Method and apparatus for calculating whether a target behavior has occurred, program product

Abstract

This application discloses a method, apparatus, and program product for calculating whether a target behavior has occurred. The method includes: inputting structured communication data and unstructured text data of a target user into a first model to obtain a communication feature vector output by the first model; performing a first fusion operation on the communication feature vector and the target user's transaction feature vector to obtain a first target feature vector; and calculating whether the target user has committed a target behavior based on the first target feature vector. This application solves the problem in related technologies where relying on single-modal data cannot accurately determine whether a target user has committed a target behavior, thereby achieving the technical effect of accurately judging whether a target user has committed a target behavior.

Description

Technical Field

[0001] This application relates to the field of computers, and more specifically, to a method, apparatus, and program product for calculating whether a target behavior has occurred. Background Technology

[0002] In related technologies, the identification of target behaviors often relies on analysis methods based on a single data source. For example, banks may rely solely on structured features such as abnormal amounts or high-frequency periods in transaction records to build rule engines or traditional machine learning models for risk assessment.

[0003] While the aforementioned methods possess certain identification capabilities within their respective domains, they fail to capture the essential connections between cross-domain collaborative abnormal behaviors. This leads to serious omissions and misjudgments in the identification of high-risk users, resulting in excessive intervention by the risk control system for low-risk users and delayed responses to high-risk users. Ultimately, this causes a severe mismatch in the resources allocated to the events corresponding to the transaction data—wasting the costs of manual review and interception.

[0004] There is currently no effective solution to the above problems in the relevant technologies. Summary of the Invention

[0005] This application provides a method, apparatus, and program product for calculating whether a target behavior has occurred, so as to at least solve the technical problem in the related art that it is impossible to accurately determine whether a target user has performed a target behavior due to reliance on single-modal data.

[0006] According to one aspect of the embodiments of this application, a method for calculating whether a target behavior has occurred is provided, comprising: inputting structured communication data and unstructured text data of a target user into a first model to obtain a communication feature vector output by the first model, wherein the first model includes a first network, a second network, and a third network, the first network and the second network are configured in parallel and there is no direct connection between the first network and the second network, the output end of the first network is connected to the input end of the third network, the output end of the second network is connected to the input end of the third network, the third network is used to fuse a first vector output by the first network based on the structured communication data and a second vector output by the second network based on the unstructured text data to obtain the communication feature vector; performing a first fusion operation on the communication feature vector and the transaction feature vector of the target user to obtain a first target feature vector, wherein the transaction feature vector is a feature vector sent by a first object in encrypted form; and calculating whether the target user has committed a target behavior based on the first target feature vector.

[0007] In an exemplary embodiment, the first network is used to perform normalization and mapping operations on the structured communication data to obtain a first vector. The normalization operation maps the structured communication data to a uniform numerical range with a mean of 0 and a variance of 1 to obtain a third vector. The mapping operation generates the first vector by combining the risk of the structured communication data in the time dimension. The second network is used to perform a first operation on the unstructured text data to obtain a second vector. The first operation includes adding semantic weights to keywords in the unstructured text data based on a target vocabulary, and setting weights for caller ID numbers in the unstructured text data based on the matching degree between the caller ID numbers in the unstructured text data and phone numbers in a suspicious phone number database. The suspicious phone number database stores phone numbers identified as having a risk.

[0008] In an exemplary embodiment, calculating whether the target user has performed a target behavior based on the first target feature vector includes: simultaneously inputting the first target feature vector into a second model and a third model to obtain a first probability output by the second model and a second probability output by the third model, wherein the second model is used to perform linear weighted calculation on the first target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the first probability, and the third model includes multiple decision trees, each decision tree including multiple internal nodes and multiple leaf nodes, each internal node having a preset splitting threshold and a feature index, and a feature index corresponding to a dimension of the first target feature vector; weighting and aggregating the first probability and the second probability according to preset weights to generate a first target probability; and determining whether the target user has performed the target behavior based on the first target probability.

[0009] In an exemplary embodiment, the third model obtains the second probability by performing the following operations: determining a first correspondence between multiple dimension values ​​in the first target feature vector and multiple internal nodes included in the third model based on the feature index; comparing each dimension value in the first target feature vector with a preset splitting threshold of the internal node corresponding to each dimension value based on the first correspondence to obtain multiple first comparison results; determining branch paths for multiple dimension values ​​based on the multiple first comparison results to obtain leaf nodes corresponding to the multiple dimension values; calculating the sum of scores of the leaf nodes corresponding to the multiple dimension values, and performing a probability calibration operation on the sum to obtain the second probability.

[0010] In an exemplary embodiment, a first fusion operation is performed on the aforementioned communication feature vector and the transaction feature vector of the target user sent by the first object to obtain a first target feature vector. This includes: performing association calculation on the aforementioned transaction feature vector and the aforementioned communication feature vector through a cross-domain attention mechanism to obtain a first weight coefficient, wherein the aforementioned transaction feature vector serves as a query vector, the aforementioned communication feature vector serves as a key vector and a value vector, and the aforementioned association calculation is used to calculate the first weight coefficients of the aforementioned query vector and the aforementioned key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency; and performing weighted aggregation on the aforementioned value vector based on the aforementioned first weight coefficients to generate the aforementioned first target feature vector.

[0011] In an exemplary embodiment, the transaction feature vector is obtained by the first object through the following operations: acquiring the transaction data of the target user, wherein the transaction data includes the frequency of fund transfers, the number of trial transactions, the transaction amount involved in each transaction, and the number of limit transactions; performing preprocessing operations on the transaction data to obtain first data, wherein the preprocessing operations include normalization operations and dimension alignment operations; and calculating second data based on the first data according to preset rules, wherein the preset rules include at least one of the following: calculating the ratio of the amount transferred in to the amount transferred out to obtain a fund concentration coefficient, and calculating the ratio between the first amount and the second amount within a first preset time period. The value is used to obtain the trial transaction coefficient. The ratio of the transaction frequency to the transaction intensity after the dormant account is activated is calculated to obtain the activation transaction intensity of the dormant account. The inflow amount is the sum of transaction amounts with a value greater than the first threshold, the outflow amount is the sum of transaction amounts with a value greater than the first threshold, the first amount is the transaction amount with a value greater than the first threshold, and the second amount is the transaction amount with a value less than the second threshold. The transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account in the second preset time after activation to the historical average transaction amount of the dormant account. The first data and the second data are combined in a preset order to obtain the transaction feature vector.

[0012] According to another aspect of the embodiments of this application, an apparatus for calculating whether a target behavior has occurred is also provided, comprising: an input module, configured to input structured communication data and unstructured text data of a target user into a first model to obtain a communication feature vector output by the first model, wherein the first model includes a first network, a second network, and a third network, the first network and the second network are arranged in parallel and there is no direct connection between the first network and the second network, the output end of the first network is connected to the input end of the third network, the output end of the second network is connected to the input end of the third network, and the third network is configured to fuse a first vector output by the first network based on the structured communication data and a second vector output by the second network based on the unstructured text data to obtain the communication feature vector; a fusion module, configured to perform a first fusion operation on the communication feature vector and the transaction feature vector of the target user to obtain a first target feature vector, wherein the transaction feature vector is a feature vector sent by a first object in encrypted form; and a calculation module, configured to calculate whether the target user has committed a target behavior based on the first target feature vector.

[0013] According to another aspect of the embodiments of this application, a method for calculating whether a target behavior has occurred is provided, comprising: performing a feature transformation operation on the transaction data of a target user to obtain a transaction feature vector; performing a second fusion operation on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector, wherein the communication feature vector is a feature vector sent by a second object in encrypted form; and calculating whether the target user has committed a target behavior based on the second target feature vector.

