Financial risk dynamic early warning method based on machine learning

Abstract

The invention relates to the technical field of financial science and data processing, and discloses a financial risk dynamic early warning method based on machine learning, and the method comprises the steps: extracting macrorhythm and microcosmic naturalness features of transaction data through the Horkes process and multi-fractal detrending fluctuation analysis; constructing a dynamic attribute graph, inputting the dynamic attribute graph into a graph attention network containing a naturalness gating unit, modulating attention weight by using a dual gating coefficient generated according to edge attributes, inhibiting information transmission of a low naturalness interaction edge in a feature aggregation process, and generating a node embedding vector; and finally, inputting the node embedded vector into a risk classification network, and executing dynamic grading early warning in combination with a dual gating coefficient. According to the method, by introducing the microdynamics characteristics and the gating mechanism, decoupling evaluation of data authenticity and operation risks is realized, and the identification capability for forged data and the robustness of a risk control model are effectively improved.

Description

Technical Field

[0001] This invention relates to the fields of financial technology and data processing technology, specifically a method for dynamic early warning of financial risks based on machine learning. Background Technology

[0002] Supply chain finance primarily relies on the genuine trade background and fund flow records between core enterprises and their upstream and downstream SMEs for credit risk assessment. With increasing digitalization, risk control models based on unstructured data such as transaction flows and invoice information are gradually replacing traditional auditing methods that rely solely on static financial statements. However, verifying the authenticity of data sources remains a key challenge in this field. In complex supply chain networks, some companies may use automated scripts or adversarial generation networks to generate fabricated transaction records in bulk to obtain credit lines or conceal operational anomalies. These fabricated data are often meticulously designed in terms of macroeconomic indicators such as statistical mean, transaction frequency, and total amount, enabling them to closely resemble the operating characteristics of normal enterprises, thereby bypassing rule-based or traditional statistical model-based anomaly detection mechanisms.

[0003] Existing machine learning-based risk control solutions primarily focus on mining topological relationships within transaction networks. For example, they utilize graph neural networks to model interactions between companies, generating a risk representation for the current company by aggregating features from neighboring nodes. However, these methods typically rely on the assumption that "data occurrence equals reality." When performing feature aggregation, they often assign weights solely based on feature similarity between nodes or a pre-defined topological structure, lacking verification of the physical properties of the interaction edges' generation mechanisms. When the input data contains a large number of forged transactions that conform to statistical patterns but lack natural behavioral dynamics, existing graph neural network algorithms cannot effectively identify and block the propagation of these false signals. This leads to the spread of abnormal features within the network, contaminating the embedding representations of normal nodes. Furthermore, existing risk warning systems typically output a single default probability value without decoupling the data's confidence level from the company's operational status. This makes it difficult for risk control personnel to distinguish whether high-risk alerts are caused by actual operational deterioration or by data quality issues or systemic fraud attacks, reducing the interpretability and practical application value of the warning results. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a dynamic early warning method for financial risks based on machine learning. This method solves the technical problem that existing supply chain finance risk control models are unable to effectively distinguish between algorithm-generated fake data and real high-risk business activities based on the micro-dynamic characteristics of transaction data, resulting in a high false alarm rate and a lack of physical interpretability in early warnings.

[0005] The first aspect of this invention provides a dynamic early warning method for financial risks based on machine learning. This method aims to address the technical problem that existing supply chain finance risk control models struggle to effectively distinguish between algorithm-generated fraudulent data and genuine high-risk business activities based on the micro-dynamic characteristics of transaction data.

[0006] This method first acquires the transaction time-series data and basic business attribute data of the target enterprise. Considering the temporal distribution characteristics of the transaction data, the method employs a Hawkes process to dynamically model the transaction time-series data. By constructing a conditional strength function model including baseline strength and a kernel function, and using maximum likelihood estimation to solve for the model parameters, a macro-rhythmic feature vector characterizing the self-excitation characteristics of the enterprise's operational behavior is extracted. This feature vector includes parameters such as baseline strength, branch ratio, decay rate, average response delay, and expected cluster size, used to quantify the triggering mechanism and clustering effect of the enterprise's transaction behavior over time.

[0007] Simultaneously, this method utilizes a multifractal detrending volatility analysis algorithm to analyze the micro-fluctuation structure of trading time series data, extracting a micro-naturalness vector that characterizes the inherent statistical regularity of the data. Specifically, the time interval series is mean-centered, cumulative deviation is calculated, and multi-scale segmentation is performed. After eliminating local trends using polynomial fitting, a mean square volatility function is calculated. Then, the generalized Hurst exponent is calculated based on the mean square volatility function, and a multifractal spectrum is derived through Legendre transformation. This method selects the spectral width, spectral asymmetry parameter, and peak position parameter of the multifractal spectrum to construct a micro-naturalness vector. By utilizing the numerical difference between the multifractal characteristics resulting from real business decision-making behavior and the unifractal characteristics of machine-generated data, a quantitative description of the physical attributes of trading data is achieved.

[0008] Building upon this foundation, the method constructs a dynamic attribute graph structure, treating target enterprises as graph nodes and transaction relationships as interaction edges. Node features are constructed by concatenating and mapping basic business attribute vectors and event type vectors; edge attributes integrate the aforementioned macro-rhythm feature vectors, micro-naturalness vectors, and data quality confidence coefficients. The method inputs the dynamic attribute graph structure into a graph attention network, which includes a naturalness gating unit. This naturalness gating unit performs feature transformation on the micro-naturalness vectors of the interaction edges using a multilayer perceptron, maps the output to a normalized interval using a sigmoid activation function, and multiplies it with the data quality confidence coefficients to generate dual-gating coefficients.

