Digital Financial Securities Fraud Identification and Risk Control Decision-Making Methods Integrating Knowledge Graphs
By constructing behavioral graph units in the securities market and matching them with a risk pattern library, the problem of traditional technologies struggling to identify complex fraudulent behaviors has been solved, enabling efficient and accurate risk monitoring and decision-making.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-24
- Publication Date
- 2026-05-26
AI Technical Summary
Traditional securities risk monitoring technologies struggle to identify complex fraudulent activities, and existing machine learning models suffer from long iteration cycles and slow feedback when identifying new risk patterns, making it impossible to achieve rapid and accurate incremental optimization.
By integrating knowledge graphs, behavioral graph units of the securities market are constructed, which dynamically connect behavioral narratives and match them with a pre-set risk model library to calculate risk levels and generate disposal instructions.
It improves the accuracy and efficiency of risk monitoring, reduces false alarm rates, provides a transparent chain of evidence, and enables rapid and accurate risk identification and decision-making.
Smart Images
Figure CN122089453A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of financial technology and risk management technology, specifically to a digital financial securities fraud identification and risk control decision-making method that integrates knowledge graphs. Background Technology
[0002] The efficient, fair, and stable operation of the securities market depends on the effective monitoring and identification of illegal and irregular activities such as market manipulation, insider trading, and fraudulent issuance. Traditional securities risk monitoring technologies mainly rely on two paradigms: one is an early warning system based on statistical thresholds and fixed rules, and the other is a data-driven model based on machine learning.
[0003] Systems based on statistical thresholds and rules issue warnings by setting static thresholds for indicators such as trading volume, price volatility, and account correlation. While this method is simple and direct, it relies on isolated data points or simple correlations. It is difficult to depict complex trading behaviors by multiple related entities that appear compliant on the surface but are manipulative as a whole (e.g., coordinated manipulation across accounts, time periods, and information dissemination). Furthermore, it is difficult to adapt to constantly evolving violations, and maintaining and updating the rule base is costly and prone to generating a large number of false alarms.
[0004] Machine learning-based models, especially deep learning models, analyze massive amounts of historical data to find risk patterns. While these methods have a certain ability to identify risk patterns, the reliability and acceptability of their conclusions are controversial in the field of financial regulation, which emphasizes procedural justice and the chain of evidence. When it is necessary to correct specific false alarm cases or incorporate the identification of new risk patterns, it is usually necessary to re-label a large amount of data and train the model. The iteration cycle is long and the feedback loop is sluggish, making it impossible to achieve rapid and accurate incremental optimization. Summary of the Invention
[0005] This invention addresses the technical problems existing in the prior art by providing a digital financial securities fraud identification and risk control decision-making method that integrates knowledge graphs.
[0006] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs, comprising the following steps: S1. Obtain multi-source heterogeneous behavioral data from the securities market, perform structured analysis on the behavioral data, and generate behavioral graph units composed of events and relationships; S2. Dynamically connect multiple behavioral graph units according to time and logical rules to construct a continuous behavioral narrative; S3. Match the behavioral narrative with the risk patterns in the pre-set risk pattern library, determine the risk level based on the matching results, and generate corresponding disposal instructions.
[0007] In a preferred embodiment, in step S1, multiple heterogeneous data source channels are accessed, including a transaction and order data interface of a securities exchange, a data interface of a company information disclosure platform, and a query interface of a database of fund and account association relationships. Receive and parse raw data streams from various data source channels. For transaction data streams, parse the account code, security code, order price, quantity, time, and transaction marker fields. For information disclosure data streams, parse the company code, announcement type, release time, and key content summary fields. For relationship data streams, parse the natural person identifier, legal entity identifier, and shareholding or control relationship fields. Identify and extract key entities and behavior tags. Based on the parsed fields, identify the core entities involved in each data record and the behavior type represented by the record, and assign corresponding entity identifiers and behavior type tags to each record. The time information in all data records is converted into a unified time base, and the data records of behavior tags from different data source channels are sorted into a raw behavior event sequence according to the order of timestamps. The original sequence of behavioral events is used as the final output and then processed. Each record in this data stream contains a timestamp in a uniform format, at least one entity identifier, at least one behavior type label, and other relevant attribute fields. From the original sequence of behavioral events, at least one type of entity is identified and extracted, including trading accounts, securities products, and key related parties. At least one type of atomic event is extracted that is participated in or triggered by the entity, including order submission, order execution, trading during a specific time period, and related fund transfer. Each atomic event is defined as a behavioral graph unit, which includes at least the event type, timestamp, entity identifier involved, and attribute data of the event itself.