[0014] In an exemplary embodiment, calculating whether the target user has performed the target behavior based on the second target feature vector includes: simultaneously inputting the second target feature vector into a fourth model and a fifth model to obtain a third probability output by the fourth model and a fourth probability output by the fifth model, wherein the fourth model is used to perform linear weighted calculation on the second target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the third probability, and the fifth model includes multiple decision trees, each decision tree including multiple internal nodes and multiple leaf nodes, each internal node having a preset splitting threshold and a feature index, and a feature index corresponding to a dimension of the second target feature vector; weighting and aggregating the third probability and the fourth probability according to preset weights to generate a second target probability; and determining whether the target user has performed the target behavior based on the second target probability.

[0015] In an exemplary embodiment, the fifth model obtains the fourth probability by performing the following operations: determining a second correspondence between multiple dimension values ​​in the second target feature vector and multiple internal nodes included in the fifth model based on the feature index; comparing each dimension value in the second target feature vector with a preset splitting threshold of the internal node corresponding to each dimension value based on the second correspondence to obtain multiple second comparison results; determining branch paths for multiple dimension values ​​based on the multiple second comparison results to obtain leaf nodes corresponding to the multiple dimension values; calculating the sum of scores of the leaf nodes corresponding to the multiple dimension values, and performing a probability calibration operation on the sum to obtain the fourth probability.

[0016] In an exemplary embodiment, a second fusion operation is performed on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector. This includes: performing association calculation on the transaction feature vector and the communication feature vector through a cross-domain attention mechanism to obtain a second weight coefficient, wherein the transaction feature vector serves as a query vector, and the communication feature vector serves as a key vector and a value vector, and the association calculation is used to calculate the second weight coefficients of the query vector and the key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency; and performing weighted aggregation on the value vector based on the second weight coefficients to generate the second target feature vector.

[0017] In an exemplary embodiment, performing a feature transformation operation on the transaction data of a target user to obtain a transaction feature vector includes: performing a preprocessing operation on the transaction data to obtain first data, wherein the preprocessing operation includes a normalization operation and a dimension alignment operation; calculating second data based on the first data according to a preset rule, wherein the preset rule includes at least one of the following: calculating the ratio of the transfer-in amount to the transfer-out amount to obtain a fund concentration coefficient; calculating the ratio between the first amount and the second amount within a first preset time period to obtain a trial transaction coefficient; calculating the ratio of the transaction frequency to the transaction intensity after the dormant account is activated to obtain the activation transaction intensity of the dormant account; wherein the transfer-in amount is the sum of transaction amounts with a value greater than a first threshold; the transfer-out amount is the sum of transaction amounts with a value greater than the first threshold; the first amount is the transaction amount with a value greater than the first threshold; the second amount is the transaction amount with a value less than the second threshold; and the transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account within a second preset time period after activation to the historical average transaction amount of the dormant account; and combining the first data and the second data in a preset order to obtain the transaction feature vector.

[0018] In one exemplary embodiment, calculating whether the target user has engaged in target behavior based on the second target feature vector includes: receiving an encrypted first target probability of the target user sent by the second object; performing a weighted summation operation on the decrypted first target probability and the second target probability to obtain a third target probability; comparing the third target probability with a target threshold, and determining that the target user has engaged in target behavior if the third target probability is higher than the target threshold, wherein the target threshold is a threshold that is updated in real time based on the degree of matching between the user's evaluation results in historical records and the actual situation.

[0019] According to another aspect of the embodiments of this application, another apparatus for calculating whether a target behavior has occurred is also provided, comprising: a conversion module, configured to perform a feature conversion operation on the transaction data of a target user to obtain a transaction feature vector; a fusion module, configured to perform a second fusion operation on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector, wherein the communication feature vector is a feature vector sent by a second object in encrypted form; and a calculation module, configured to calculate whether the target user has committed a target behavior based on the second target feature vector.

[0020] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed by a processor.

[0021] According to another aspect of the embodiments of this application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, causing the computer device to perform the steps in any of the method embodiments described above.

[0022] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to perform the steps of any of the above method embodiments through the computer program.

[0023] This application utilizes a model comprising a parallel structured processing network and an unstructured text processing network to extract deep semantic features from the target user's structured communication data and unstructured text data, respectively, and aligns them into a unified-dimensional communication feature vector. Subsequently, this communication feature vector is fused across domains with a transaction feature vector securely transmitted via an encrypted channel by the first object to generate a first target feature vector. Finally, the fused feature vector is used to determine whether the target user has engaged in the target behavior. This method, by constructing a dual-channel parallel modeling mechanism of "structured + unstructured," achieves deep collaborative representation of multimodal data from the telecommunications side, overcoming the information partiality problem caused by traditional single-modal models relying on only a single data source. Simultaneously, by combining encrypted transmission and cross-domain feature fusion, it achieves the discovery of implicit correlations between financial transaction behavior and communication semantic behavior while ensuring that the original data of both objects remain within their respective domains and comply with privacy regulations. Therefore, it solves the technical problem that related technologies, relying on single-modal data, cannot accurately determine whether a target user has engaged in the target behavior, achieving the technical effect of accurately determining whether a target user has engaged in the target behavior. Attached Figure Description

[0024] Figure 1 This is a schematic diagram illustrating an application scenario of a method for calculating whether a target behavior has occurred according to an embodiment of this application;

[0025] Figure 2 This is a flowchart illustrating a method for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 1 ;

[0026] Figure 3 This is a flowchart illustrating a method for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 2 ;

[0027] Figure 4 This is a schematic diagram illustrating the process of determining whether a target behavior occurs based on vertical federated learning and a multimodal large model, according to an embodiment of this application.

[0028] Figure 5 This is a structural block diagram of an apparatus for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 1 ;

[0029] Figure 6 This is a structural block diagram of an apparatus for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 2 ;

[0030] Figure 7 This is a computer system architecture block diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0031] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present application. Furthermore, in the absence of conflict, the various embodiments and features in the embodiments of the present application can be arbitrarily combined with each other in principle. The collection, storage, use, processing, transmission, provision, and disclosure of information such as financial data or user data involved in the technical solutions of the present application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] According to one aspect of the embodiments of this application, a method for calculating whether a target behavior has occurred is provided. Optionally, in this embodiment, the above method may be applied, but is not limited to, to... Figure 1 The hardware environment shown includes terminal device 102 and server 104. Server 104 can be connected to terminal device 102 via a network and can be used to provide services (e.g., application services, etc.) to terminal device 102 or clients installed on terminal device 102. A database can be set up on server 104 or independently of server 104 to provide data storage services for server 104.

[0034] The aforementioned network may include, but is not limited to, at least one of the following: wired network and wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network (WAN), metropolitan area network (MAN), and local area network (LAN). The aforementioned wireless network may include, but is not limited to, at least one of the following: Wireless Fidelity (WIFI) and Bluetooth. Terminal device 102 may be, but is not limited to, a personal computer (PC), mobile phone, tablet computer, etc. Server 104 may be, but is not limited to, a cloud server, server cluster, or other server types.

[0035] The method for calculating whether a target behavior has occurred in this embodiment can be executed by server 104, by terminal device 102, or by both server 104 and terminal device 102. Alternatively, the method executed by terminal device 102 can be executed by a client installed on it.

[0036] Taking the method of calculating whether the target behavior has occurred as an example, which is executed by terminal device 102 (server 104), Figure 2 This is a flowchart illustrating a method for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 1 ,like Figure 2 As shown, the process of this method may include the following steps:

[0037] Step S202: Input the structured communication data and unstructured text data of the target user into the first model to obtain the communication feature vector output by the first model. The first model includes a first network, a second network, and a third network. The first network and the second network are set in parallel and there is no direct connection between the first network and the second network. The output of the first network is connected to the input of the third network, and the output of the second network is connected to the input of the third network. The third network is used to fuse the first vector output by the first network based on the structured communication data and the second vector output by the second network based on the unstructured text data to obtain the communication feature vector.