[0009] In the feature aggregation stage of the graph attention network, the model uses dual gating coefficients to perform weighted softmax normalization on the non-normalized attention scores between nodes. When the dual gating coefficients approach zero, the model forcibly decays the corresponding attention weights. This mechanism allows the model to dynamically adjust the weights of information flow based on the physical naturalness and quality confidence of the data when aggregating neighborhood information, thereby suppressing the numerical influence of low micro-naturalness or low-quality interaction edges on the node embedding vectors at the algorithm level. The risk classification network receives the finally generated enterprise node embedding vectors and performs hierarchical judgment based on the dual gating coefficients: it calculates the average gating score of the target node and its first-order neighbor nodes, and combines the maximum predicted probability and predicted category of the classification network to output a first-level warning signal indicating data fraud, a second-level warning signal indicating operational risk, or a third-level warning signal indicating operational instability. In addition, the model uses the FocalLoss loss function during training and updates the parameters of the risk classification network, attention network, and naturalness gating unit synchronously through backpropagation algorithm to achieve adaptive adjustment of the micro-feature discrimination criteria.

[0010] A second aspect of this invention provides a dynamic early warning system for financial risks based on machine learning. This system includes a feature extraction module, a graph analysis module, and an early warning module.

[0011] The feature extraction module is configured to acquire the transaction time series data and basic business attribute data of the target enterprise, use Hawkes process to perform dynamic modeling of the transaction time series data to extract macro rhythm feature vectors, and use multifractal detrending fluctuation analysis algorithm to analyze the micro fluctuation structure of the transaction time series data to extract micro naturalness vectors.

[0012] The graph analysis module is configured to construct a dynamic attribute graph structure, where node features are built based on basic industrial and commercial attribute data, and edge attributes integrate macroscopic rhythmic feature vectors and microscopic naturalness vectors. This module is also configured to input the dynamic attribute graph structure into a graph attention network containing naturalness-gated units. The naturalness-gated units generate dual-gating coefficients based on edge attributes, and these dual-gating coefficients modulate the attention weights. Feature aggregation then generates enterprise node embedding vectors. This process directly maps the physical fractal characteristics of the data to edge weights in the graph neural network, achieving a connection between feature extraction and graph representation learning.

[0013] The early warning module is configured to embed enterprise nodes into a vector input risk classification network, and perform hierarchical judgments using dual gating coefficients to output financial risk early warning levels. By decoupling data authenticity assessment from operational risk assessment, this module can identify potential financial default risks while independently blocking false alarms triggered by algorithm-generated forged transaction data, thereby outputting multi-level early warning results with physical meaning interpretation.

[0014] A third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon. When executed by a processor, the program implements the steps of the machine learning-based dynamic early warning method for financial risks described in the first aspect.

[0015] This invention provides a dynamic early warning method for financial risks based on machine learning. It has the following beneficial effects:

[0016] 1. This invention utilizes Hawkes processes and multifractal detrending volatility analysis algorithms to extract dynamic features from transaction data from two dimensions: macroscopic time rhythm and microscopic volatility structure. This method can effectively identify single-fractal characteristics or random noise features in algorithm-generated fraudulent data, thereby distinguishing genuine human business decision-making behavior from machine-generated fraudulent data at the feature input end. This solves the technical problem that traditional models, relying solely on shallow features such as statistical mean or variance, cannot identify highly realistic fraudulent data.

[0017] 2. This invention introduces a gating mechanism based on micro-level naturalness into graph attention networks, dynamically adjusting the attention weights between nodes by calculating dual gating coefficients. This mechanism can automatically suppress the weights of low-naturalness or low-quality interaction edges when aggregating neighborhood information, preventing abnormal or false transaction relationships from causing numerical interference to the node embedding vectors. This design enables the model to effectively filter the influence of noisy data while preserving the graph structure and topological information, significantly improving the robustness of the risk assessment model in the face of data contamination.

[0018] 3. This invention establishes a tiered early warning strategy based on a dual probability-gating indicator, achieving decoupled assessment of data authenticity and operational risk. By independently calculating the average gating score and risk prediction probability, the system can distinguish between abnormal signals triggered by data falsification and genuine financial default risks, avoiding false alarms caused by the inability of traditional single-probability models to identify data source problems. This strategy can output tiered signals indicating data falsification, high operational risk, and operational instability, providing risk control personnel with decision-making basis with physical meaning. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the noise-resistant supply chain risk early warning system of the present invention;

[0020] Figure 2 This is a flowchart of the noise-resistant supply chain risk early warning system of the present invention;

[0021] Figure 3 This is a schematic diagram of the logic flow of the adaptive timing quantization and maximum entropy bootstrapping processing of the present invention;

[0022] Figure 4This is a schematic diagram of the macroscopic business rhythm feature modeling process based on Hawkes process of the present invention;

[0023] Figure 5 This is a schematic diagram of the microscopic naturalness fingerprint extraction process based on the MF-DFA algorithm of the present invention;

[0024] Figure 6 This is a schematic diagram of the inference process of the quality-fractal dual-gated graph attention network of the present invention;

[0025] Figure 7 This is a schematic diagram of the multidimensional risk assessment and dynamic hierarchical early warning process of the present invention;

[0026] Figure 8 The multifractal spectrum of normal and fake transaction records in this invention Comparison chart;

[0027] Figure 9 The present invention is based on the threshold for determining fraud. The changing ROC curve of the model and the graph showing the change in false alarm rate;

[0028] Figure 10 This is a comparison chart of the model training loss reduction curves of the present invention. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] See attached document Figure 1 , Figure 1 This is a schematic diagram of a noise-resistant supply chain risk early warning system according to an embodiment of the present invention. The present invention provides a machine learning-based dynamic financial risk early warning system, which is deployed in a distributed computing cluster or high-performance server and can perform real-time analysis and risk inference on multi-source heterogeneous supply chain operation logs. The system includes a data preprocessing module, a feature extraction module, a graph analysis module, and an early warning output module.

[0031] The data preprocessing module is configured to access the business systems of each node in the supply chain, perform full log extraction, cleaning, time-series alignment, and sequence enhancement operations, and solve the problems of sparsity and physical noise interference in the original data.

[0032] The feature extraction module is connected to the data preprocessing module and is used to receive the processed time series data. The feature extraction module integrates a parallel computing unit, configured to mine the dynamic features of the time series from both macroscopic statistical and microscopic fractal perspectives, and output macroscopic rhythm vectors and microscopic naturalness vectors.