[0008] In a preferred embodiment, in step S2, multiple behavioral graph units are received, and using a first preset duration as a sliding window, all behavioral graph units whose time falls within the same window and involve at least one identical entity are aggregated into a set of units to be associated. For each set of units to be associated, logical relationships are established between the units contained therein based on business logic rules to form an initial narrative fragment; The business logic rules include: the counterparty relationship in transaction behavior, and the intention to cancel consecutive orders. Figure 1 The correlation between consistency, capital flow and transaction behavior is analyzed. Taking a single entity or group of entities as the core, multiple initial narrative fragments that are consecutive in time and related through the same entity are spliced together to output a complete behavioral narrative.
[0009] In a preferred embodiment, in step S3, a risk pattern is read from the risk pattern library, the risk pattern defining the entity roles, key event type sequence and at least one logical relationship that must be satisfied between each event necessary to constitute a typical risk behavior. The entity roles, event types, and logical relationships between events involved in the behavioral narrative are compared item by item with the elements defined in the current risk model. The item-by-item comparison includes the following steps: Read the set of entity roles, event type sequences, and logical relationship sets extracted from the behavioral narrative, and simultaneously read the required entity roles, key event sequences, and logical relationship requirements defined in the current risk model; create an initially empty set of element comparison results. For each required entity role defined in the risk model, search the set of entity roles in the behavioral narrative to see if there are any entities that meet the requirements of the role type and quantity. If there are entities that fully match, generate a fully matched result; if they partially match, generate a partially matched result; if they do not match, generate a non-match result. Add the generated comparison results to the feature comparison result set. In the continuous event flow of the behavioral narrative, locate the first event that matches the current script event type, determine whether the order in which the event occurs in the narrative is consistent with the relative order defined in the script, and whether the entity characters involved in it meet the matching relationship; If both the order and role match, an event matching result is generated. If only the event type matches but the order or role does not match, a partial matching result is generated. If no matching event is found, a non-matching result is generated. The generated comparison result is then added to the feature comparison result set. In the behavioral narrative, check whether there is actually a causal relationship edge between the two specific events involved in the relationship. If there is and the semantics are completely consistent, a relationship matching result is generated. If there is a relationship but the semantic strength or type is not completely consistent, a partial matching result is generated. If the relationship edge does not exist, a non-matching result is generated. The generated comparison result is added to the element comparison result set. Based on the results of the item-by-item comparison, each compared element is assigned a predefined score according to its comparison result. The scores of all assigned elements are summed to obtain a total cumulative score. The total cumulative score is divided by the theoretical maximum total score of all defined elements of the risk model in a perfect match state to obtain a normalized ratio value. The normalized ratio value is converted into a standard score and output as the final matching score. The matching score is compared with a preset first matching threshold. If the matching score is greater than or equal to the first matching threshold, it is determined that the match is successful and the risk pattern type and matching score are recorded. Otherwise, it is determined that the match is not successful. Based on the matching results, the risk pattern type and corresponding matching score of the successfully matched individuals are obtained as basic risk factors. At least one enhanced risk factor is extracted from the behavioral narratives of the successfully matched individuals. The acquisition of the enhanced risk factor includes the following steps: Calculate the behavioral intensity index of key events in this behavioral narrative; Check the historical risk records of participating entities to obtain their historical number of violations and whether they are currently on a list of key monitoring entities; The basic risk factor and at least one enhanced risk factor are weighted and fused to calculate the comprehensive risk value of the behavioral narrative. The calculated comprehensive risk value and a preset risk level threshold sequence arranged in ascending order of value are obtained. Starting from the lowest threshold in the threshold sequence, the comprehensive risk value is compared with each threshold in turn. When the comprehensive risk value is less than or equal to the currently compared threshold, the risk level corresponding to the current threshold is determined as the risk level of the behavioral narrative. If the comprehensive risk value is greater than all the thresholds in the threshold sequence, its risk level is determined as the highest risk level. Based on the determined risk level, the corresponding handling instructions are retrieved and generated from the pre-generated handling action mapping table. The handling instructions include: generating a risk warning report, pushing the case to a specific level of manual review queue, and implementing automatic transaction restrictions on the relevant accounts.