[0038] Optionally, the method in this embodiment can be applied to the fields of financial security, telecommunications anti-fraud, intelligent risk control, and cross-institutional collaborative governance. Application scenarios of the solution in this embodiment include, but are not limited to, anti-fraud collaborative platforms jointly built by banks and telecommunications operators, cross-industry risk information sharing mechanisms led by regulatory agencies, and real-time risk interception systems in scenarios where mobile payment and communication services converge. For example, in an "anti-fraud linkage response system" jointly deployed by commercial banks and provincial telecommunications companies, the bank generates encrypted transaction feature vectors based on customer transaction records, while the telecommunications side uses this method to perform multimodal joint modeling of user SMS content and call behavior to generate communication feature vectors. Both parties complete cross-domain feature fusion under a peer-to-peer federated architecture without neutral nodes, achieving accurate identification of concealed fraud patterns such as "overseas fraudulent phone calls + SMS-induced transfers + rapid in-and-out of account funds," automatically marking high-risk users and triggering real-time limit freezing on the bank and number shutdown on the telecommunications side. Terminal-linked response; for example, in the "Financial-Communication Data Integration Pilot Project" promoted by the National Anti-Fraud Center, this method can provide a unified risk scoring interface for the public security, banking and insurance regulatory, and industry and information technology departments while ensuring user privacy and compliance, supporting the intelligent connection of cross-regional case clues; furthermore, in the cooperation scenario between cross-border digital payment platforms (such as cross-border remittance platforms) and international communication service providers, this method can be used to identify new cross-border fraud chains of "high-frequency mass phishing text messages from overseas virtual numbers + small-amount trial transactions through multiple channels in domestic accounts", realizing risk warning in advance on a global scale.

[0039] Optionally, the structured communication data in this embodiment refers to quantifiable and normalizable user communication behavior indicators from the telecommunications side, used to characterize the patterned features of communication behavior. Its content includes, but is not limited to: the number of calls from overseas numbers, the proportion of calls from out-of-town numbers, the number of cross-regional call trajectories in a very short time, the number of SMS messages received / sent from unknown numbers per day, high-frequency SMS sending periods (e.g., 1–5 AM), the distribution of call and SMS intervals, and the ratio of call frequency to SMS frequency. The above data is automatically extracted from the telecommunications operator's billing system, anti-fraud platform logs, or communication behavior analysis module, and after standardization processing, forms a numerical feature vector. It does not include original call recordings or SMS text.

[0040] Optionally, the unstructured text data in this embodiment refers to the original semantic text content related to the target user. Its content includes, but is not limited to: SMS text content (such as "Your account is abnormal, quickly transfer the deposit to a safe account"), text transcribed from call recordings by a speech recognition system (such as "I am a bank customer service representative, your card has been stolen, please press 9 to confirm"), and caller ID information (such as "marked as fraud", "suspected phishing", "matched in high-risk number database"). The above text may contain colloquial expressions, typos, dialects, abbreviations, or leading phrases. It needs to be preprocessed by cleaning, word segmentation, and stop word removal before being input into the model for semantic encoding.

[0041] Optionally, the first network in this embodiment is a feature extraction sub-network dedicated to processing structured communication data. Its structure is a fully connected neural network or a lightweight multi-layer perceptron (MLP). The input is a normalized structured communication feature vector (e.g., 12-dimensional), and the output is a 256-dimensional structured behavioral semantic vector, which is used to capture the statistical regularity and temporal pattern of communication behavior (e.g., the fraud feature of the combination of "high-frequency short-term calls" and "remote transfer"). It has no parameter sharing or interaction with the second network, ensuring that the structured features are encoded independently.

[0042] Optionally, the second network in this embodiment is a semantic encoding sub-network dedicated to processing unstructured text data. Its structure is a lightweight text encoder based on Qwen-VL-Lite. The input is a preprocessed SMS / transcribed text sequence, and the output is a 256-dimensional semantic embedding vector. This network models the contextual association of fraudulent keywords (such as "transfer", "verification", "secure account") through an attention mechanism, and combines the "suspected fraudulent number" label for weighted enhancement to improve semantic discriminative power. Its training process adopts a combination of self-supervised pre-training and supervised fine-tuning, without relying on an external labeled corpus.

[0043] Optionally, the third network in this embodiment is a cross-modal feature fusion network, which is a lightweight splicing + fully connected layer or attention fusion module. It is used to receive independent output vectors (each 256-dimensional) from the first network and the second network, and generate a unified 512-dimensional communication feature vector by splicing or weighted fusion. This network does not introduce external parameter sharing or cross-network feedback, ensuring that structured and unstructured features maintain their original independence in the semantic space. Semantic alignment is only performed at the high level, effectively avoiding intermodal interference and information confusion.

[0044] Optionally, the communication feature vector in this embodiment is a high-dimensional semantic representation with a unified dimension output by the first model. It integrates the statistical regularities of structured communication behavior (such as call frequency and geographical jump) with the semantic intent of unstructured text (such as leading words and keyword density), and has cross-modal semantic consistency.

[0045] Step S204: Perform a first fusion operation on the above-mentioned communication feature vector and the above-mentioned target user's transaction feature vector to obtain a first target feature vector, wherein the above-mentioned transaction feature vector is a feature vector sent by the first object in encrypted form;

[0046] Optionally, the transaction feature vector in this embodiment is a structured feature vector generated locally by the bank based on customer transaction flow and electronic channel behavior data. Its content includes, but is not limited to, features such as: fund concentration coefficient, trial transaction multiple, cross-domain transaction frequency, quick in and quick out index, dormant account activation intensity, multi-channel limit transaction overlap, and abnormal period transaction ratio. This vector can be output by the bank's lightweight Transformer model, and after being homomorphically encrypted by Paillier, it can be transmitted to the local end in ciphertext form through a secure channel.

[0047] Optionally, the first object in this embodiment refers to a third-party institution that collaborates with this embodiment, namely a banking system or its risk control platform. It does not participate in local model training or data access, but only acts as a provider of encrypted features to ensure the privacy compliance architecture of "data not leaving the domain" in vertical federated learning. The transaction feature vector transmitted by it is in an encrypted state.

[0048] Optionally, the first fusion operation in this embodiment refers to a cross-modal attention alignment mechanism executed in the encrypted domain. It uses the communication feature vector as the Query and the encrypted transaction feature vector as the Key / Value, calculates the association weights of the two in the dimensions of "time correlation" (such as transferring money within 1 hour after a call) and "behavioral synergy" (such as triggering a large transaction when the keyword "transfer" appears in a text message), and generates the first target feature vector after fusion. This operation is completed entirely in the encrypted space without decrypting the original data, ensuring the privacy and security of cross-institutional data collaboration.

[0049] Step S206: Calculate whether the target user has performed the target behavior based on the first target feature vector.

[0050] Optionally, the target behavior in this embodiment refers to whether the target user has been defrauded. The target behavior can be a high-risk event that is highly related to telecommunications fraud, including but not limited to: being induced to transfer money from an account, having funds rapidly split and transferred, high-frequency limited transactions after a dormant account is activated, and binding a third-party payment platform after an overseas call. The determination of this behavior is based on the output probability value of the first target feature vector input to the local model, combined with the reinforcement learning dynamic threshold mechanism for classification. The determination result does not depend on manual rules or fixed thresholds, but is automatically derived through the implicit association of cross-domain behavior patterns learned by the model.

[0051] This embodiment extracts deep semantic features from the target user's structured communication data and unstructured text data using a model comprising a parallel structured processing network and an unstructured text processing network, aligning them into a unified-dimensional communication feature vector. This communication feature vector is then fused across domains with a transaction feature vector securely transmitted via an encrypted channel by the first object to generate a first target feature vector. Finally, the fused feature vector is used to determine whether the target user has engaged in the target behavior. This method, by constructing a dual-channel parallel modeling mechanism of "structured + unstructured," achieves deep collaborative representation of multimodal data from the telecommunications side, overcoming the information partiality problem caused by traditional single-modal models relying on only a single data source. Simultaneously, by combining encrypted transmission and cross-domain feature fusion, it achieves the discovery of implicit correlations between financial transaction behavior and communication semantic behavior while ensuring that the original data of both objects remain within their respective domains and comply with privacy regulations. Therefore, it solves the technical problem that related technologies, relying on single-modal data, cannot accurately determine whether a target user has engaged in the target behavior, achieving the technical effect of accurately determining whether a target user has engaged in the target behavior.