[0033] The graph analysis module is connected to the feature extraction module. The graph analysis module stores dynamic graph structure data and pre-trained deep neural network models. This module is configured to construct enterprise relationship graphs and utilize feature vectors to calculate attention weights and gating coefficients between nodes, performing feature propagation and aggregation within the graph.

[0034] The early warning output module is connected to the graph analysis module. The early warning output module is configured to calculate the default probability based on the node embedding vectors output by the graph analysis module, and generate a tiered early warning signal by combining the statistical distribution of the gating coefficients.

[0035] See attached document Figure 2 , Figure 2 This is a flowchart of a noise-resistant supply chain risk early warning method according to an embodiment of the present invention. The present invention provides a machine learning-based dynamic financial risk early warning method, comprising the following steps:

[0036] S1, the data preprocessing module performs standardization and enhancement processing on multi-source heterogeneous event streams. The module extends the acquisition scope down to the atomic operation layer, obtaining quadruples of data containing the operation initiator, operation receiver, original timestamp, and event type. Addressing network jitter and clock drift between different servers, the module calculates a dynamic quantization window, mapping the original timestamps to discrete quantized timestamps and filtering out high-frequency physical noise. For time series with insufficient sample size, the module performs bootstrap resampling based on the maximum entropy principle, generating isomorphic extended sequences that preserve the original probability density and autocorrelation structure, and simultaneously calculates the data quality confidence coefficient.

[0037] S2, the feature extraction module performs macroscopic intensity modeling of the extended sequence based on the Hawkes process model. The feature extraction module uses maximum likelihood estimation to solve for the parameters of the conditional intensity function, including baseline intensity, branch ratio, and decay rate. These parameters constitute a macroscopic rhythm vector, used to characterize the urgency of corporate fund allocation and business continuity.

[0038] S3, the feature extraction module, performs micro-naturalness verification on the extended sequence based on a multifractal detrending fluctuation analysis algorithm. The feature extraction module calculates the generalized Hurst exponent spectrum of the time series and derives the multifractal spectrum through Legendre transformation. It then extracts the spectral width and asymmetric parameters of the multifractal spectrum to construct a micro-naturalness vector. This vector characterizes the complexity and fractal structure integrity of the time series, distinguishing it from genuine human business operations and algorithmically generated fabricated data. S2 and S3 can be executed in parallel.

[0039] S4, the graph analysis module constructs a dynamic supply chain graph containing enterprise nodes and interaction edges, and performs quality-fractal dual-gated inference. The graph analysis module combines the micro-level naturalness vector and the data quality confidence coefficient to calculate a dual-gated coefficient for each edge in the graph. The graph analysis module uses the dual-gated coefficient to modulate the attention weights of the graph attention network. During feature propagation, the graph analysis module aggregates the feature information of neighboring nodes based on the modulated weights and updates the hidden state vector of the current node. This mechanism can physically block the credit transmission of low-quality data or forged data lacking natural fractal characteristics in the network.

[0040] S5, the early warning output module performs risk assessment based on the updated hidden state vectors of the nodes. The module inputs the node vectors into a fully connected classification network to calculate the default risk probability of the current enterprise node. It then compares this default risk probability with a preset risk threshold. When the default risk probability exceeds the threshold, the module generates a Level 1 financial risk early warning signal; when the default risk probability does not exceed the threshold but the double gating coefficient of the associated edges remains below the abnormal threshold, the module generates a Level 2 data anomaly early warning signal.

[0041] In this embodiment of the invention, to address the issues of sample sparsity and lag caused by relying solely on cash flow data in supply chain finance risk control, a data preprocessing module is used to define and fine-grainedly collect multi-source heterogeneous event flows. The underlying principle of this step is that real business risks often precede financial defaults and manifest as high-frequency anxiety-inducing actions (such as frequent tax calculations and repeated inventory checks). By introducing high-frequency non-cash behaviors, the originally sparse, low-frequency transaction point process can be transformed into a high-density behavioral point process that meets statistical convergence requirements.

[0042] The data preprocessing module establishes a unified data access channel through a pre-built application programming interface (API) or ETL tool. The data sources include the enterprise's ERP system, bank fund settlement system, OA office system, and tax management system. The data preprocessing module maps log data from these heterogeneous systems into standardized atomic events. A global event set is defined. Each of the atomic events It can be represented as a quadruple structure:

[0043] ;

[0044] in, This indicates the node identifier that initiated the operation, corresponding to the entity ID of an upstream or downstream enterprise in the supply chain; Indicates the identifier of the receiving node or the identifier of the operation; The timestamp representing the precise time of the event is uniformly converted to a UNIX timestamp format with millisecond precision to eliminate time zone differences and facilitate subsequent numerical calculations. Indicates the event type identifier.

[0045] To fully uncover the potential risk characteristics of enterprise operations, the data preprocessing module performs full-stack atomic event collection. Specifically, event types... The data collection scope not only includes traditional financial events (such as transfers, payments, and receipts) but also covers high-frequency non-financial business operation events. Specific non-financial events include: inventory queries, order creation, and material receiving operations in ERP systems; contract approvals, process rejections, and instant messaging login operations in OA systems; and invoice previews and tax calculations in tax systems. By introducing these non-financial events, the time series sample length of a single enterprise node is increased. This can meet the minimum convergence threshold required for subsequent multifractal detrending fluctuation analysis (typically) .

[0046] After data collection is complete, the data preprocessing module performs data cleaning and standardization sub-steps. Specifically, this includes: removing invalid logs with any missing field in the four-tuple; and classifying event types. Perform one-hot encoding, generating dimension . event type vector This vector is then used to initialize the node feature embeddings in the graph neural network. For the same pair of interacting nodes... The data preprocessing module is based on timestamps. The atomic events are sorted in ascending order by their numerical values ​​to construct the original interaction time series. This sequence will serve as the direct input data for the subsequent adaptive timing quantization module.

