is controlled by the weights of the connecting edges, ensuring that the risk signal is transmitted to the relevant entities in a targeted and attenuated manner. Through this process, each employee receives a real-time updated propagation risk value, reflecting the potential threat they face due to the risk exposure of related entities; when a merchant node in the graph is confirmed through external data (e.g., regulatory notices, public opinion) or internal investigation... When setting up a cash-out operation, its initial risk value is... Set to 1.0. Then, initiate a label-propagation-like process to allow the risk to spread in a controlled manner across the graph. The update formula is: ;in, It is any node in the graph In the Risk value after propagation; It is a damping factor used to control the degree to which a node retains its historical risk, preventing the risk from being amplified indefinitely; It is the edge The weights can be initialized as node-level attention. This indicates the intensity of the impact; after several iterations until convergence or the maximum number of steps is reached, high-risk merchants are considered. The associated employee nodes will receive a significantly increased propagation risk value. .

[0128] Specifically, multimodal fusion and classification: Here, all information from the preceding modules is integrated to form the final judgment; the system concatenates four key pieces of information to constitute the employee's final feature representation. These four pieces of information include: a graph structure representation vector (spatial risk) from a graph neural network, a behavioral intent representation vector (temporal risk) from a Transformer, a propagation risk value (real-time impact) from dynamic propagation, and the employee's original static feature vector (basic background). This concatenated, information-complete feature vector is fed into a fully connected neural network classifier. The final output of the classifier is a violation probability between zero and one, which comprehensively and holistically assesses the overall risk level of the employee's involvement in illegal cash-out schemes; in this module, representation vectors learned from different dimensions and modalities are concatenated and input into a final fully connected layer classifier to calculate the employee's risk level. Probability of violation: ;in, It is a graph structure representation vector from a graph neural network, which encodes the network structure risk; It is a behavioral intent representation vector from the Transformer, which encodes temporal behavioral risks; It is a propagation risk value derived from dynamic risk propagation, which encodes real-time external risk shocks; It is the employee's original static feature vector, serving as a supplement to basic information; and These are the weights and biases of the classifier; yes The activation function maps the output to... The interval, i.e., the employee Predicted probability of violation .

[0129] Specifically, finally, we concatenate the representation vectors learned from different dimensions and modalities, and input them into a final fully connected layer classifier to calculate employee... Probability of violation: ;in, : is a graph structure representation vector from a graph neural network, which encodes the network structure risk; : is a behavioral intent representation vector from the Transformer, which encodes temporal behavioral risks; : is the propagation risk value (scalar) from dynamic risk propagation, which encodes real-time external risk shocks; It is the employee's original static feature vector, serving as a supplement to basic information; and These are the weights and biases of the classifier; It is the Sigmoid activation function, which maps the output to the (0,1) interval, i.e., the employee... Predicted probability of violation .

[0130] This invention presents a model architecture for a cash-out identification method based on multimodal dynamic graphs and risk propagation, effectively addressing the core problems of traditional risk control methods, such as difficulty in identifying the concealment of bank employees and organized cash-out activities, as well as the lag in detection. By constructing a dynamic heterogeneous graph that integrates multi-source data and collaboratively performing deep modeling of spatial relationships and temporal behaviors, combined with a real-time risk propagation mechanism, a paradigm shift is achieved in assessing employee risk from static, isolated evaluation to dynamic, relational analysis. This significantly improves the accuracy, timeliness, and interpretability of risk identification, providing key technical support for banks to build a proactive and intelligent internal risk management system.

