Financial transaction risk early warning processing method, system and device

Abstract

The invention relates to the technical field of computers and artificial intelligence, and discloses a financial transaction risk early warning processing method, system and device, and the main points of the technical scheme are that original financial data is obtained and preprocessed, and an event data flow of financial transaction data and a historical behavior sequence of a user are obtained; based on the event data flow of the financial transaction data, constructing a dynamic time sequence diagram, and generating a context risk vector for the to-be-analyzed transaction through the dynamic time sequence diagram; an individual financial cognitive model is constructed for the user, the individual financial cognitive model is used for adjusting an attention mechanism of the model according to the historical behavior sequence and the context risk vector of the user, and an expected representation vector of the to-be-analyzed transaction is generated; obtaining an actual representation vector of the to-be-analyzed transaction, and calculating a cognitive deviation degree in combination with comparison with an expected representation vector of the to-be-analyzed transaction; and obtaining a corresponding risk level based on the cognitive deviation degree and a preset risk early warning rule, and sending a risk early warning signal corresponding to the risk level.

Description

A method, system and device for early warning and processing of financial transaction risks Technical Field

[0001] This invention relates to the fields of computer and artificial intelligence technology, and more specifically, to a method, system, and apparatus for processing financial transaction risk warnings. Background Technology

[0002] With the rapid development of financial technology, online, mobile, and real-time banking services have become the norm. While this increased convenience brings great benefits to users, it also provides fertile ground for financial fraud. Modern financial fraud methods are becoming increasingly complex, organized, and professional. Attackers often use stolen identity information and control a large number of "farmed" accounts to coordinate their crimes, causing huge economic losses and reputational risks to banks and users. Therefore, building an efficient and accurate anti-fraud risk early warning system has become the core and key to the security system of modern financial institutions.

[0003] To address this challenge, bank anti-fraud technology has evolved from traditional expert rule systems to machine learning-based models. While expert rule systems offer clear logic and strong interpretability, their rule formulation and updates heavily rely on human experience, resulting in slow response times and difficulty in dealing with the ever-evolving and rapidly changing new fraud methods. Once attackers gain access to the rules, the defense system can be easily bypassed. The introduction of machine learning models, by automatically learning from massive amounts of historical data and uncovering potential fraud patterns, has improved the accuracy and coverage of risk identification to a certain extent, becoming the mainstream solution in the industry today.

[0004] However, current mainstream machine learning-based risk warning methods still suffer from a fundamental limitation in their technological paradigm. These methods typically treat each transaction or each user's behavior as an isolated analytical object. Whether analyzing the multidimensional features of a single transaction or using techniques such as recurrent neural networks to model the historical behavioral sequences of users, their perspective is inherently inward and local. They lack the ability to dynamically perceive the entire financial network environment in which a transaction occurs.

[0005] This "contextual blindness" makes existing models inadequate against organized and coordinated fraud attacks. For example, a transaction may appear perfectly normal based solely on the user's historical behavior, but if the counterparty's account has recently been linked to multiple identified risky accounts, or if the transaction itself is situated within an abnormal network topology where funds are rapidly aggregated and dispersed within a short period, then the true risk level of this transaction should be significantly increased. Existing technologies, unable to effectively model such dynamic and complex inter-entity relationships, struggle to capture these crucial "relationship-based risk" signals.

[0006] Therefore, existing technologies generally struggle to overcome the bottleneck of individual analysis, failing to deeply integrate and collaboratively assess users' intrinsic behavioral patterns with the dynamic risks of the external environment. When facing organized and highly concealed new types of financial fraud, existing technological solutions generally suffer from untimely warnings, high rates of false alarms and false negatives, necessitating a novel technological solution to overcome this critical deficiency. Summary of the Invention

[0007] The purpose of this invention is to provide a financial transaction risk early warning processing method, system and device, which achieves dynamic and accurate early warning of potential fraud risks by deeply integrating the global network context risk of transactions with the judgment of the inherent patterns of individual user behavior.