[0047] For specific implementation methods to address data sparsity and physical noise interference in the data preprocessing module, please refer to the appendix. Figure 3 , Figure 3This invention demonstrates the logical flow of adaptive time-series quantization and maximum entropy bootstrapping processing. Through the following steps, the original interaction time series is cleaned and enhanced, transforming the raw logs, which are affected by physical devices, into dynamic signals that reflect the essence of business logic.

[0048] S201, the data preprocessing module performs adaptive time-series quantization on the original interaction time series. This step uses the physiological limits of human operation as a benchmark to filter out non-business-related minor jitter caused by network protocol stack processing (such as TCP retransmission, Nagle algorithm delay).

[0049] The data preprocessing module first calculates the current enterprise node Average operating frequency For a length of The original time series The original interval sequence is obtained by calculating the difference between adjacent timestamps. ,in Calculate the average operation interval. Set dynamic quantization window . The calculation follows the following constraints:

[0050] ;

[0051] in, The preset quantization scaling factor is set to 0.1 in this embodiment. The physical meaning of this parameter lies in defining the temporal resolution of concurrent operations; that is, time differences within an average interval of less than 10% are considered a physical continuation of the same operation, rather than a new independent intent. The calculated dynamic quantization window is then used. For the original timestamp Perform a nonlinear floor function to obtain the quantized timestamp. :

[0052] ;

[0053] The denoised time interval sequence was recalculated based on the quantized timestamp. For intervals where the calculation result is 0 (i.e. This indicates that the two events fall within the same quantization time window. The data preprocessing module executes an event merging strategy, aggregating the attribute features of the latter event into the former event, and removing the latter timestamp from the sequence to eliminate the interference of pseudo-high-frequency noise on subsequent fractal dimension calculations.

[0054] S202, the data preprocessing module performs maximum entropy bootstrapping determination and enhancement on the denoised sequence based on a length threshold. The data preprocessing module detects the sequence length. Is it less than the preset fractal analysis convergence threshold? (In this embodiment, the value is set to 1000).

[0055] when At this time, the maximum entropy bootstrapping enhancement program is initiated. The core of this algorithm lies in constructing a continuous probability density function that satisfies the maximum entropy principle and strictly reusing the rank-order arrangement of the original sequence during resampling, thus expanding the data without destroying the original temporal correlation. Specifically, during execution, firstly... Sort in ascending order to obtain the sorted sequence. .

[0056] Subsequently, a piecewise uniform probability density function is constructed for each interval. This satisfies the entropy maximization condition. According to generate A set of random numbers The key step is to obtain the original sequence. The rank index of each element in the order column set After sorting, according to the index sequence The order of the data (with cyclic padding for any deficiencies) is rearranged to obtain the final enhanced time series. .

[0057] S203, the data preprocessing module calculates the data quality confidence coefficient of the augmented sequence. Because synthetic data introduces statistical uncertainty, its weight in the subsequent neural network needs to be controlled by a decay coefficient. The confidence coefficient is defined.

[0058] ;

[0059] in, To enhance the penalty coefficient, it is set to 0.8 in this embodiment. This coefficient determines the level of distrust the model has towards artificially synthesized data. The larger the value, the lower the model's dependence on augmented data. This indicates the data expansion ratio.

[0060] Finally, the data preprocessing module outputs an enhanced time interval sequence. and the corresponding confidence coefficient Through the above steps, the system solves the problem of algorithm non-convergence caused by data sparsity while preserving the original business rhythm characteristics.

[0061] See attached document Figure 4 , Figure 4This is a schematic diagram of a macro-level business rhythm feature modeling process based on Hawkes processes according to an embodiment of the present invention. After acquiring the preprocessed and enhanced time series, the feature extraction module uses Hawkes processes to perform dynamic modeling of the self-excitation characteristics of enterprise operational behavior. The physical principle of this step is that the supply chain business flow has significant time clustering characteristics, that is, an initial event (such as receiving a purchase order) often triggers a series of subsequent events (such as inventory locking, delivery note generation, and logistics notification). Hawkes processes quantify this causal mechanism of "historical events increasing the probability of future events" through conditional strength functions.

[0062] S301, the feature extraction module constructs a conditional strength function model of a univariate Hawkes process. For the enhanced time series... Corresponding timestamp sequence At any time Condition strength for an operational event to occur The definition is as follows:

[0063] ;

[0064] in, Indicates time A collection of previous historical events; Base intensity represents the baseline intensity. This represents the frequency of a company’s spontaneous maintenance operations when there are no external business triggers, such as regular system heartbeat checks or fixed tax declarations. This represents the activation kernel function, used to quantify historical events. For the current moment The effect decays over time.

[0065] In this embodiment, the feature extraction module uses a single exponential decay kernel function for modeling, and its mathematical expression is:

[0066] ;

[0067] in, For time delay; The branch ratio is defined as follows: Its physical meaning is the average expected number of child events directly triggered by each parent event; The decay rate reflects how quickly an event's influence diminishes over time. When At this point, the process is in a subcritical state, and the event flow is stable; when At this point, the process is in a supercritical state, indicating that the number of events is growing exponentially, corresponding to an abnormal surge in business or high-frequency attack behavior.

[0068] S302, The feature extraction module uses the maximum likelihood estimation method to solve for the model parameter set. Construct the log-likelihood function as follows:

[0069] ;

[0070] Substituting the exponential kernel function, the log-likelihood function expands to:

[0071] ;

[0072] To reduce computational complexity and avoid The feature extraction module introduces recursive variables for the double summation calculation. Linearize the calculation of the summation term:

[0073] ;

[0074] in This recursive formula reduces the computational complexity of the likelihood function to [missing information]. The feature extraction module uses a quasi-Newton method to iteratively optimize the log-likelihood function. To avoid getting trapped in local optima, the initial values ​​of the parameters are... In the interval Uniform random sampling within the area, with constraints set: , , .