[0052] In an exemplary embodiment, the first network is used to perform normalization and mapping operations on the structured communication data to obtain a first vector. The normalization operation maps the structured communication data to a uniform numerical range with a mean of 0 and a variance of 1 to obtain a third vector. The mapping operation generates the first vector by combining the risk of the structured communication data in the time dimension. The second network is used to perform a first operation on the unstructured text data to obtain a second vector. The first operation includes adding semantic weights to keywords in the unstructured text data based on a target vocabulary, and setting weights for caller ID numbers in the unstructured text data based on the matching degree between the caller ID numbers in the unstructured text data and phone numbers in a suspicious phone number database. The suspicious phone number database stores phone numbers identified as having a risk.

[0053] Optionally, the normalization operation in this embodiment refers to uniformly mapping the original structured communication data to a numerical range with a mean of 0 and a variance of 1 using the Z-Score normalization method. This eliminates the interference of different feature dimensions and distribution differences on subsequent model training. The calculation formula is: z=(x-μ) / σ, where x is the original feature value, μ is the mean of the feature in the training set, and σ is the standard deviation. For example, the "number of overseas calls" is normalized from the original range [0, 47] to [-1.2, 3.5], and the "percentage of cross-regional call duration" is converted from [0%, 89%] to [-0.8, 2.1], ensuring that all features participate in modeling at the same scale, thereby improving the model's convergence stability and the accuracy of feature importance discrimination.

[0054] Optionally, the mapping operation in this embodiment refers to introducing a time-dimensional risk weight function on the basis of normalization to semantically enhance the structured communication data and generate a first vector with behavioral temporal risk perception. This operation constructs a "behavior-time" risk function to assign higher weights to communication behaviors that occur during high-risk periods (such as 2-6 AM), high-risk cycles (such as the first day after a holiday), and after high-risk triggers (such as within 30 minutes of receiving a suspected fraudulent text message). For example, if a user makes their first call to an overseas number at 3 AM, and that number has a "phishing" tag in the suspicious call database, the weight of that call is amplified by 1.8 times after mapping. The final output first vector not only contains the original values ​​but also embeds a "time risk enhancement factor," enabling the model to identify the combination pattern of "abnormal behavior + high-risk time point," rather than isolated values.

[0055] Optionally, the first operation in this embodiment refers to a semantic enhancement preprocessing flow applied to unstructured text data, which includes two core sub-operations: one is keyword semantic weight enhancement based on the target vocabulary, and the other is context weight adjustment based on caller ID matching. This operation is completed before the text enters the encoder, aiming to enhance sensitivity to fraud semantics, rather than relying solely on a general semantic model for representation.

[0056] Optionally, the operation of increasing the semantic weight of keywords in the unstructured text data based on the target vocabulary in this embodiment refers to: constructing a "telecom fraud inducement semantic vocabulary" jointly released by anti-fraud experts and regulatory agencies, which includes high-frequency fraud keywords such as "safe account," "deposit," "verify funds," "transfer to regulatory account," "system upgrade requires your cooperation," "police warrant," "frozen account," and "click link to unfreeze." Before inputting into the model, the system detects whether the above keywords appear in the text. If they do, the semantic weight of the word is exponentially amplified in the word vector embedding layer (e.g., original weight × 3), while retaining its position information in the sentence. For example, in the text "Please transfer to a safe account immediately to prevent freezing," after "safe account" is identified, its vector magnitude in the BERT embedding space is significantly enhanced, making it easier for the model to capture its fraudulent intent. Even if the word is transformed into "safe account" or "safe property," the weight enhancement can still be triggered through the fuzzy matching mechanism.

[0057] Optionally, in this embodiment, the operation of setting the weight of the caller ID in the unstructured text data based on the matching degree between the caller ID in the unstructured text data and the phone numbers in the suspicious phone database refers to: the telecommunications side maintaining a dynamically updated "suspicious phone database," which stores phone numbers verified as high-risk by multiple sources such as public security, operators, and user reports (such as international virtual number segments, voice robot number segments, and fraudulent numbers that have been shut down), and marking each number with a risk level (such as L1–L5, with L5 being the highest). When the unstructured text data contains a caller ID (such as the sender's number in an SMS message or the caller ID in a call log), the system queries whether the number exists in the database: if it matches an L5 level number, the entire text is assigned a weight multiplier of 1.5–2.0; if it matches an L3 level number, it is assigned a weight of 1.2 times; if it does not match, the weight is 1.0. This operation incorporates "number credibility" as a contextual prior into semantic modeling, enabling the model to automatically distinguish the semantic essence of "high-risk phishing" and "ordinary customer service notification" based on whether the sender number is a known fraudulent number when understanding "receiving a text message 'I am a bank customer service representative'".

[0058] Optionally, the suspicious call database in this embodiment is a national / regional dynamic risk number database jointly built by telecommunications operators, public security bureaus, anti-fraud centers, and third-party security vendors. Its data sources include, but are not limited to, high-risk numbers marked with user reports, voice robot / mass calling device number segments automatically identified by AI models, and historical records of shut-down fraud numbers. This database adopts a federated update mechanism, where each participating party only uploads the number hash value and risk label, without sharing the original call content, ensuring data compliance. The database is updated daily and supports millisecond-level queries.

[0059] Optionally, the second vector in this embodiment is an unstructured text semantic representation enhanced by the first operation described above. It is an embedded vector output by the Qwen-VL-Lite text encoder, which not only contains the semantic content of the text (such as keywords and sentence structure), but also integrates the dual prior information of "keyword weight enhancement" and "caller number risk weighting". This allows the model to accurately determine the fraudulent intent through implicit weight signals even in cases of semantic ambiguity or abbreviated expression (such as "Forward quickly! Otherwise your account will be blocked").

[0060] In this embodiment, the first network generates a first vector by performing normalization and time-risk mapping operations on structured communication data, and the second network performs semantic enhancement on unstructured text data by adjusting the semantic weighting of keywords and the matching weights of suspicious numbers, thereby obtaining a second vector. By introducing a domain knowledge-driven semantic enhancement mechanism in the feature extraction stage, the sensitivity and discriminative power of communication features to fraudulent behavior are significantly improved, solving the problem of weak recognition ability of traditional models for ambiguous language and variant numbers, and providing a highly discriminative input basis for cross-domain fusion.

[0061] In an exemplary embodiment, calculating whether the target user has performed a target behavior based on the first target feature vector includes: simultaneously inputting the first target feature vector into a second model and a third model to obtain a first probability output by the second model and a second probability output by the third model, wherein the second model is used to perform linear weighted calculation on the first target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the first probability, and the third model includes multiple decision trees, each decision tree including multiple internal nodes and multiple leaf nodes, each internal node having a preset splitting threshold and a feature index, and a feature index corresponding to a dimension of the first target feature vector; weighting and aggregating the first probability and the second probability according to preset weights to generate a first target probability; and determining whether the target user has performed the target behavior based on the first target probability.

[0062] Optionally, the second model in this embodiment is a linear probability prediction model based on homomorphic encryption operations. Its structure is a logistic regression or weighted linear classifier, designed specifically for encrypted environments. The input is a first target feature vector. The feature vector is weighted and summed for each dimension through homomorphic addition and homomorphic multiplication. The linear combination operation is performed directly in the encrypted state, and the output is the first probability in the range of 0-1 (i.e., the fraud probability score in encrypted form). Its weight parameters are learned through encrypted gradient updates during the federated training phase, without relying on plaintext labels. This ensures that the bank and the telecommunications company can collaboratively construct the discriminant function without disclosing the original features. It is suitable for real-time anti-fraud scenarios with extremely high requirements for computational efficiency and privacy compliance.