[0008] The above-mentioned technical objective of the present invention is achieved through the following technical solution: a financial transaction risk early warning processing method, comprising the following steps: S1, acquiring raw financial data and preprocessing it to obtain event data stream and historical behavior sequence; the raw financial data includes: user transaction flow, inter-account transfer records, network login behavior, device fingerprint information and geographical location data.

[0009] Preprocessing includes: cleaning, format standardization, and feature extraction of heterogeneous raw financial data; transforming each user's transaction or behavioral event into a structured multidimensional feature vector, which has a time index of the event occurrence, forming a historical behavioral sequence of the user; and organizing entities and their interaction relationships into an event data stream required to construct a dynamic time series diagram.

[0010] S2. Based on financial transaction data, construct a dynamic time series graph and generate a contextual risk vector for the transaction to be analyzed through the dynamic time series graph; financial transaction data includes user transaction history, device information, and login behavior; the nodes of the dynamic time series graph are entities related to the transaction, and the edges of the dynamic time series graph represent timestamped interactions between entities; entities related to the transaction include user accounts, merchants, device IDs, and IP addresses.

[0011] The process of generating a context risk vector for a transaction to be analyzed using a dynamic time sequence graph is as follows: a time sequence graph network model is used to learn the dynamic evolution of the memory state and interaction information of nodes in the dynamic time sequence graph. By aggregating and encoding the nodes involved in the current transaction and their neighborhood information, a context risk vector is generated to represent the global network environment risk of this transaction.

[0012] In the temporal graph network model, a memory vector that evolves over time and represents the node's state is established for each node in the graph. During the application of the temporal graph network model, when a transaction is processed, a message is generated for the nodes involved in the transaction. This message aggregates the latest memory vectors of both parties before the transaction occurred, as well as the current transaction's own feature vector. This aggregation process is defined by a message function, which is a learnable neural network. After the message is generated, the temporal graph network model updates the node's memory vector using this message. After updating the memory vectors of all relevant nodes in this transaction, the temporal graph network model integrates the updated node memory vectors and transaction feature vectors through the aggregation function to generate the final context risk vector.

[0013] S3. Construct an individual financial cognitive model for the user. The individual financial cognitive model is used to adjust the attention mechanism of the model based on the user's historical behavior sequence and contextual risk vector to generate the expected representation vector of the transaction to be analyzed. The historical behavior sequence includes: transaction amount, transaction time interval, transaction type and merchant category.

[0014] The individual financial cognition model is built on the Transformer architecture to capture long-term dependencies in user behavior.

[0015] After establishing the user's individual financial cognitive model, the user's historical behavior sequence is added to the positional encoding through an embedding layer to obtain the input representation sequence of the individual financial cognitive model. When the individual financial cognitive model analyzes the current transaction to be processed with a time index, a query vector is generated from the corresponding input representation, and a key vector and a value vector are generated from the input representation at any time in the sequence. When calculating the attention score between the query vector of the transaction to be analyzed and the key vector of the user's historical behavior sequence using the attention score calculation formula, a contextual risk vector is introduced to adjust the attention mechanism. The attention score is normalized into attention weights using the standard Softmax function, and the value vectors are weighted and summed using these weights. After processing by the standard Transformer component, the individual financial cognitive model outputs an expected representation vector of the transaction to be analyzed.

[0016] S4. Obtain the actual representation vector of the transaction to be analyzed, and calculate the cognitive deviation by comparing it with the expected representation vector of the transaction to be analyzed. The cognitive deviation is calculated by calculating the cosine distance between the expected representation vector and the actual representation vector.

[0017] S5. Based on the cognitive deviation and preset risk warning rules, obtain the corresponding risk level and issue a risk warning signal corresponding to the risk level. This includes: mapping the cognitive deviation to a standardized risk score through a calibration function; obtaining the risk level corresponding to the risk score according to the preset risk warning rules, and then issuing a risk warning signal corresponding to the risk level.