[0075] S303, The feature extraction module constructs a macroscopic rhythmic feature vector based on the converged parameter set. This vector contains not only the model parameters themselves, but also the second-order dynamic statistics derived from the parameters, and its specific construction is as follows:

[0076] ;

[0077] in, This represents the average response time, reflecting the operational efficiency of the enterprise. This represents the expected cluster size in steady state, i.e., the total chain length of subsequent associated operations averaged by a single spontaneous operation. Finally, the feature extraction module will... The output is sent to the graph analysis module. Through this step, the original time series is mapped to a set of physical parameters that can quantitatively characterize the urgency of corporate fund allocation and the complexity of the business chain.

[0078] See attached document Figure 5 , Figure 5This is a schematic diagram of a micro-naturalness fingerprint extraction process based on the MF-DFA algorithm according to an embodiment of the present invention. To identify forged transaction flows generated by machine algorithms, the feature extraction module utilizes the Multifractal Detrending Fluctuation Analysis (MF-DFA) algorithm to extract naturalness fingerprints from the micro-fluctuation structure of the time series. The physical principle behind this step is that genuine human business decision-making behavior is influenced by the nonlinear coupling of multiple heterogeneous factors such as market sentiment, cash flow pressure, and supply chain game theory, and its time interval series mathematically exhibits a multifractal structure with broad spectrum and wide features; while forged data generated by a single rule or simple random algorithm typically exhibits monofractal or approximately white noise characteristics.

[0079] S401, the feature extraction module constructs a mean-centered cumulative deviation sequence. For a length of... Enhanced time interval sequence First, calculate its arithmetic mean. :

[0080] ;

[0081] Next, construct the cumulative deviation sequence. This step is equivalent to integrating the original noisy sequence, transforming it into a random walk sequence to amplify the weak trend signal.

[0082] ;

[0083] S402, the feature extraction module performs multi-scale segmentation and local trend elimination on the cumulative deviation sequence. The sequence... Divided into A number of non-overlapping intervals, among which The time scale is used. To ensure the stability of the statistical results, the scale is... The value range is set to The values ​​are taken according to a geometric progression step size. To avoid losing data at the tail end, the sequence is divided in reverse order, starting from the tail end. The intervals totaled [number], resulting in [number] totals. A local interval.

[0084] In each interval Inside, a least squares method is used to fit a... Polynomial trend function In this embodiment, a second-order polynomial is used. This effectively filters out implicit linear and weakly nonlinear trends in the sequence. The mean square fluctuation function after eliminating local trends is calculated. .

[0085] ;

[0086] S403, The feature extraction module calculates the q-th order generalized wave function. And fit the generalized Hurst exponent Set the fluctuation order. The range of values ​​is The step size is 0.2. For a given... Take the average of the mean square fluctuations over all intervals:

[0087] ;

[0088] against For singularities, the logarithmic mean is used for calculation to ensure the continuity of the function:

[0089] ;

[0090] According to the power law In a double logarithmic coordinate system Perform linear regression, and the slope is the generalized Hurst exponent. . Follow The degree of change reflects the strength of the multifractal of the sequence: if If it is a constant, then it is a simplefractal; if Follow If it decreases monotonically, it is a multifractal.

[0091] S404, the feature extraction module calculates the multifractal spectrum through Legendre transformation. First, calculate the quality index. :

[0092] ;

[0093] Then calculate the singularity index. and multifractal spectrum :

[0094] ;

[0095] ;

[0096] in By discrete The sequence is obtained by numerical difference differentiation.

[0097] S405, the feature extraction module extracts key geometric parameters of the multifractal spectrum and constructs a microscopic naturalness vector. This vector contains the following three core components:

[0098] Spectral width : Characterizes the strength of multifractal properties of time series. The larger the value, the more uneven the distribution of magnitude fluctuations in the sequence, and the higher the naturalness; conversely, if... If so, it is determined to be suspected algorithm-generated data.

[0099] Spectral asymmetric parameters : Characterizes the imbalance in the distribution of large fluctuations and small fluctuations.

[0100] peak position :Right now When taking the maximum value The value represents the average randomness of the sequence. The final constructed micro-naturalness vector is:

[0101] ;

[0102] This vector, serving as a physical fingerprint to measure the biological naturalness of the data, will be fed into a subsequent gated graph neural network to modulate the attention weights of the edges.

[0103] See attached document Figure 6 , Figure 6 This is a schematic diagram of the reasoning process of a quality-fractal dual-gated graph attention network according to an embodiment of the present invention. The graph analysis module constructs a dynamic supply chain graph based on the macroscopic and microscopic features and data quality coefficients extracted in the preceding steps. This module uses a graph attention network (GAT) as its skeleton, and its core improvement lies in the introduction of a gated sub-network based on fractal features. This network structure allows the model to dynamically adjust the weights of information flow according to the microscopic dynamic properties of edges when performing neighborhood aggregation, thereby suppressing the contamination of node embedding representations by anomalous data at the algorithmic level.

[0104] 5501, Graph Analysis Module Constructs Dynamic Attribute Graph Structure .in, For enterprise node set, This is the set of interactive edges. For each node... The graph analysis module utilizes the event type vectors generated during the data preprocessing stage. and the company's basic business attributes vector (including registered capital, years of establishment, and company size index). The features are concatenated and mapped to a fully connected layer. , to obtain the initial node feature vector .

[0105] For each edge The graph analysis module aggregates the dynamic parameters output by the aforementioned feature extraction module to construct a multidimensional edge attribute vector. The edge attribute vector is constructed as follows:

[0106] ;

[0107] in, This is a macroscopic rhythm vector extracted based on the Hawkes process. This is a micro-naturalness vector extracted based on MF-DFA. This represents the vector concatenation operation. Let... The dimension is Simultaneously, the system reads the data quality confidence coefficient corresponding to that edge. (scalar) , which are fixed weight parameters used as external inputs.