[0010] The beneficial effects of this invention are as follows: By comparing behavioral data with risk patterns and calculating the degree of matching, this invention enables risk judgment conclusions to be traced back to specific entity behaviors, event sequences, and logical connections, providing a transparent chain of evidence and enhancing the credibility of monitoring results in risk decision-making and supervision. Through behavioral graphs, it is possible to identify behavioral sequences that conform to risk patterns but are compliant, thereby reducing false alarm rates. By using basic matching degree, behavioral intensity, and historical credit, a comprehensive risk value is calculated, and the risk level is automatically determined. Based on the risk level, it can automatically trigger graded disposal instructions of different intensities, improving the efficiency and accuracy of regulatory response. Attached Figure Description
[0011] Figure 1 This is a flowchart of the method of the present invention. Detailed Implementation
[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0013] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.
[0014] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.
[0015] like Figure 1 This embodiment provides a digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs, including the following steps: S1. Obtain multi-source heterogeneous behavioral data from the securities market, perform structured analysis on the behavioral data, and generate behavioral graph units composed of events and relationships; Furthermore, in S1, multiple heterogeneous data source channels are accessed, including the trading and entrustment data interface of the securities exchange, the data interface of the company's information disclosure platform, and the query interface of the fund and account association database. Receive and parse raw data streams from various data source channels. For transaction data streams, parse the account code, security code, order price, quantity, time, and transaction marker fields. For information disclosure data streams, parse the company code, announcement type, release time, and key content summary fields. For relationship data streams, parse the natural person identifier, legal entity identifier, and shareholding or control relationship fields. Identify and extract key entities and behavioral tags. Based on the parsed fields, identify the core entities (such as trading accounts and listed companies) involved in each data record and the behavioral type (such as buy orders, financial report releases, and changes in control) represented by the record, and assign corresponding entity identifiers and behavioral type tags to each record. The time information in all data records is converted into a unified time base, and the data records of behavior tags from different data source channels are sorted into a raw behavior event sequence according to the order of timestamps. The original sequence of behavioral events is used as the final output and then processed. Each record in this data stream contains a timestamp in a uniform format, at least one entity identifier, at least one behavior type label, and other relevant attribute fields. From the original sequence of behavioral events, at least one type of entity is identified and extracted, including trading accounts, securities products, and key related parties. At least one type of atomic event is extracted that is participated in or triggered by the entity, including order submission, order execution, trading during a specific time period, and related fund transfer. Each atomic event is defined as a behavioral graph unit, which includes at least the event type, timestamp, entity identifier involved, and attribute data of the event itself.
[0016] S2. Dynamically connect multiple behavioral graph units according to time and logical rules to construct a continuous behavioral narrative; Furthermore, in S2, multiple behavior graph units are received, and with a first preset duration as a sliding window, all behavior graph units whose time falls within the same window and involve at least one identical entity are aggregated into a set of units to be associated. For each set of units to be associated, logical relationships are established between the units contained therein based on business logic rules to form an initial narrative fragment; The business logic rules include: the counterparty relationship in transaction behavior, and the intention to cancel consecutive orders. Figure 1 The correlation between consistency, capital flow and transaction behavior is analyzed. Taking a single entity or group of entities as the core, multiple initial narrative fragments that are consecutive in time and related through the same entity are spliced together to output a complete behavioral narrative.
[0017] S3. Match the behavioral narrative with the risk patterns in the pre-set risk pattern library, determine the risk level based on the matching results, and generate corresponding disposal instructions.