[0018] A financial transaction risk early warning and processing system includes: a data preprocessing module for acquiring and preprocessing raw financial data to obtain event data streams, historical behavior sequences, and actual representation vectors of the transactions to be analyzed; a context risk vector generation module for constructing a dynamic time series diagram based on financial transaction data and generating context risk vectors for the transactions to be analyzed through the dynamic time series diagram; an individual financial cognitive model construction module for constructing an individual financial cognitive model for users, wherein the individual financial cognitive model is used to adjust the attention mechanism of the model based on the user's historical behavior sequence and context risk vectors to generate expected representation vectors of the transactions to be analyzed; a risk quantification module for acquiring the actual representation vectors of the transactions to be analyzed and comparing them with the expected representation vectors of the transactions to be analyzed to calculate the cognitive deviation; and a risk early warning module for obtaining the corresponding risk level based on the cognitive deviation and preset risk early warning rules, and issuing a risk early warning signal corresponding to the risk level.

[0019] A financial transaction risk early warning processing device includes a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor executes the computer program to implement the above-mentioned method.

[0020] In summary, this invention offers the following advantages: it significantly enhances the ability to identify coordinated fraud and organized crime. By constructing a dynamic time-series graph and generating a contextual risk vector for each transaction, the technical solution of this invention overcomes the limitations of traditional methods that only analyze isolated users or transactions. It can capture in real time the abnormal topology and fund flow characteristics formed in the financial network when multiple accounts coordinate their actions, thereby effectively identifying highly concealed frauds where individual behaviors appear normal but are ultimately part of a fraud network.

[0021] This invention effectively reduces the false alarm rate of risk warnings and improves user experience. Its core context-aware self-attention mechanism injects a contextual risk vector, representing external environmental risk, into the judgment process of individual behavior. This enables the model to distinguish between benign and malicious behavioral anomalies, avoiding unnecessary interference with normal user transactions caused by a "one-size-fits-all" judgment, and achieving a balance between precise targeting and user experience.

[0022] This invention possesses rapid adaptability and generalization capabilities to novel and unknown fraud techniques. The technical solution of this invention does not rely on any fixed, expert-experience-based fraud rule base. Its core temporal graph network and context-aware cognitive model both identify risk patterns through deep learning from data. When new fraud techniques emerge, these techniques will inevitably deviate from normal patterns in financial network correlations and individual behavioral sequences. This deviation can be automatically captured by the model, thereby ensuring the long-term effectiveness of the system against continuously evolving attack techniques.

[0023] This invention automates and refines the process from risk perception to decision-making. By calculating cognitive deviation and mapping it to a standardized risk score, this invention provides a quantifiable risk measurement standard. Combined with preset multi-level risk thresholds, the system can automatically trigger different levels of handling strategies, such as automatic release, enhanced verification, or real-time blocking, forming a complete automated decision-making closed loop, which greatly improves the efficiency and timeliness of handling risk events.

[0024] This invention enables early risk prediction and proactive defense. Because the contextual risk vector integrates the risk profile of the surrounding transaction environment, this invention can detect potential threats at the initial stage of fraudulent activity, even before a user's account incurs direct losses, through its correlation with the risk network environment. This "environmental early warning" capability transforms risk control from reactive, post-event detection to proactive, in-event intervention and even proactive, pre-event prediction, buying valuable response time for banks and users. Attached Figure Description

[0025] Figure 1 is a flowchart of the method of the present invention; Figure 2 is a schematic diagram of the attention mechanism regulation of the present invention. Detailed Implementation

[0026] It is readily understood that, based on the technical solution of this invention, various embodiments of the invention can be conceived by those skilled in the art without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention. Rather, these embodiments are provided to enable those skilled in the art to gain a more thorough understanding of the invention. Preferred embodiments of the invention are described below in conjunction with the accompanying drawings, which form part of this application and, together with the embodiments of the invention, serve to illustrate the innovative concept of the invention.