[0108] S502, the graph analysis module calculates dual gating coefficients based on quality-naturalness. This step aims to learn the edges through the neural network component. The probability of authenticity. The graph analysis module is configured with a two-layer perceptron (MLP). As a naturalness-gated unit. Dual gating coefficient. The calculation formula is as follows:

[0109] ;

[0110] in, The quality attenuation term introduced for data augmentation directly applies to the gate value for multiplicative weighting. Using the Sigmoid activation function, the output is constrained to (0, 1). interval; and This represents the learnable weight matrix for the gating unit. These parameters are updated during model training through backpropagation using the final risk prediction loss function, enabling the model to automatically learn to identify anomalous links with low fractal dimensions.

[0111] S503, the graph analysis module performs attention coefficient calculations incorporating macroscopic rhythmic features. In the... In the layered network (total) (layer), the input is a set of node features .node For neighboring nodes Nonnormalized attention score The calculation is as follows:

[0112] ;

[0113] in, The node feature transformation matrix; This is the macro-rhythmic feature transformation matrix, used to map edge features to the same semantic space as node features; This is the attention parameter vector; This indicates vector concatenation.

[0114] The negative slope coefficient of LeakyReLU is set to 0.2.

[0115] Subsequently, using dual gating coefficients The attention coefficients are weighted and Softmax normalized to obtain the final attention weights. :

[0116] ;

[0117] This formula shows that if the microscopic naturalness of an edge is low (leading to...), or poor data quality () If the similarity of features is such that the weight of the edge during aggregation is forcibly decayed, the numerical suppression of false trading signals will be achieved.

[0118] S504, the graph analysis module performs feature aggregation and state updates based on the modulated attention weights. A multi-head attention mechanism is employed to stabilize the training process. The number of heads is set to [number missing]. For the intermediate layer ( ), using a splicing operation:

[0119] ;

[0120] For the output layer ( The averaging operation is used to obtain the final node embedding vector. :

[0121] ;

[0122] The final output node embedding vector It will serve as the direct input for subsequent risk classifiers.

[0123] See attached document Figure 7 , Figure 7 This is a schematic diagram of a multi-dimensional risk assessment and dynamic hierarchical early warning process according to an embodiment of the present invention. The early warning module is connected to the output of the graph analysis module. Its core function is to use a supervised learning mechanism to embed abstract high-dimensional nodes into vectors and map them into specific business risk probabilities. Combined with the physical gating coefficients generated in the preceding steps, it achieves a decoupled assessment of "data credibility" and "operational robustness".

[0124] S601, the early warning module is constructed based on a multilayer perceptron (MLP) A risk classification network. The input data for this network is the node embedding vectors output by the graph analysis module. (in (The node embedding dimension is 128 in this embodiment). The classification network contains one hidden layer and one output layer. First, a non-linear feature transformation is performed through the hidden layer:

[0125] ;

[0126] in, The hidden layer weight matrix is... This is a bias term. Subsequently, it is mapped to a risk class through the output layer.

[0127] We separate the risk space and use the Softmax function to calculate the probability distribution of each risk category:

[0128] ;

[0129] in, For the predicted probability vector, This embodiment defines the number of risk categories. The category labels correspond to: (Regular customers) , (Financial default risk) , (Trade background fraud) . These are the output layer weights.

[0130] S602, the early warning module trains the model based on the Focal Loss function. The training sample set consists of historical customer data from the supply chain finance platform, and its true labels... This data is derived from past audit reports, bank credit records, and legal proceedings. Given the risk sample... It accounts for a very small percentage of the total data (usually less than 5%). To avoid the model biasing towards the majority class Collapse, using Focal Loss as the objective function:

[0131] ;

[0132] in, For the current training batch (Batch) The number of samples; For the sample Authentic labels (one-hot format) ; The focus parameter is set to 2.0. The category balancing weights are inversely proportional to the frequency of each category in the total dataset. The specific calculation formula is as follows: ,in The total number of samples in each class.

[0133] During training, the early warning module minimizes the total loss using the Adam optimizer. The key is that the calculated gradient not only updates... It also propagates backward to the weights of the preceding graph attention network through a chain rule. and the weights of the gated generative network This end-to-end training mechanism enables the gating unit to automatically adjust its discrimination criteria for micro-fractal features based on the final risk classification results.

[0134] S603, the early warning module executes a dynamic hierarchical early warning strategy based on a dual "probability-gating" indicator. The technical principle behind this step lies in utilizing the average gating coefficient. As an independent measure of data authenticity, it prevents the model from misjudging low-risk results calculated based on fabricated data. First, the computation nodes... The average gating score of all its first-order neighbors :

[0135] ;

[0136] This metric reflects the average physical naturalness of the node's associated transaction data within the topology. Subsequently, the early warning module uses the predicted probability vector... maximum value and their corresponding categories , combined Determine the warning level. The determination logic is as follows:

[0137] Level 1 Warning (Data Integrity Blockage): If If the probability prediction result is ignored, a first-level warning signal will be output directly. The threshold for determining fraud is set by maximizing the recall rate while maintaining a fixed false positive rate (FPR < 1%) on the validation set; in this embodiment, it is set to 0.3. This state indicates that the company's transaction records do not possess the fractal characteristics of a natural person and show signs of systematic fraud generated by the algorithm.

[0138] Level 2 Warning (High Operational Risk): If and (Financial default risk), at the same time .in This is the confidence threshold, typically set to 0.75. This status indicates that the data is accurate, but based on business rhythm characteristics, the risk of a broken capital chain is relatively high.

[0139] Level 3 Warning (Attention Category): If and Between [0.5, Between, or The results fluctuated across multiple assessments. This state indicates instability in the company's operations.

[0140] Normal state: If and .

[0141] Finally, the early warning module outputs an alert level, risk category, and key attribution indicators. Value, Hawkes process branch ratio Structured signals.

[0142] To more intuitively illustrate the operating mechanism of this invention in actual supply chain finance risk control scenarios, the following explanation is based on a specific case of corporate fraud identification.

[0143] Application scenario background:

[0144] A commercial bank's supply chain finance platform connected with an electronic component distributor (hereinafter referred to as "Target Company A"). The company applied for a financing of 5 million yuan based on accounts receivable. Its submitted transaction records showed that in the past three months, the company had engaged in frequent small-amount purchase transactions with a downstream technology company. Its financial statements showed sufficient cash flow, seemingly meeting the credit approval criteria.