[0063] Optionally, the homomorphic addition and homomorphic multiplication operations in this embodiment refer to the ciphertext algebra operations supported by the Paillier homomorphic encryption system: homomorphic addition allows the sum of two ciphertexts to be decrypted as the sum of the plaintexts, and homomorphic multiplication allows the product of a ciphertext and a plaintext constant to be decrypted as the plaintext product. This mechanism enables the second model to complete operations such as Σ(w) without decrypting the first target feature vector. i ×x i The linear weighted calculation of ), where w i For encryption weights, x i The encrypted feature value is used to output an encrypted probability value, which is only used for decision-making after being decrypted locally, thus preventing intermediate data leakage throughout the process.

[0064] Optionally, the third model in this embodiment is a nonlinear prediction model based on a gradient boosting decision tree architecture. It consists of multiple independent decision trees, each containing multiple internal nodes and leaf nodes. Each internal node has a preset feature index (corresponding to a certain dimension in the first target feature vector, such as "trial transaction coefficient" or "number of overseas calls") and a splitting threshold (such as "trial transaction coefficient > 3.2"), which is used to perform layer-by-layer splitting judgment on the input vector during inference. The tree structure is built on encrypted features through federated training, and the splitting rules are automatically learned by the model during the training phase. It retains the high-order nonlinear modeling capability for feature interaction relationships (such as "dormant account activation + SMS keyword density"), and is suitable for capturing complex and nonlinear fraud behavior patterns.

[0065] Optionally, the internal nodes in this embodiment are computational units in the decision tree used to perform binary split judgments. Each node contains two core parameters: feature index (specifying the judgment based on the k-th dimension in the first target feature vector) and split threshold (setting the cut point for this dimension, such as "fund concentration coefficient ≥ 0.8"). Its function is to recursively divide the input sample into a purer subset along the feature space. For example, if the value of the 5th dimension (trial transaction coefficient) in a user's first target feature vector is 4.1, which is higher than the node threshold of 3.2, then it enters the "high-risk branch"; otherwise, it enters the "low-risk branch" until it reaches the leaf node.

[0066] Optionally, in this embodiment, the leaf nodes are the terminal nodes of the decision tree. Each leaf node stores a score (e.g., -1.2, 0.5, 2.1), which represents the prediction strength that the sample under this path belongs to the fraud category. This score is obtained by iterative optimization through the gradient boosting algorithm during the training phase and reflects the fraud ratio of historical samples under this path and the convergence result of the loss function. The sum of the scores of multiple leaf nodes is converted into the final second probability (0-1 interval) by the sigmoid function or probability calibration module, which is used to characterize the confidence level of the user being judged as a fraudster.

[0067] Optionally, in this embodiment, one dimension of the first target feature vector refers to each independent numerical channel in the 1024-dimensional fused feature. Each dimension represents a comprehensive representation of a cross-domain joint behavior. For example, the first dimension is "the number of large-amount transfers within 1 hour after an overseas call", the 12th dimension is "the density of the keyword 'safe account' in the SMS × the activation intensity of dormant accounts", and the 512th dimension is "the overlap of multi-channel limit transactions × the proportion of transactions during abnormal periods". Each dimension is weighted and fused through a cross-domain attention mechanism, carrying semantically dense fraud signals, and is the input basis for the decision tree to make split judgments.

[0068] Optionally, the weighted aggregation of the first probability and the second probability in this embodiment refers to: at the local node, the linear probability (first probability) output by the second model and the tree model probability (second probability) output by the third model are weighted and averaged according to a preset weight (e.g., 0.4:0.6) to generate the first target probability; this weight is dynamically adjusted during the federated training phase based on historical accuracy. For example, when the logistic regression has a higher F1-score in the recent test set, the system automatically increases its weight, and vice versa, it favors the tree model, realizing adaptive complementarity between models, effectively reducing the risk of single-model bias, and improving the overall prediction stability and generalization ability.

[0069] Optionally, the first target probability in this embodiment is the final fraud risk score output after dual-model fusion and dynamic weighting, with a value range of 0–1 (or 0–100 points), representing the comprehensive probability of the target user engaging in telecommunications fraud.

[0070] In this embodiment, based on the first target feature vector, the second and third models output a first probability and a second probability in parallel, and these probabilities are aggregated according to preset weights to form the first target probability to determine the target behavior. A dual-model heterogeneous voting mechanism is constructed, integrating the stability of a linear model with the nonlinear modeling capability of a tree model. This effectively balances the risks of overfitting and underfitting, significantly improving the robustness and generalization of fraud probability prediction, and avoiding misjudgments caused by feature bias in a single model.

[0071] In an exemplary embodiment, the third model obtains the second probability by performing the following operations: determining a first correspondence between multiple dimension values ​​in the first target feature vector and multiple internal nodes included in the third model based on the feature index; comparing each dimension value in the first target feature vector with a preset splitting threshold of the internal node corresponding to each dimension value based on the first correspondence to obtain multiple first comparison results; determining branch paths for multiple dimension values ​​based on the multiple first comparison results to obtain leaf nodes corresponding to the multiple dimension values; calculating the sum of scores of the leaf nodes corresponding to the multiple dimension values, and performing a probability calibration operation on the sum to obtain the second probability.

[0072] Optionally, in this embodiment, the feature index refers to the dimension number used by each internal node in the third model (multiple decision trees) to specify the basis for judgment. Its value ranges from 1 to 1024, corresponding one-to-one with each semantic feature in the first target feature vector. For example, feature index "57" represents the 57th dimension in the first target feature vector, and its semantic meaning may be "number of large transfers within 1 hour after an overseas call". Feature index "213" may represent "density of the keyword 'safe account' in the SMS × activation strength of dormant accounts". This index is automatically learned and generated by the model during the federated training phase based on information gain or Gini impurity, ensuring that the splitting decision focuses on the most discriminative cross-domain joint features, rather than the original low-dimensional input.

[0073] Optionally, the multiple dimension values ​​in the first target feature vector in this embodiment refer to several specific values ​​in the feature vector input to the third model that are referenced by the current decision tree node. For example, the value of the 57th dimension is 3.8 (indicating that the user made 3 large transfers within 1 hour after making a call from overseas), and the value of the 213th dimension is 0.92 (indicating that the joint score of fraud keyword density and account activation strength is extremely high). These values ​​are all in ciphertext form after Paillier homomorphic encryption, but their relative size relationship remains unchanged in the encrypted domain, so that the decision tree can still perform secure reasoning based on threshold comparison, realizing a privacy-protected reasoning mechanism of "ciphertext can be distinguished and data is not leaked".

[0074] Optionally, the preset splitting threshold for internal nodes in this embodiment refers to the numerical splitting point automatically learned and fixed to each internal node by the federated learning algorithm based on the distribution of encrypted features during the decision tree training phase. This threshold is used to determine whether a sample should move to the left or right subtree. For example, if a node has a feature index of 57 (number of transfers after an overseas call), its splitting threshold is 2.5, meaning that when this dimension value is ≥2.5, it enters the "high-risk path," otherwise it enters the "low-risk path." This threshold is obtained by the model through gradient boosting iterative optimization on encrypted data. It does not rely on plaintext labels and is constructed solely based on the statistical distribution of encrypted features and the principle of minimizing the loss function, ensuring that the model can still construct highly discriminative splitting rules without accessing the original data.

[0075] Optionally, in this embodiment, the first correspondence refers to matching each selected dimension in the first target feature vector of the user to be judged with the feature index of its corresponding internal node in the current decision tree during the inference phase, thereby establishing a mapping relationship of "feature vector dimension → decision tree node index". For example, the 57th dimension of the user feature vector corresponds to the 3rd layer node of tree A, and the 213th dimension corresponds to the 5th layer node of tree B. This dynamic association allows each tree to extract only the feature subset most relevant to its own splitting logic, avoiding invalid calculations, improving inference efficiency, and ensuring the consistency and controllability of feature use under privacy constraints.