[0027] As shown in Figure 1, the present invention provides a financial transaction risk early warning processing method, including the following steps: S1, through the system's data preprocessing module, raw financial data is collected and integrated, and preprocessed to obtain the event data stream of financial transaction data and the user's historical behavior sequence; the preprocessing includes: cleaning, format unification, and feature extraction of heterogeneous raw financial data; converting each transaction or behavior event of the user into a structured multi-dimensional feature vector to form the user's historical behavior sequence; organizing entities and their interaction relationships into the event data stream required to construct a dynamic time series diagram.

[0028] S2. Using the context risk vector generation module, based on financial transaction data, including user transaction history, device information, and login behavior, a global dynamic time series graph is constructed, and context risk vectors are generated for the transactions to be analyzed through the dynamic time series graph. The nodes of the dynamic time series graph are entities related to the transaction, and the edges of the dynamic time series graph represent timestamped interactions between entities. Entities related to the transaction include user accounts, merchants, device IDs, and IP addresses.

[0029] The process of generating a context risk vector for a transaction to be analyzed using a dynamic time sequence graph is as follows: a time sequence graph network model is used to learn the dynamic evolution of the memory state and interaction information of nodes in the dynamic time sequence graph. By aggregating and encoding the nodes involved in the current transaction and their neighborhood information, a context risk vector is generated to represent the global network environment risk of this transaction.

[0030] Specifically, in the temporal graph network model, a memory vector that evolves over time and represents the node's state is established for each node in the graph. During the application of the temporal graph network model, when a transaction is processed, the model generates a message for the nodes involved in the transaction. This message aggregates the latest memory vectors of both parties before the transaction occurred, as well as the current transaction's own feature vector. This aggregation process is defined by a message function, which is a learnable neural network. After the message is generated, the temporal graph network model updates the node's memory vector using this message. After updating the memory vectors of all relevant nodes in this transaction, the model integrates the updated node memory vectors and the transaction feature vectors using the aggregation function to generate the final context risk vector.

[0031] S3. Construct an individual financial cognitive model for the user. The individual financial cognitive model is used to adjust the model’s attention mechanism based on the user’s historical behavior sequence and contextual risk vector to generate the expected representation vector of the transaction to be analyzed. This adjustment process is not a simple summation of results, but rather uses external environmental risk as a key variable to directly intervene in the model’s internal judgment of the intrinsic correlation of user behavior.

[0032] A user's historical behavior sequence includes: transaction amount, transaction time interval, transaction type, and merchant category.

[0033] The individual financial cognition model is built on the Transformer architecture to capture long-term dependencies in user behavior.

[0034] After establishing a user's individual financial cognitive model, the user's historical behavior sequence is added to the location encoding through an embedding layer to obtain the input representation sequence of the individual financial cognitive model. When the individual financial cognitive model analyzes the current pending transaction with a time index, a query vector is generated from the corresponding input representation. And generate a key vector from the input representation at any time in the sequence. The sum vector; then the attention mechanism adjustment process is executed, as shown in Figure 2, that is, through the attention score calculation formula: Calculate the query vector of the transaction to be analyzed. Key vectors of user historical behavior sequences When calculating attention scores, a contextual risk vector is introduced. ; These are learnable weight matrices used to map queries, keys, and context vectors to a unified latent space; These are learnable weight vectors. In this way, the model can adapt to the external risk environment. This reflects the dynamic adjustment of the "focus" on the user's historical behavior, thereby generating an expected representation vector for this transaction that is more in line with the current context.

[0035] The attention score is normalized into attention weights using the standard Softmax function, and then used to perform a weighted summation on the value vector. After processing by the standard Transformer component, the individual financial cognitive model outputs an expected representation vector of the transaction to be analyzed.

[0036] S4. Obtain the actual representation vector of the transaction to be analyzed, and calculate the cognitive deviation by comparing it with the expected representation vector of the transaction to be analyzed. The cognitive deviation is calculated by calculating the cosine distance between the expected representation vector and the actual representation vector, and its expression is: ,in, For cognitive deviation, Let the desired representation vector be... This is the actual representation vector of the transaction to be analyzed.