[0145] System processing flow:

[0146] Data access and preprocessing (S201-S203):

[0147] The system reads the raw interaction logs of target company A. Raw sequence length. It is slightly below the convergence threshold of 1000.

[0148] Perform Adaptive Timing Quantization (ATQ) Calculate the average operation interval Seconds, quantization window Second.

[0149] After filtering out network jitter, the effective event sequence length is normalized to: .

[0150] Maximum entropy bootstrapping is performed: Due to insufficient data, the system initiates MEB enhancement to expand the sequence to... 1200. The data quality confidence coefficient was calculated. .

[0151] Macroscopic dynamic modeling (S301-S303) The enhanced sequence was fitted using the Hawkes process.

[0152] The solution yields the parameter set: baseline intensity. Branch ratio attenuation rate .

[0153] analyze: This indicates a supercritical state, where trading exhibits extremely strong self-initiative (i.e., a single trade instantly triggers multiple trades). This is usually inconsistent with the decision-making cycle of B2B bulk transactions, suggesting the possibility of automated order placement.

[0154] Microscopic naturalness fingerprint extraction (S401-S405) :

[0155] Perform MF-DFA analysis on the sequence.

[0156] Calculating multifractal spectral width .

[0157] Analysis: This value is significantly lower than the typical threshold for natural human manipulation (usually >0.2). The spectrum exhibits an extremely narrow parabola, indicating that the fluctuations in time intervals are extremely uniform and lack long-range correlation, consistent with the pseudo-random characteristics generated by a "timed script".

[0158] Graph Network Reasoning and Gating (S501-S504): In the constructed supply chain graph, the edges (A, B) between target company A and downstream technology companies are defined. Input graph analysis module.

[0159] Naturalness Gated Unit Input The output sigmoid activation value is close to 0.1.

[0160] Combining confidence level The final calculated dual-gating coefficient .

[0161] Result: During the GAT aggregation process, the edge (A, B) Attention weights Forced to decay to an extremely low level, the suspected fraudulent transaction link was effectively "cut off" in terms of information transmission.

[0162] Hierarchical early warning output (S601-S603): Node embedding vectors received by the early warning module. It mainly consists of static attributes of the enterprise (because the dynamic transaction link has been blocked).

[0163] Calculate the average gate score .

[0164] Judgment logic: because (Threshold 0.3) The system directly ignores the output of the financial classifier and triggers "Level 1 warning (data integrity block)".

[0165] Final report: "Algorithm-generated non-natural transaction flows detected. It is recommended to deny credit and initiate on-site audit."

[0166] Upon on-site verification by risk control personnel, it was confirmed that target company A did indeed use Python scripts to generate fake order data in batches at night in an attempt to fraudulently obtain financing. This invention successfully achieved precise interception in the event of falsified financial data.

[0167] Experimental setup

[0168] Data source: Supply chain finance business data of a major bank from 2021 to 2023, including 50,000 enterprise nodes and 200,000 transaction edges.

[0169] Label distribution: Normal enterprises account for 90%, financial defaults account for 5%, and fraud and forgery account for 5%.

[0170] Comparison with the baseline model:

[0171] XGBoost: A traditional machine learning model based on manual feature engineering.

[0172] GCN: Standard Graph Convolutional Neural Network, without attention mechanism.

[0173] GAT: A standard graph attention network with no physical gating mechanism.

[0174] This invention introduces an improved model of Hawkes process and MF-DFA gating.

[0175] Experimental Results Analysis

[0176] Discrimination verification of multifractal spectrum

[0177] See attached document Figure 8 , Figure 8 It is a multifractal spectrum of normal transaction records and fake transaction records. Comparison chart.

[0178] Illustration: The horizontal axis represents the singularity index. The vertical axis represents the multifractal spectrum. .

[0179] Results analysis:

[0180] The solid line (normal trading) exhibits a typical wide-mouth parabolic shape, with a wide spectrum. This reflects the complexity and multi-scale fluctuation characteristics of human behavior.

[0181] The dashed line (fake transaction) appears as an extremely narrow, spike-like shape with a wide spectral width. And peak position A left shift indicates that the data lacks inherent dynamic complexity.

[0182] The results directly demonstrate that the microscopic naturalness fingerprints extracted by steps S401-S405 of this invention have extremely strong physical separability.

[0183] Comparison of risk classification performance.

[0184] The test results are shown in Table 1, and the corresponding comparison charts are shown below. Figures 8 to 10 As shown.

[0185] The table below shows the performance metrics (%) of different models on the test set.

[0186] Model Accuracy Default Recall Fraud Recall F1-Score (Macro) XGBoost 88.5 65.2 42.1 68.4 GCN 91.2 72.4 55.6 75.8 GAT 92.8 76.5 58.9 78.2 This invention 96.4 84.3 91.5 89.6

[0187] Results analysis:

[0188] While the traditional GAT model performs reasonably well in overall accuracy, its fraud recall rate is only 58.9%. This is because the traditional GAT model mistakenly identifies high-frequency fake interactions as close business collaborations, thus allocating incorrect attention weights.

[0189] The model of this invention significantly improves the fraud recall rate to 91.5%. This is due to the dual gating mechanism, which effectively identifies and suppresses forged links, preventing the spread of false credit in the network.

[0190] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A dynamic early warning method for financial risk based on machine learning, characterized in that, Includes the following steps: Obtain the transaction time series data and basic business registration attribute data of the target company; The Hawkes process is used to perform dynamic modeling on the transaction time series data to extract macro-rhythmic feature vectors that characterize the self-incentive properties of corporate operational behavior; The micro-fluctuation structure of the transaction time series data is analyzed using a multifractal detrending fluctuation analysis algorithm to extract a micro-naturalness vector representing the biological naturalness of the data. A dynamic attribute graph structure is constructed, wherein node features are constructed based on the basic industrial and commercial attribute data, and edge attributes are fused with the macro-rhythm feature vector and the micro-naturalness vector; The dynamic attribute graph structure is input into a graph attention network containing a naturalness gating unit. The naturalness gating unit generates dual gating coefficients based on edge attributes, and the dual gating coefficients are used to modulate the attention weights. Enterprise node embedding vectors are generated through feature aggregation. The enterprise node is embedded into the vector input risk classification network, and the classification judgment is performed in combination with the dual gating coefficient to output the financial risk warning level.