[0131] Example 3 To achieve the above invention, such as Figure 3 As shown, this embodiment also provides a cash-out identification device 10 based on multimodal dynamic graphs and risk propagation. The device 10 includes: The dynamic heterogeneous graph construction module 100 is used to construct a dynamic heterogeneous information graph, which integrates multi-type entities such as employees, customers, merchants, and accounts, as well as the corresponding semantic relationships of approval, transaction, and transfer through multi-source data, and dynamically maintains the time-series operation sequence of employee nodes. The heterogeneous graph neural network module 200 is used to model the spatial relationships of dynamic heterogeneous graphs using a hierarchical attention mechanism. It calculates the contribution weight of each neighbor node to the risk of the target employee through node-level attention and calculates the global impact weight of different relationship types on risk propagation through relationship-level attention, and generates the graph structure risk representation vector of the employee. Transformer temporal encoding module 300 is used to encode the temporal operation sequence of employees based on the Transformer architecture, and uses the self-attention mechanism to capture the long-range dependencies between operation behaviors to generate a temporal intent vector representing the employee's behavioral intention. The dynamic risk propagation module 400 is used to activate the dynamic risk propagation mechanism when any node in the graph is detected to be marked as high risk. Based on the graph structure risk representation vector and attention weight, the risk signal is propagated in a directional manner along the graph connection edge to generate the real-time propagation risk value of the employee node. The multimodal fusion and risk scoring module 500 is used to perform multimodal fusion of the graph structure risk representation vector, the temporal intent vector, the real-time propagation risk value and the employee static feature vector, input the data into a classifier to calculate the employee's violation probability and output a risk score.

[0132] In one embodiment of the present invention, it further includes: an incremental update module, used to incrementally update the dynamic heterogeneous graph according to a preset update cycle, and retrain the heterogeneous graph neural network and Transformer encoder based on the newly added nodes and edges, so as to dynamically adjust the model parameters and risk propagation weights.

[0133] This invention discloses a cash-out identification device based on multimodal dynamic graphs and risk propagation, effectively overcoming the core problems of traditional risk control systems, such as "information silos" and lack of correlation modeling, when dealing with the concealed and organized illegal cash-out activities of bank employees. Through the coordinated operation of its modules, the device achieves multi-dimensional fusion analysis and comprehensive judgment of employee static attributes, dynamic graph relationships, temporal behavioral intentions, and real-time risk propagation signals, significantly improving the comprehensiveness, accuracy, and timeliness of risk identification. Its technical effect lies in providing automated and intelligent decision support for internal bank risk control, enhancing the proactive defense and early warning capabilities against complex fraud patterns.

[0134] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 4 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads the executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the cash-out identification method based on multimodal dynamic graph and risk propagation described above.

[0135] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a cash-out identification method based on multimodal dynamic graphs and risk propagation as described in the foregoing embodiments.

[0136] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0137] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for identifying cash-out schemes based on multimodal dynamic graphs and risk propagation, characterized in that, include: S1, construct a dynamic heterogeneous information graph, integrate multi-type entities such as employees, customers, merchants, and accounts, as well as the corresponding semantic relationships of approval, transaction, and transfer, and dynamically maintain the time-series operation sequence for employee nodes; S2 uses a hierarchical attention mechanism to model the spatial relationships of a dynamic heterogeneous graph. It calculates the contribution weight of each neighbor node to the risk of the target employee through node-level attention and calculates the global impact weight of different relationship types on risk propagation through relationship-level attention, thereby generating a graph structure risk representation vector for the employee. S3 encodes the temporal operation sequence of employees based on the Transformer architecture, uses the self-attention mechanism to capture the long-range dependencies between operation behaviors, and generates a temporal intent vector representing the employee's behavioral intention. S4. When any node in the graph is detected to be marked as high risk, a dynamic risk propagation mechanism is activated. Based on the graph structure risk representation vector and attention weight, the risk signal is propagated in a directional manner along the graph connection edge to generate the real-time propagation risk value of the employee node. S5, perform multimodal fusion of the graph structure risk representation vector, the temporal intent vector, the real-time propagation risk value and the employee static feature vector, input the data into the classifier to calculate the employee's violation probability and output the risk score.