[0037] S5. Based on the cognitive deviation and the preset risk warning rules, obtain the corresponding risk level and issue a risk warning signal corresponding to the risk level.

[0038] This includes: mapping cognitive deviation to a standardized risk score through a calibration function; obtaining the risk level corresponding to the risk score based on preset risk warning rules; and then issuing a risk warning signal corresponding to the risk level.

[0039] The risk warning rules pre-set at least two risk thresholds. By comparing the risk score with the risk thresholds, different levels of risk warning signals, such as "normal", "attention", and "high risk", are generated, thereby triggering the corresponding follow-up handling procedures.

[0040] Corresponding to the above method, the present invention also provides a financial transaction risk early warning and processing system, including: a data preprocessing module, used to acquire raw financial data and preprocess it to obtain event data streams, historical behavior sequences, and actual representation vectors of the transactions to be analyzed; specifically, in the initial stage of system operation, the data preprocessing module is responsible for collecting and integrating raw financial data from multiple business system databases of the bank. This data includes, but is not limited to, user transaction records, inter-account transfer records, network login behavior, device fingerprint information, and geographic location data.

[0041] The data preprocessing module performs cleaning, format standardization, and feature extraction operations on the collected heterogeneous data. It transforms each user transaction or behavioral event (such as login) into a structured, multi-dimensional feature vector. ,in It serves as a time index for events. Simultaneously, it organizes entities (such as users and merchants) and their interactions into an event data stream required for constructing a dynamic time series graph, and then sends the processed structured data to the context risk vector generation module and the individual financial cognitive model processing module. The context risk vector generation module is used to construct a dynamic time series graph based on financial transaction data, and generate context risk vectors for the transactions to be analyzed through the dynamic time series graph; the context risk vector generation module receives the event data stream from the data preprocessing module. The core function of this module is to construct and maintain a global dynamic time series graph G, which uses user accounts, merchants, etc., as nodes, and their transactions or interactions as timestamped edges.

[0042] When a transaction to be analyzed occurs, the context risk vector generation module uses a pre-trained temporal graph network model to analyze the transaction's position and relationships within the graph in real time. By aggregating the historical information and current state of the nodes involved in the transaction and their neighboring nodes, this module generates a context risk vector that encapsulates the risks of the global network environment. It is then passed to the individual financial cognitive model processing module.

[0043] The individual financial cognitive model building module is used to construct an individual financial cognitive model for the user. This model adjusts the attention mechanism based on the user's historical behavior sequence and contextual risk vector to generate the expected representation vector of the transaction to be analyzed. The individual financial cognitive model processing module receives the user's historical behavior sequence from the data preprocessing module. , and the context risk vector from the context risk vector generation module for the current transaction to be analyzed. .

[0044] This individual financial cognition model processing module maintains an independent, Transformer-based individual financial cognition model for each user. Its core function is to analyze the user's own historical behavioral patterns by incorporating a contextual risk vector representing external environmental risk. As a moderating factor, it intervenes in the self-attention mechanism within the model. In this way, the model no longer generates predictions based on isolated user behavior, but rather a desired representation vector that integrates user habits and external environmental risks, representing the current exchange to be analyzed. The risk quantification module is used to obtain the actual representation vector of the transaction to be analyzed and compare it with the expected representation vector of the transaction to be analyzed to calculate the cognitive deviation. The risk quantification module receives the expected representation vector from the individual financial cognitive model processing module. And the actual representation vector of the transaction to be analyzed, which has been embedded from the data preprocessing module. This module's function is to accurately quantify risk. It calculates the difference between expectations and reality to obtain a scalar value, namely, the cognitive deviation. The calculation process can be defined by the following formula: ;in, For cognitive deviation, Let the desired representation vector be... Let be the actual vector, and represent the vector dot product. This represents the L2 norm of the vector. The calculated cognitive deviation... The data is output to the risk warning module. The risk warning module is used to obtain the corresponding risk level based on the cognitive deviation and preset risk warning rules, and to issue a risk warning signal corresponding to the risk level.