2. The machine learning-based dynamic early warning method for financial risk according to claim 1, characterized in that, The method of using Hawkes processes to perform dynamic modeling on the transaction time series data and extracting macro-rhythmic feature vectors representing the self-incentivizing characteristics of corporate operational behavior specifically includes: A conditional strength function model of a univariate Hawkes process is constructed, wherein the conditional strength function includes a baseline strength and a kernel function based on historical event excitation; The parameters of the conditional intensity function model are solved using the maximum likelihood estimation method to obtain the baseline intensity parameters, branch ratio parameters, and attenuation rate parameters. The average response delay and expected cluster size are calculated based on the solved parameters. The baseline intensity parameter, branch ratio parameter, decay rate parameter, average response delay and expected cluster size are combined to form the macroscopic rhythm feature vector.

3. The machine learning-based dynamic early warning method for financial risk according to claim 1, characterized in that, The analysis of the micro-fluctuation structure of the trading time series data using the multifractal detrending fluctuation analysis algorithm, and the extraction of a micro-naturalness vector representing the biological naturalness of the data, specifically includes: The time interval sequence of the transaction time series data is subjected to mean centering and cumulative deviation calculation to obtain the cumulative deviation sequence. The cumulative deviation sequence is segmented at multiple scales, and the mean square fluctuation function is calculated after eliminating local trends by using polynomial fitting. The generalized Hurst exponent is calculated based on the mean square fluctuation function, and the multifractal spectrum is calculated through Legendre transformation. The spectral width, spectral asymmetry parameter, and peak position parameter of the multifractal spectrum are extracted and combined to form the microscopic naturalness vector.

4. The machine learning-based dynamic early warning method for financial risk according to claim 1, characterized in that, The construction of the dynamic attribute graph structure specifically includes: The target enterprise is treated as a graph node, and the transaction relationships between enterprises are treated as interaction edges; The basic business attribute vector of the enterprise is concatenated with the event type vector and mapped through a fully connected layer to obtain the initial node feature vector; For each interaction edge, the macro-rhythm feature vector and the micro-naturalness vector are concatenated, and the data quality confidence coefficient corresponding to the interaction edge is obtained, which together form a multi-dimensional edge attribute vector.

5. The machine learning-based dynamic early warning method for financial risk according to claim 1, characterized in that, The naturalness gating unit generates dual gating coefficients based on edge attributes, and the specific calculation formula is as follows: Feature transformation of the micro-naturalness vector of the interaction edge is performed using a multilayer perceptron; The Sigmoid activation function is used to map the transformed features to a normalized interval. The mapped result is multiplied by the data quality confidence coefficient to obtain the dual gating coefficient; The dual gating coefficient is used to characterize the probability of authenticity of the transaction data corresponding to the interaction edge.

6. The machine learning-based dynamic early warning method for financial risks according to claim 1, characterized in that, The modulation of attention weights using the dual gating coefficients specifically includes: Calculate the nonnormalized attention score between a node and its neighboring nodes; The non-normalized attention score is weighted and Softmax normalized using the dual gating coefficients to obtain the final attention weights. Specifically, when the dual gating coefficient approaches zero, the corresponding attention weight is forcibly decayed to suppress the information transmission of interaction edges with low micro-naturalness or low data quality during the feature aggregation process.

7. The machine learning-based dynamic early warning method for financial risk according to claim 1, characterized in that, The risk classification network uses Focal Loss as the loss function during training. The training process simultaneously updates the weight parameters of the risk classification network, the graph attention network, and the naturalness gating unit through the backpropagation algorithm, so that the naturalness gating unit adaptively adjusts the discrimination criteria of the micro naturalness vector according to the final risk classification result.

8. The machine learning-based dynamic early warning method for financial risk according to claim 1, characterized in that, The step of combining the dual gating coefficients to perform graded judgment and output financial risk warning level specifically includes: The average gating score is obtained by averaging the dual gating coefficients of the target node and all its first-order neighbor nodes. Obtain the maximum value of the predicted probability vector output by the risk classification network and its corresponding risk category; If the average gating score is less than the preset fraud detection threshold, a first-level warning signal indicating data fraud will be output. If the average gating score is greater than or equal to the fraud determination threshold, and the predicted risk category is financial default risk and the predicted probability is greater than the confidence threshold, then a secondary early warning signal indicating operational risk will be output. If the average gating score is greater than or equal to the fraud determination threshold and the predicted probability is in the non-confidence range, then a level three warning signal indicating operational instability will be output.

9. A machine learning-based dynamic early warning system for financial risks, used to implement the machine learning-based dynamic early warning method for financial risks as described in any one of claims 1-8, characterized in that, The feature extraction module is used to acquire the transaction time series data and basic business attribute data of the target enterprise, use Hawkes process to perform dynamic modeling on the transaction time series data to extract macro rhythm feature vectors, and use multifractal detrending fluctuation analysis algorithm to analyze the micro fluctuation structure of the transaction time series data to extract micro naturalness vectors. The graph analysis module is used to construct a dynamic attribute graph structure, wherein node features are constructed based on the basic industrial and commercial attribute data, and edge attributes are fused with the macro-rhythm feature vector and the micro-naturalness vector; it is also used to input the dynamic attribute graph structure into a graph attention network containing a naturalness gating unit, use the naturalness gating unit to generate dual gating coefficients based on edge attributes, and use the dual gating coefficients to modulate the attention weights, and generate enterprise node embedding vectors through feature aggregation; The early warning module is used to embed the enterprise node into the vector input risk classification network, combine it with the dual gating coefficient to perform hierarchical judgment, and output the financial risk early warning level.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 8.

Images