2. The method as described in claim 1, characterized in that, Constructing a dynamic heterogeneous information graph includes: S11 uses a rules engine to clean the raw data from the credit card transaction system, core accounting system, credit approval system, and human resources system, removing invalid records and noisy data. S12 uses a graph embedding algorithm to align entities in the cleaned data, mapping the same entity in different systems to a unified identifier, and constructs semantic relationship edges for approval, transaction, and transfer through a relation extraction model.

3. The method as described in claim 1, characterized in that, Heterogeneous graph neural networks employing hierarchical attention mechanisms include: S21, Calculate node-level attention scores using the LeakyReLU activation function. ;in, , They are nodes , In the The layer's representation vector, It is a learnable shared weight matrix. It is a learnable attention vector; S22, the node-level attention scores are normalized using the softmax function to obtain standardized attention weights. ;in, For nodes The set of all neighbors.

4. The method as described in claim 1, characterized in that, Encoding of time-series operation sequences based on the Transformer architecture includes: S31, calculate the query matrix using a multi-head self-attention mechanism. Key matrix Sum matrix The formula for calculating single-head attention is as follows: ; S32, using scaling factor The attention score is normalized to prevent the gradient from vanishing due to an excessively large inner product.

5. The method as described in claim 1, characterized in that, Activate a dynamic risk communication mechanism, including: S41, the initial risk value for merchant nodes that will be marked as high-risk. Set it to 1.0 and set the damping factor. Control the rate at which risk spreads and diminishes; S42, through iterative formula Multiple rounds of propagation are performed until the preset maximum number of iterations and risk value convergence are reached; among them... Any node in the diagram In the Risk value after propagation side The weight.

6. The method as described in claim 1, characterized in that, Also includes: S6 incrementally updates the dynamic heterogeneous graph according to the preset update cycle, and retrains the heterogeneous graph neural network and Transformer encoder based on the newly added nodes and edges to dynamically adjust the model parameters and risk propagation weights.

7. A cash-out identification device based on multimodal dynamic graphs and risk propagation, characterized in that, include: The dynamic heterogeneous graph construction module is used to construct a dynamic heterogeneous information graph, which integrates multi-type entities such as employees, customers, merchants, and accounts, as well as their corresponding semantic relationships of approval, transaction, and transfer through multi-source data, and dynamically maintains the time-series operation sequence of employee nodes. The heterogeneous graph neural network module is used to model the spatial relationships of dynamic heterogeneous graphs using a hierarchical attention mechanism. It calculates the contribution weight of each neighbor node to the risk of the target employee through node-level attention and calculates the global impact weight of different relationship types on risk propagation through relationship-level attention, generating a graph structure risk representation vector for the employee. The Transformer temporal encoding module is used to encode the temporal operation sequence of employees based on the Transformer architecture. It uses the self-attention mechanism to capture the long-range dependencies between operation behaviors and generate a temporal intent vector that represents the employee's behavioral intention. The dynamic risk propagation module is used to activate the dynamic risk propagation mechanism when any node in the graph is detected as high risk. Based on the graph structure risk representation vector and attention weight, the risk signal is propagated in a directional manner along the graph connection edge to generate the real-time propagation risk value of the employee node. The multimodal fusion and risk scoring module is used to perform multimodal fusion of the graph structure risk representation vector, the temporal intent vector, the real-time propagation risk value and the employee static feature vector, input the data into a classifier to calculate the employee's violation probability and output a risk score.

8. The apparatus as claimed in claim 7, characterized in that, Also includes: The incremental update module is used to incrementally update the dynamic heterogeneous graph according to a preset update cycle, and retrain the heterogeneous graph neural network and Transformer encoder based on the newly added nodes and edges to dynamically adjust the model parameters and risk propagation weights.

9. An electronic device, comprising: processor; The memory stores executable instructions; when the processor executes the instructions, it implements the cash-out identification method based on multimodal dynamic graph and risk propagation as described in any one of claims 1-6.

10. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements a cash-out identification method based on multimodal dynamic graphs and risk propagation as described in any one of claims 1-6.

Images