[0045] The risk warning module receives the cognitive deviation from the risk quantification module. This module first considers cognitive deviation. A standardized risk score is mapped through a calibration function. The module then compares the risk score with preset multi-level risk thresholds in the system and generates specific risk warning signals based on the comparison results. For example, a low-risk score will result in automatic transaction approval, while a high-risk score will trigger real-time transaction blocking and generate a high-priority work order pushed to the financial institution's risk analyst for manual intervention, thus forming a complete risk management closed loop. In a specific embodiment of the invention, the context risk vector generation module internally deploys a time-series graph network model. The core of this model is to maintain a memory vector that evolves over time and represents the state of each node i in the graph (e.g., a user account or a merchant). When a transaction occurring at time t involving user node u and counterparty node c is processed, this model first generates messages for the participating nodes. Taking user node u as an example, the messages it receives... It aggregates the latest memory vectors of both parties before the transaction occurred. , and the feature vector of the current transaction itself. This process can be defined by a message function Msg: The message function Msg is a learnable neural network, such as a multilayer perceptron.

[0046] After generating a message, the model uses that message to update the node's memory vector. This update process is performed using a recurrent neural network (RNN) unit (e.g., a gated recurrent unit, GRU) to capture the temporal dependencies of the state. The new memory vector of the user node... , due to its old memory vector And the message I just received Joint decision: RNN Through the above steps, the model updates the internal state of the nodes related to this transaction. Finally, the module uses an aggregation function, Aggregate, to update the node memory vectors. and and transaction characteristics The data is then integrated to generate the final contextual risk vector. This vector This is a quantitative description of the risk situation of this transaction within the entire financial network environment.

[0047] In this embodiment, the core of the individual financial cognitive model processing module is a context-aware cognitive model specifically designed for this invention. The basic architecture of this model is a Transformer encoder, but its internal self-attention mechanism has been fundamentally improved. First, the user's historical behavioral feature sequence is processed... Through the embedding layer, with position encoding Adding them together yields the input representation sequence of the model. .

[0048] When the model analyzes the current pending transactions (time index is...) When it is in the corresponding input representation, it is from the input representation. Generate query vectors and the input representation from any time in the sequence Generate key vectors Sum value vector This process utilizes independent, learnable weight matrices. Finish: , , Afterward, the model executes its core collaborative steps. This involves computing the query vector. With key vector Attention scores between At that time, the context risk vector received from the context risk vector generation module will be used. This is introduced as crucial third-party information. The computation process is implemented using a specific attention fusion network: In this formula, These are three independent learnable weight matrices, used to linearly transform the query vector, key vector, and context risk vector, projecting them into a unified semantic space; tanh is the hyperbolic tangent nonlinear activation function. It is a learnable weight vector that transforms the activated fusion vector into a scalar, namely the final attention score. .

[0049] Using the above formula, the generation of attention scores no longer depends solely on the internal consistency of the user's own behavior. and The similarity is not determined by the risk of the external network environment of the current transaction. The model dynamically and non-linearly adjusts the scores. Subsequently, the model uses the standard Softmax function to convert the scores... Normalized to attention weights and used to adjust the value vector A weighted summation is performed. After processing by standard Transformer components such as multi-head attention, residual connections, and feedforward networks, the model finally outputs an expected representation vector of the current transaction. This vector It contains a theoretical behavioral representation that conforms to the user's consistent behavior pattern under a specific global risk context, providing a precise benchmark for subsequent risk quantification.

[0050] As an embodiment of the present invention, the risk quantification module and the risk warning module are described in detail as follows: The core task of the risk quantification module is to accurately measure the deviation between actual behavior and its theoretical benchmark in a specific context. This module receives the expected representation vector generated by the individual financial cognitive model processing module. and the actual representation vector representing the real transaction. In this embodiment, cosine distance is used to calculate the difference between these two high-dimensional vectors, thus obtaining the cognitive deviation. It can effectively capture their inconsistencies in direction without being overly affected by vector length (e.g., transaction amount). The calculation process is strictly performed within the module, and its mathematical definition is consistent with that described above.