[0018] Furthermore, in S3, a risk pattern is read from the risk pattern library. The risk pattern defines the entity roles, key event type sequences, and at least one logical relationship that must be satisfied between each event to constitute a typical risk behavior. The entity roles, event types, and logical relationships between events involved in the behavioral narrative are compared item by item with the elements defined in the current risk model. The item-by-item comparison includes the following steps: Read the set of entity roles, event type sequences, and logical relationship sets extracted from the behavioral narrative, and simultaneously read the required entity roles, key event sequences, and logical relationship requirements defined in the current risk model; create an initially empty set of element comparison results. For each required entity role defined in the risk model, search the entity role set in the behavioral narrative to see if there are entities that meet the type and quantity requirements of that role. If there are entities that fully match, generate a fully matched result. If they partially match (e.g., the type matches but the quantity is insufficient), generate a partially matched result. If they do not match, generate a non-match result. Add the generated comparison results (including role identifier and matching status) to the feature comparison result set. In the continuous event flow of the behavioral narrative, locate the first event that matches the current script event type, determine whether the order in which the event occurs in the narrative is consistent with the relative order defined in the script, and whether the entity characters involved in it meet the matching relationship; If both the order and role match, an event matching result is generated. If only the event type matches but the order or role does not match, a partial matching result is generated. If no matching event is found, a non-matching result is generated. The generated comparison result is then added to the feature comparison result set. In the behavioral narrative, check whether there is actually a causal relationship between the two specific events involved in the relationship. If there is, and the semantics are completely consistent, a relationship matching result is generated. If there is a relationship, but the semantic strength or type is not completely consistent, a partial matching result is generated. If there is no relationship, a non-matching result is generated. The generated comparison result (including relationship identifier and matching status) is added to the element comparison result set. Based on the results of the item-by-item comparison, each compared element is assigned a predefined score according to its comparison result. The scores of all assigned elements are summed to obtain a total cumulative score. The total cumulative score is divided by the theoretical maximum total score of all defined elements of the risk model in a perfect match state to obtain a normalized ratio value. The normalized ratio value is converted into a standard score and output as the final matching score. The matching score is compared with a preset first matching threshold. If the matching score is greater than or equal to the first matching threshold, it is determined that the match is successful and the risk pattern type and matching score are recorded. Otherwise, it is determined that the match is not successful. Based on the matching results, the risk pattern type and corresponding matching score of the successfully matched individuals are obtained as basic risk factors. At least one enhanced risk factor is extracted from the behavioral narratives of the successfully matched individuals. The acquisition of the enhanced risk factor includes the following steps: Calculate behavioral intensity indicators (e.g., percentage of market turnover and order cancellation frequency) for key events (such as large transactions and frequent order cancellations) in the behavioral narrative. The behavioral intensity index is calculated based on the current matched risk pattern type. It determines the key event type for which the intensity index needs to be calculated. For example, if the pattern involves false declarations, the key event is frequent order cancellations; if it involves price manipulation, the key event is large transactions. Based on the determined event type, it extracts all event sets belonging to that type from the current behavioral narrative and obtains the core attribute data of each event (for transaction events, it extracts the transaction amount; for order cancellation events, it extracts the cancellation timestamp and the corresponding original order quantity). The basic strength sub-indicators are calculated as follows: For large-volume transaction events, the total transaction amount within the cumulative narrative time window is calculated, and its ratio to the total market transaction amount of the same security product during the same period is calculated; for frequent order cancellation events, the total number of order cancellations within the window is counted, and its ratio to the sum of cancellations and valid transactions is calculated. Then, the strength indicators are normalized and synthesized. Each basic sub-indicator value is compared with the baseline threshold that indicates obvious anomalies. The values are then mapped to a standardized intensity score range using a piecewise function. If there are multiple sub-indicators, their standardized scores are weighted and summed according to preset weights to generate the final behavioral intensity index. This index is output as a standardized numerical result for subsequent calculation of the comprehensive risk value.