[0076] Optionally, the first comparison result in this embodiment refers to the binary judgment flag (e.g., "≥ threshold" is 1, "< threshold" is 0) output after performing a ciphertext comparison operation on each dimension value and its corresponding node's splitting threshold during the inference process. This comparison is implemented in the encrypted domain through a secure multi-party computation protocol, such as a comparison circuit based on homomorphic encryption or a privacy-preserving sorting protocol, ensuring that the specific numerical value is not exposed and only the logical result is output. For example, when the ciphertext value of the 57th dimension is compared and "≥2.5" is found to be true (i.e., output 1), the sample continues to propagate downwards along the "high-risk branch" of that node, forming a branch decision chain of the tree path.

[0077] Optionally, the branch path in this embodiment refers to the complete judgment route from the root node to the leaf node of the decision tree, which is formed by sequentially connecting multiple first comparison results. For example: root node feature index 57 → 1 (≥2.5) → second layer feature index 213 → 1 (≥0.8) → third layer feature index 89 → 0 (<0.5), finally reaching the 15th leaf node; this path completely records the user's behavioral trajectory in the cross-domain feature space, which is the logical basis for the model to make risk judgments. Its path length and path combination reflect the complexity and hierarchy of fraudulent behavior, such as the four-step closed loop of "overseas call → SMS inducement → trial transaction → large transfer".

[0078] Optionally, in this embodiment, the leaf nodes are the final termination nodes of the decision tree. Each leaf node stores a score (e.g., -1.2, 0.3, 2.5), which is the prediction strength value obtained by optimizing in the encrypted domain through the gradient boosting algorithm during the training phase, reflecting the average fraud tendency of historical samples under this path. For example, a leaf node path is "high-frequency SMS + midnight transfer + unknown number + quick in and out of funds," and its score is 2.7, indicating that the historical fraud rate of this combination pattern is as high as 92%. This score is a real number, stored in encrypted form after federated training, and only participates in the summation operation during local decryption to ensure that the model knowledge is not leaked.

[0079] Optionally, in this embodiment, the sum of scores refers to the result of accumulating the scores of the leaf nodes output by each tree in a scenario integrating multiple decision trees. For example, if a user reaches a leaf node with a score of 2.1 through tree A, a leaf node with a score of 0.8 through tree B, and a leaf node with a score of -0.3 through tree C, the sum is 2.1 + 0.8 + (-0.3) = 2.6. This sum represents the overall assessment strength of the model on user risk, and its magnitude is positively correlated with the probability of fraud, serving as the input basis for subsequent probability calibration.

[0080] Optionally, the probability calibration operation in this embodiment refers to mapping the sum of scores output by multiple trees to a second probability within the 0–1 interval using a Sigmoid function or Isotonic regression, in order to solve the problems of uneven distribution and lack of probabilistic physical meaning in the original scores. For example, a sum of 2.6 is calculated by the Sigmoid function to obtain 0.93, meaning the output second probability is 93%. This process is completed in the local plaintext space and is only executed after decrypting the encrypted aggregation result, ensuring that intermediate model parameters are not leaked. At the same time, it makes the output probability interpretable and business-operable, facilitating weighted fusion with the first probability of the second model to ultimately form a unified risk score.

[0081] In this embodiment, the third model outputs a second probability through feature index matching, split threshold comparison, path tracing, and leaf node score aggregation, combined with probability calibration. This achieves interpretable hierarchical decision-making for high-dimensional fused features, preserving model transparency without sacrificing accuracy. It makes the risk assessment process traceable and auditable, meeting the mandatory requirements of the financial and telecommunications industries for compliance and regulatory compliance of risk control models.

[0082] In an exemplary embodiment, a first fusion operation is performed on the aforementioned communication feature vector and the transaction feature vector of the target user sent by the first object to obtain a first target feature vector. This includes: performing association calculation on the aforementioned transaction feature vector and the aforementioned communication feature vector through a cross-domain attention mechanism to obtain a first weight coefficient, wherein the aforementioned transaction feature vector serves as a query vector, the aforementioned communication feature vector serves as a key vector and a value vector, and the aforementioned association calculation is used to calculate the first weight coefficients of the aforementioned query vector and the aforementioned key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency; and performing weighted aggregation on the aforementioned value vector based on the aforementioned first weight coefficients to generate the aforementioned first target feature vector.

[0083] Optionally, the cross-domain attention mechanism in this embodiment is an encrypted domain feature alignment and association modeling module specifically designed for a vertical federated learning environment. To achieve privacy-preserving association between structured transaction data from the bank side and multimodal communication data from the telecommunications side, it performs an attention weight calculation and weighted aggregation process based on homomorphic encryption between the local encrypted feature vectors of both parties. Its core lies in dynamically calculating the implicit association strength between bank transaction behavior and telecommunications communication behavior through a Query-Key-Value structure without decrypting the original features.

[0084] Optionally, in this embodiment, the transaction feature vector as a query vector refers to the feature vector output by the bank. Each dimension encodes the financial behavior semantics of the user account, such as "fund concentration coefficient", "probing transaction coefficient", "dormant account activation intensity", "multi-channel limit transaction overlap", etc., representing the user's "intent tendency" at the level of fund operation. As a query, it actively initiates a retrieval request for communication behavior to ask: "Does this abnormal fund operation correspond to a high-risk communication trigger?" For example, when the value of the "probing transaction coefficient" dimension in the query vector increases significantly, the system searches on the communication side for pre-emptive signals such as "high-frequency unknown text messages" or "overseas calls".

[0085] Optionally, in this embodiment, the communication feature vector, serving as both a key and a value, refers to the multimodal feature vector output by the modified Qwen-VL-Lite model from the telecommunications side. This vector contains a joint representation of structured communication behaviors (such as the number of overseas calls and SMS frequency) and unstructured semantically enhanced text (such as keyword density and suspicious number matching weights). As a key, it is used to respond to the query and assess whether a certain communication feature is related to the current transaction behavior. As a value, it carries specific communication semantic content for subsequent weighted aggregation. For example, the combined dimension of "fraud keyword density × overseas call time correlation" in the communication vector serves as both a key for judging relevance and a value for providing supporting evidence.

[0086] Optionally, in this embodiment, the time correlation dimension refers to calculating the synchronicity weight of transaction and communication behaviors in a time series, used to capture typical fraud patterns of "fund operations occurring shortly after communication." For example, if a user receives a text message containing "safe account" at 2:15 AM (communication timestamp) and completes a large transfer at 2:17 AM (transaction timestamp), the time difference is less than 3 minutes, and the system assigns a weight of 0.92 to this dimension; if the time interval exceeds 2 hours, the weight drops to 0.15. This dimension calculates the time difference distribution of transaction and communication events and generates continuously decaying weights using a Gaussian kernel function, achieving highly sensitive identification of "instant inducement fraud" (such as "frozen funds if you don't transfer now").

[0087] Optionally, the behavioral synchronicity dimension in this embodiment refers to measuring the coordinated changing trends of transaction behavior and communication behavior in terms of frequency, intensity, and pattern, rather than relying solely on timestamps. For example, if a user receives a large number of text messages from unknown numbers at night for three consecutive days, and each day in the early morning there is a small trial transaction (e.g., 200 yuan) followed by a 50,000 yuan transfer 30 minutes later, the system determines that their "frequency synchronicity" score is 0.88; if it is only a single text message + a single transfer, the synchronicity weight is only 0.3. This dimension achieves nonlinear synchronicity modeling in the encrypted domain by calculating the covariance, Pearson correlation coefficient, or dynamic time warping (DTW) distance of two vectors within a time-series sliding window, and is used to identify "long-term inducement fraud" (e.g., "cultivating trust before harvesting").