[0051] Calculated cognitive deviation It is a dimensionless scalar value whose magnitude intuitively reflects the degree of abnormality of the current transaction behavior. A value close to 0 indicates that the actual behavior is highly consistent with the model's expectations, while a large value indicates that the behavior deviates significantly from the user's inherent paradigm in the current network risk environment, and there is a potential for fraud.

[0052] Subsequently, cognitive deviation The raw score is then passed to the risk warning module. To make the score more business-interpretable and facilitate subsequent decision-making, the risk warning module first maps it to a standardized risk score using a configurable calibration function. In a specific implementation, the calibration function can be a parameterized Siqmoid function: ;in, and These are parameters that risk strategy analysts can adjust according to business needs, controlling the steepness and center offset of the risk curve. Through this step, the original deviation is converted into a risk score between 0 and 1 that aligns with probabilistic intuition.

[0053] In generating standardized risk scores Next, the risk warning module compares it with a pre-defined set of risk strategies that includes at least two thresholds—that is, the established risk warning rules. This set of strategies defines the boundaries between different risk levels; for example, a low-risk threshold. and a high-risk threshold .

[0054] When a transaction's risk score Less than the low risk threshold When the transaction is deemed normal, the system will generate an "automatic release" instruction to ensure a seamless and normal transaction experience for the user.

[0055] When risk score lie in and If the system determines that the transaction carries a moderate risk, the risk warning module will generate an "enhanced verification" command. This command can be linked with the bank's identity authentication system to automatically trigger a secondary verification request for the user, such as sending a dynamic SMS password or requiring facial recognition or fingerprint verification.

[0056] When risk score Greater than or equal to the high-risk threshold If the transaction is deemed highly suspicious, the risk warning module will generate the highest-level warning signal, which triggers two parallel actions: first, it sends a "real-time blocking" command to the core transaction processing system to halt the transaction before the funds are transferred; second, it automatically generates a high-priority risk event work order in the risk management platform, recording all relevant information about the transaction in detail, and immediately pushes it to the manual review team for in-depth analysis and handling. Through this series of automated, tiered handling processes, this invention achieves a complete closed loop from risk quantification to business decision-making.

[0057] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

[0058] It should be understood that, in order to simplify the present invention and help those skilled in the art understand its various aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes described in a single embodiment or with reference to a single figure. However, the present invention should not be construed as including all features in the exemplary embodiments as essential technical features of the claims of this patent.

[0059] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0060] It should be understood that the modules, units, components, etc., included in the device of one embodiment of the present invention can be adaptively changed to be placed in a device different from that embodiment. Different modules, units, or components included in the device of the embodiment can be combined into a single module, unit, or component, or they can be divided into multiple sub-modules, sub-units, or sub-components.

[0061] The modules, units, or components in the embodiments of the present invention can be implemented in hardware, in software running on one or more processors, or in a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement the embodiments of the present invention. The present invention can also be implemented on a computer program product or computer-readable medium for performing some or all of the methods described herein.

Claims

1. A method for handling early warning of financial transaction risks, characterized by: The process includes the following steps: S1. Acquire raw financial data and preprocess it to obtain the event data stream of financial transaction data and the user's historical behavior sequence; S2. Based on the event data stream of financial transaction data, construct a dynamic time series graph and generate a contextual risk vector for the transaction to be analyzed through the dynamic time series graph; S3. Build an individual financial cognition model for the user. The individual financial cognition model is used to adjust the attention mechanism of the model according to the user's historical behavior sequence and contextual risk vector to generate the expected representation vector of the transaction to be analyzed. S4. Obtain the actual representation vector of the transaction to be analyzed, and calculate the cognitive deviation by comparing it with the expected representation vector of the transaction to be analyzed; S5. Based on the cognitive deviation and the preset risk warning rules, obtain the corresponding risk level, and issue a risk warning signal corresponding to the risk level.