[0019] Check the historical risk records of participating entities to obtain their historical number of violations and whether they are currently on a list of key monitoring entities; The basic risk factor and at least one enhanced risk factor are weighted and fused to calculate the comprehensive risk value of the behavioral narrative. The calculated comprehensive risk value and a preset risk level threshold sequence arranged in ascending order of value are obtained. Starting from the lowest threshold in the threshold sequence, the comprehensive risk value is compared with each threshold in turn. When the comprehensive risk value is less than or equal to the currently compared threshold, the risk level corresponding to the current threshold is determined as the risk level of the behavioral narrative. If the comprehensive risk value is greater than all the thresholds in the threshold sequence, its risk level is determined as the highest risk level. Based on the determined risk level, the corresponding handling instructions are retrieved and generated from the pre-generated handling action mapping table. The handling instructions include: generating a risk warning report, pushing the case to a specific level of manual review queue, and implementing automatic transaction restrictions on the relevant accounts.
[0020] It should be noted that the pre-generated action mapping table establishes a deterministic mapping relationship between different risk levels and executable action instructions. The generation of this table first defines the core action principles and initial instruction set corresponding to each risk level based on securities regulatory regulations, internal risk control policies and business logic, fills in specific execution parameters for each instruction to form an operable instruction package, and then tests and calibrates by analyzing historical risk cases or running simulations to optimize the accuracy and effectiveness of the mapping relationship. Finally, the determined multiple sets of correspondences are stored and managed in a standardized data structure to form an action mapping table that the system can directly call. The preset first matching threshold is a critical score used to determine whether a behavioral narrative and a risk pattern constitute a valid match. Only when the calculated matching score reaches or exceeds this threshold is the behavioral narrative considered to be a typical risky behavior described by the risk pattern, thereby triggering the subsequent risk assessment process. Otherwise, it is considered a mismatch, and the narrative will not be marked as a potential risk event.
[0021] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.
[0022] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0023] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0024] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0025] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.
[0026] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.
[0027] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.
Claims
1. A digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs, characterized in that, Includes the following steps: S1. Obtain multi-source heterogeneous behavioral data from the securities market, perform structured analysis on the behavioral data, and generate behavioral graph units composed of events and relationships; S2. Dynamically connect multiple behavioral graph units according to time and logical rules to construct a continuous behavioral narrative; S3. Match the behavioral narrative with the risk patterns in the pre-set risk pattern library, determine the risk level based on the matching results, and generate corresponding disposal instructions.
2. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 1, characterized in that, In S1, multiple heterogeneous data source channels are accessed, including the transaction and order data interface of the securities exchange, the data interface of the company's information disclosure platform, and the query interface of the database of fund and account association. Receive and parse raw data streams from various data source channels. For transaction data streams, parse the account code, security code, order price, quantity, time, and transaction marker fields. For information disclosure data streams, parse the company code, announcement type, release time, and key content summary fields. For relationship data streams, parse the natural person identifier, legal entity identifier, and shareholding or control relationship fields. Identify and extract key entities and behavior tags. Based on the parsed fields, identify the core entities involved in each data record and the behavior type represented by the record, and assign corresponding entity identifiers and behavior type tags to each record. The time information in all data records is converted into a unified time base, and the data records of behavior tags from different data source channels are sorted into a raw behavior event sequence according to the order of timestamps.
3. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 2, characterized in that, The original sequence of behavioral events is used as the final output and then processed. Each record in this data stream contains a timestamp in a uniform format, at least one entity identifier, at least one behavior type label, and other relevant attribute fields. From the original sequence of behavioral events, identify and extract at least one type of entity, including trading accounts, securities products, and key related parties, and extract at least one type of atomic event that is participated in or triggered by the entity, including order submission, order execution, trading during a specific period, and related fund transfer. Define each atomic event as a behavioral graph unit, which includes at least the event type, timestamp, entity identifier involved, and attribute data of the event itself.
4. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 1, characterized in that, In S2, multiple behavior graph units are received, and using a first preset duration as a sliding window, all behavior graph units whose time falls within the same window and involve at least one identical entity are aggregated into a set of units to be associated. For each set of units to be associated, logical relationships are established between the units contained therein based on business logic rules to form an initial narrative fragment; The business logic rules include: the counterparty relationship of transaction behaviors, the consistency of intent in continuous order declaration and cancellation, and the correlation between fund flow and transaction behavior. Taking a single entity or group of entities as the core, multiple initial narrative fragments that are consecutive in time and associated through the same entity are spliced together to output a complete behavioral narrative.
5. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 1, characterized in that, In S3, a risk pattern is read from the risk pattern library. The risk pattern defines the entity roles, key event type sequence and at least one logical relationship that must be satisfied between each event to constitute a typical risk behavior. The entity roles, event types, and logical relationships between events involved in the behavioral narrative are compared item by item with the elements defined in the current risk model.
6. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 5, characterized in that, The item-by-item comparison includes the following steps: Read the set of entity roles, event type sequence, and logical relationship set extracted from the behavioral narrative, and at the same time read the required entity roles, key event sequence, and logical relationship requirements defined in the current risk model; Create an initial empty set of feature comparison results; For each required entity role defined in the risk model, search the set of entity roles in the behavioral narrative to see if there are any entities that meet the requirements of the role type and quantity. If there are entities that fully match, generate a fully matched result; if they partially match, generate a partially matched result; if they do not match, generate a non-match result. Add the generated comparison results to the feature comparison result set. In the continuous event flow of the behavioral narrative, locate the first event that matches the current script event type, determine whether the order in which the event occurs in the narrative is consistent with the relative order defined in the script, and whether the entity characters involved in it meet the matching relationship; If both the order and role match, an event matching result is generated. If only the event type matches but the order or role does not match, a partial matching result is generated. If no matching event is found, a non-matching result is generated. The generated comparison result is then added to the feature comparison result set. In the behavioral narrative, check whether there is actually a causal relationship edge between the two specific events involved in the relationship. If there is, and the semantics are completely consistent, a relationship matching result is generated. If there is a relationship but the semantic strength or type is not completely consistent, a partial matching result is generated. If the relationship edge does not exist, a non-matching result is generated. The generated comparison result is added to the element comparison result set.
7. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 6, characterized in that, The decision-making method is characterized by assigning a predefined score to each compared element based on the comparison results, summing the scores of all elements to obtain a total cumulative score, dividing the total cumulative score by the theoretical maximum total score of all defined elements of the risk model in a perfect match state to obtain a normalized ratio value, and converting the normalized ratio value into a standard score as the final matching score output. The matching score is compared with a preset first matching threshold. If the matching score is greater than or equal to the first matching threshold, it is determined that the match is successful and the risk pattern type and matching score are recorded. Otherwise, it is determined that the match is not successful. Based on the matching results, obtain the risk pattern type and corresponding matching score of the successfully matched risk as the basic risk factor, and extract at least one enhanced risk factor from the behavioral narrative of the successfully matched risk.
8. The digital financial securities fraud identification and risk control decision-making method integrating knowledge graphs according to claim 7, characterized in that, The acquisition of the enhanced risk factor includes the following steps: Calculate the behavioral intensity index of key events in behavioral narratives; Check the historical risk records of participating entities to obtain their historical number of violations and whether they are currently on a list of key monitoring entities; The basic risk factor is weighted and fused with at least one enhanced risk factor to calculate the comprehensive risk value of the behavioral narrative. The calculated comprehensive risk value and a preset risk level threshold sequence arranged in ascending order of value are obtained. Starting from the lowest threshold in the threshold sequence, the comprehensive risk value is compared with each threshold in turn. When the comprehensive risk value is less than or equal to the currently compared threshold, the risk level corresponding to the current threshold is determined as the risk level of the behavioral narrative. If the comprehensive risk value is greater than all thresholds in the threshold sequence, its risk level is determined as the highest risk level. Based on the determined risk level, the corresponding handling instructions are retrieved and generated from the pre-generated handling action mapping table. The handling instructions include: generating a risk warning report, pushing the case to a specific level of manual review queue, and imposing automatic transaction restrictions on the relevant accounts.