[0088] Optionally, the semantic consistency dimension in this embodiment refers to evaluating the logical consistency between the semantic content of the transaction behavior and the communication text at the semantic level, i.e., "what the communication says, and whether the transaction does what it requires." For example, if the communication text contains keywords such as "please transfer funds to the escrow account" or "transfer is required to verify your identity," and the "recipient account type" in the transaction feature vector is "non-owner account," "off-site corporate account," or "newly registered account," and the "transfer purpose field" is empty or filled with "personal transactions," then the semantic consistency weight is as high as 0.95; if the communication is a "bank reminder" and the transaction is a daily salary deposit, then the weight is close to 0.05. This dimension achieves cross-modal semantic alignment by calculating the cosine similarity between the semantic embedding of the communication text and the semantic tags of the transaction behavior (such as "quick in and out of funds" or "multi-channel limit") within the encrypted domain.

[0089] Optionally, in this embodiment, the first weight coefficient refers to the normalized attention weights calculated on the three dimensions (temporal correlation, behavioral synchronization, and semantic consistency) respectively. The three are weighted and fused to form the final cross-domain association strength vector. The weight of each dimension is automatically learned during the federated training phase (e.g., 0.4 for time, 0.3 for synchronization, and 0.3 for semantics), ensuring that the model prioritizes the most discriminative association patterns. For example, in a user case, the weights of the three dimensions are 0.91, 0.87, and 0.83 respectively. After Softmax normalization, the first weight coefficient is [0.35, 0.34, 0.31], indicating that the user's risk mainly stems from the synergistic effect of the three dimensions, rather than a single-dimensional anomaly.

[0090] Optionally, in this embodiment, the weighted aggregation of the value vector based on the first weight coefficient means: summing each feature dimension in the communication feature vector (Value) according to the first weight coefficient to generate a first target feature vector. This vector is no longer a simple concatenation of banking and telecommunications features, but a deep fusion representation "after semantic enhancement of fraudulent behavior". Each dimension carries a causal signal that "a certain financial behavior occurs due to a certain communication inducement". For example, the 600th dimension may represent the combined effect of "when the user receives a 'margin' type SMS (high semantic weight) + the SMS occurs 10 minutes before the transfer (high time weight) + the user frequently receives such SMS in the past 3 days (high synchronization weight)", thereby significantly amplifying the contribution of this dimension in the final prediction.

[0091] Optionally, the first target feature vector in this embodiment is the final fusion representation output by the cross-domain attention mechanism. It is generated by dynamically weighting and aggregating the transaction feature vector provided by the bank and the communication feature vector provided by the telecommunications side through the encrypted domain attention mechanism. Each dimension contains a strong semantic association between "funding behavior and communication inducement". Its essence is to transform the "fraud behavior chain" from discrete events into a continuous and quantifiable joint feature space representation. This vector does not contain any original data, but only reflects the strength of the association between behaviors. At the same time, it provides a high-discrimination and high-privacy-security input basis for subsequent dual-model prediction.

[0092] This embodiment utilizes a cross-domain attention mechanism, using transaction features as the query vector and communication features as the key and value vectors, to calculate the weights of three dimensions (temporal correlation, behavioral synchronization, and semantic consistency) and aggregate them to generate the first target feature vector. Within the encrypted domain, it accurately captures implicit collaborative patterns of fund flows and information flows (such as "transfer within one hour of an overseas call"), overcoming the limitations of traditional federated learning's shallow fusion approach that only involves simple feature concatenation or weighting. This enables deep behavioral correlation modeling across institutions and modalities, significantly improving the identification and recall rate of hidden fraud chains.

[0093] In an exemplary embodiment, the transaction feature vector is obtained by the first object through the following operations: acquiring the transaction data of the target user, wherein the transaction data includes the frequency of fund transfers, the number of trial transactions, the transaction amount involved in each transaction, and the number of limit transactions; performing preprocessing operations on the transaction data to obtain first data, wherein the preprocessing operations include normalization operations and dimension alignment operations; and calculating second data based on the first data according to preset rules, wherein the preset rules include at least one of the following: calculating the ratio of the amount transferred in to the amount transferred out to obtain a fund concentration coefficient, and calculating the ratio between the first amount and the second amount within a first preset time period. The value is used to obtain the trial transaction coefficient. The ratio of the transaction frequency to the transaction intensity after the dormant account is activated is calculated to obtain the activation transaction intensity of the dormant account. The inflow amount is the sum of transaction amounts with a value greater than the first threshold, the outflow amount is the sum of transaction amounts with a value greater than the first threshold, the first amount is the transaction amount with a value greater than the first threshold, and the second amount is the transaction amount with a value less than the second threshold. The transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account in the second preset time after activation to the historical average transaction amount of the dormant account. The first data and the second data are combined in a preset order to obtain the transaction feature vector.

[0094] Optionally, the target user in this embodiment refers to an individual account holder who has been included in the anti-fraud monitoring scope of the banking system. Their identity is uniquely bound to the mobile phone number of the telecommunications user through the customer number, which is used to achieve vertical federal alignment between bank-side transaction behavior and telecommunications-side communication behavior. This user is not distinguished as to whether fraud has occurred, but is continuously monitored as a potential risk object. Their account status may be active, dormant, or recently activated, but all meet the basic conditions of "having the ability to conduct fund transactions + associated telecommunications communication behavior".

[0095] Optionally, the transaction data in this embodiment refers to structured transaction records related to the target user's account collected by the bank's core accounting system, electronic channel platform, risk control logs, and other original systems. The data granularity is at the single transaction level. It should be noted that the above transaction data are all original details retained locally by the bank and do not contain sensitive information such as customer names or ID numbers. Only account identifiers and transaction metadata are retained, complying with the de-identification requirements of the Personal Information Protection Law.

[0096] Optionally, in this embodiment, the frequency of fund transactions refers to the total number of fund transfers in and out of the account within a preset time window (such as the past 24 hours), which is used to measure abnormal account activity.

[0097] Optionally, the number of trial transactions in this embodiment refers to the number of transactions with a single amount less than the second threshold (e.g., 200 yuan) within a preset time window. This is usually a trial behavior by fraudsters to test whether the account is usable and whether the limit is effective.

[0098] Optionally, the transaction amount involved in each transaction in this embodiment refers to the original amount of each transaction, which is used to calculate derivative features such as fund concentration, probing ratio, and quick in-and-out index.

[0099] Optionally, in this embodiment, the number of transactions with a limit refers to the number of transactions where the amount of a single transaction is close to or reaches the daily / single transaction limit set by the bank (such as 90% or more of the limit). This often occurs in scenarios where fraudsters induce users to make multiple transfers in separate transactions.

[0100] Optionally, the preprocessing operation in this embodiment refers to the standardization, normalization, and alignment process performed on the original transaction data to improve feature quality and model compatibility. It includes the following two core sub-operations: normalization operation, which uses Min-Max standardization or Z-Score standardization to uniformly map the original values ​​of different units such as "transaction amount", "frequency", and "number of times" to the interval [0, 1] or [-1, 1] to eliminate the interference of unit differences on subsequent model training. For example, if a user's maximum single transaction amount is 500,000 yuan and the minimum is 0 yuan, then after normalization, the maximum value is 1, the minimum value is 0, and the intermediate value is linearly scaled; dimension alignment operation, which uniformly adjusts the transaction indicators statistically collected in different time windows (such as 7 days and 30 days) to the same dimension length (such as 1 sample per day, a total of 30 dimensions) to ensure that all user input feature vectors have a unified dimension structure (such as 32 dimensions), which is convenient for subsequent model input. For example, the "number of trial transactions in the past 7 days" and the "number of limit transactions in the past 30 days" are uniformly sampled as daily averages to form a 30-dimensional sequence for time series modeling.

[0101] Optionally, the first data in this embodiment refers to a standardized set of transaction features after normalization and dimension alignment. The data is in the form of a structured array with a fixed number of dimensions (e.g., 32 dimensions). Each dimension corresponds to a standardized original or derived indicator. For example, the first dimension is "24-hour transfer frequency (normalized)", the fifth dimension is "proportion of trial transactions (normalized)", and the twelfth dimension is "number of daily limit transactions (normalized)". This data has been noise-free and scaled uniformly, providing high-quality input for subsequent rule-driven feature engineering. It does not contain any plaintext sensitive information, satisfying the privacy premise of "local data not leaving the domain" in federated learning.