2. The financial transaction risk early warning processing method according to claim 1, characterized in that: preprocessing include: The heterogeneous raw financial data is cleaned, formatted, and its features are extracted. Each user transaction or behavior event is transformed into a structured multidimensional feature vector, which has a time index of the event occurrence, forming a historical behavior sequence of the user; entities and their interaction relationships are organized into an event data stream required to construct a dynamic time sequence diagram.

3. The financial transaction risk early warning processing method according to claim 1, characterized in that: The nodes of a dynamic sequence graph are entities related to transactions, and the edges of a dynamic sequence graph represent timestamped interactions between entities. In the sequence graph network model, a memory vector that evolves over time and represents the state of each node is established for each node in the graph.

4. The financial transaction risk early warning processing method according to claim 1, characterized in that: The process of generating a context risk vector for a transaction to be analyzed using a dynamic time sequence graph is as follows: a time sequence graph network model is used to learn the dynamic evolution of the memory state and interaction information of nodes in the dynamic time sequence graph. By aggregating and encoding the nodes involved in the current transaction and their neighborhood information, a context risk vector is generated to represent the global network environment risk of this transaction.

5. The financial transaction risk early warning processing method according to claim 1, characterized in that: in In the application of the temporal graph network model, when a transaction is processed, the temporal graph network model generates a message for the nodes involved in the current transaction. This message aggregates the latest memory vectors of both parties before the transaction occurred and the feature vector of the current transaction itself. After the message is generated, the temporal graph network model updates the memory vectors of the nodes using this message. After the temporal graph network model updates the memory vectors of all relevant nodes in this transaction, it integrates the updated node memory vectors and transaction feature vectors through an aggregation function to generate a contextual risk vector.

6. The financial transaction risk early warning processing method according to claim 1, characterized in that: After establishing the user's individual financial cognitive model, the user's historical behavior sequence is added to the positional encoding through an embedding layer to obtain the input representation sequence of the individual financial cognitive model. When the individual financial cognitive model analyzes the current transaction to be processed with a time index, a query vector is generated from the corresponding input representation, and a key vector and a value vector are generated from the input representation at any time in the sequence. When calculating the attention score between the query vector of the transaction to be analyzed and the key vector of the user's historical behavior sequence using the attention score calculation formula, a contextual risk vector is introduced to adjust the attention mechanism. The attention score is normalized into attention weights using the standard Softmax function, and the value vectors are weighted and summed using these weights. After processing by the standard Transformer component, the individual financial cognitive model outputs the expected representation vector of the transaction to be analyzed.

7. The financial transaction risk early warning processing method according to claim 1, characterized in that: The cognitive deviation is calculated by calculating the cosine distance between the expected representation vector and the actual representation vector.

8. The financial transaction risk early warning processing method according to claim 1, characterized in that: S5 include: Cognitive deviation is mapped to a standardized risk score using a calibration function; Based on the preset risk warning rules, the risk level corresponding to the risk score is obtained, and then a risk warning signal corresponding to the risk level is issued.

9. A financial transaction risk early warning and processing system, characterized in that: include: The data preprocessing module is used to acquire raw financial data and preprocess it to obtain event data streams, historical behavior sequences, and actual representation vectors of the transactions to be analyzed. The context risk vector generation module is used to construct a dynamic time series graph based on financial transaction data, and generate a context risk vector for the transaction to be analyzed through the dynamic time series graph; the individual financial cognition model construction module is used to build an individual financial cognition model for users. The individual financial cognition model is used to adjust the attention mechanism of the model according to the user's historical behavior sequence and context risk vector, and generate the expected representation vector of the transaction to be analyzed. The risk quantification module is used to obtain the actual representation vector of the transaction to be analyzed and compare it with the expected representation vector of the transaction to be analyzed to calculate the cognitive deviation. The risk warning module is used to obtain the corresponding risk level based on the degree of cognitive deviation and the preset risk warning rules, and to issue a risk warning signal corresponding to the risk level.

10. A financial transaction risk early warning and processing device, characterized in that: include: A processor and a memory, the memory storing a computer program executable by the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-4.

Images