[0102] Optionally, the preset rules in this embodiment are a set of calculable and reproducible business logic formulas extracted by anti-fraud experts and risk control teams based on the characteristics of real cases. These formulas are used to mine highly discriminative derivative features from the first data, including but not limited to the following four rules: calculating the ratio of the inflow amount to the outflow amount to obtain the fund concentration coefficient, where "inflow amount" is the sum of all inflow amounts with a single amount greater than a first threshold (e.g., 5000 yuan), and "outflow amount" is the sum of all outflow amounts with a single amount greater than the first threshold. The ratio reflects a typical fraud pattern of "concentrated inflow and rapid outflow" of funds, such as "1 million yuan inflow → all transferred out within 2 hours." A ratio close to 1.0 indicates high suspicion. The ratio between the first amount and the second amount within a first preset time period is calculated to obtain the trial transaction coefficient. Here, "first amount" refers to a single transaction amount greater than the first threshold (e.g., 5000 yuan), and "second amount" refers to a single trial transaction amount less than the second threshold (e.g., 200 yuan). The ratio reflects a "trial first, then large amount" behavioral chain, such as: 10 After a trial transaction of 200 yuan, an 80,000 yuan transfer occurred. The coefficient = 80000 / 2000 = 40. The higher the coefficient, the greater the likelihood of fraud. The activation transaction intensity of a dormant account is calculated by comparing the transaction frequency to the transaction intensity after activation. Here, "dormant account" refers to an account with no transaction records in the past 6 months; "second preset time after activation" refers to the first 72 hours after activation; "transaction frequency" is the number of transactions after activation; and "transaction intensity" is the ratio of the cumulative transaction amount after activation to the account's historical average transaction amount. The ratio of the past 12 months is used to identify high-risk patterns where "zombie accounts are activated and immediately used for fraudulent transfers." For example, if the historical average is 500 yuan and the total transaction amount reaches 150,000 yuan within 3 days after activation, then the transaction intensity = 300, which is extremely high risk. The overlap of multi-channel limit transactions refers to the consistency of the frequency of transactions that reach more than 90% of the limit on a single day across mobile banking, online banking, and APP. If the limit is triggered on all three channels within 2 hours, the overlap is 1.0, indicating abnormal operation and being induced to make concentrated transfers.

[0103] Optionally, the second data in this embodiment refers to a set of high-order derived features with strong fraud discrimination power, which is calculated from the first data according to the above-mentioned preset rules. Its dimensions are independent of the first data, but its semantics are complementary, and together they constitute the core discrimination unit of the transaction feature vector. For example, the second data may include: fund concentration coefficient (1-dimensional), trial transaction coefficient (1-dimensional), dormant account activation transaction intensity (1-dimensional), multi-channel limit overlap degree (1-dimensional), etc. Each item is a dimensionless value, and its semantics have been enhanced through business rules, which is significantly better than the linear expression of the original transaction amount or frequency.

[0104] Optionally, the preset order in this embodiment refers to a fixed sequence in which the first data and the second data are arranged and combined according to a predetermined logic to adapt to the input structure of the bank-side model, so as to ensure that the model can correctly capture the hierarchical relationship of "basic behavioral features → higher-order semantic features"; for example, the preset order is: [1st-16th dimensions] are normalized original transaction indicators (such as frequency, amount, number of limit transactions, etc.), [17th-24th dimensions] are normalized derived features (such as capital concentration, trial transaction coefficient, etc.), and [25th-32nd dimensions] are behavioral time-series statistical indicators (such as 24-hour transaction volatility, proportion of transactions in the early morning).

[0105] In this embodiment, the first object acquires raw transaction data, performs normalization and dimensional alignment, and derives multiple risk coefficients based on business rules (such as fund concentration, trial transaction coefficient, and dormant / activated intensity), ultimately combining them to generate a transaction feature vector. This constructs a refined, interpretable, and business-oriented structured feature system for anti-fraud scenarios, solidifying the experience of bank risk control experts into computable model input. This effectively compensates for the shortcomings of purely data-driven models in understanding the semantics of financial behavior, significantly improving the fraud characterization capability and model interpretability of transaction-side features.

[0106] According to another aspect of the embodiments of this application, a method for calculating whether a target behavior has occurred is provided. This method can be executed by a server 104, a terminal device 102, or jointly by both the server 104 and the terminal device 102. The terminal device 102 can also execute the method of this application embodiment by a client installed on it.

[0107] Taking the method of calculating whether the target behavior has occurred as an example, which is executed by terminal device 102 (server 104), Figure 3 This is a flowchart illustrating a method for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 2 ,like Figure 3 As shown, the process of this method may include the following steps:

[0108] Step S302: Perform feature transformation operation on the target user's transaction data to obtain a transaction feature vector;

[0109] Optionally, the method in this embodiment can be applied to the fields of financial security, telecommunications anti-fraud, intelligent risk control, and cross-institutional collaborative governance. Application scenarios of the solution in this embodiment include, but are not limited to, anti-fraud collaborative platforms jointly built by banks and telecommunications operators, cross-industry risk information sharing mechanisms led by regulatory agencies, and real-time risk interception systems in scenarios where mobile payment and communication services converge. For example, in an "anti-fraud linkage response system" jointly deployed by commercial banks and provincial telecommunications companies, the bank generates encrypted transaction feature vectors based on customer transaction records, while the telecommunications side uses this method to perform multimodal joint modeling of user SMS content and call behavior to generate communication feature vectors. Both parties complete cross-domain feature fusion under a peer-to-peer federated architecture without neutral nodes, achieving accurate identification of concealed fraud patterns such as "overseas fraudulent phone calls + SMS-induced transfers + rapid in-and-out of account funds," automatically marking high-risk users and triggering real-time limit freezing on the bank and number shutdown on the telecommunications side. Terminal-linked response; for example, in the "Financial-Communication Data Integration Pilot Project" promoted by the National Anti-Fraud Center, this method can provide a unified risk scoring interface for the public security, banking and insurance regulatory, and industry and information technology departments while ensuring user privacy and compliance, supporting the intelligent connection of cross-regional case clues; furthermore, in the cooperation scenario between cross-border digital payment platforms (such as cross-border remittance platforms) and international communication service providers, this method can be used to identify new cross-border fraud chains of "high-frequency mass phishing text messages from overseas virtual numbers + small-amount trial transactions through multiple channels in domestic accounts", realizing risk warning in advance on a global scale.

[0110] Optionally, the target user in this embodiment refers to an individual account holder who is included in the anti-fraud monitoring scope under the two-way cooperation framework between banks and telecommunications. Their identity is uniquely bound by "bank customer number" and "telecom mobile phone number". This user is not pre-set as a fraud perpetrator, but is continuously evaluated as a potential victim. Their account status can be active, dormant or recently activated, but all meet the basic conditions of "having traceable transaction behavior + associated collectable communication behavior".

[0111] Optionally, the transaction feature vector in this embodiment is a structured feature vector generated locally by the bank based on customer transaction flow and electronic channel behavior data. Its content includes, but is not limited to, features such as: fund concentration coefficient, trial transaction multiple, cross-domain transaction frequency, quick in and quick out index, dormant account activation intensity, multi-channel limit transaction overlap, and abnormal period transaction ratio. This vector can be output by the bank's lightweight Transformer model, and after being homomorphically encrypted by Paillier, it can be transmitted to the local end in ciphertext form through a secure channel.

[0112] Optionally, the feature transformation operation in this embodiment refers to the preprocessing process on the bank side, which standardizes, derivatizes, and vectorizes the original transaction data locally. Its goal is to transform discrete, heterogeneous, and low-semantic original transaction records into transaction feature vectors with high discriminative power, unified dimensions, and the ability to be understood by deep learning models. This process does not involve data transmission and is entirely completed locally. Specifically, it includes normalization, scaling transaction amounts, frequencies, and other values ​​to the [0,1] range to eliminate dimensional interference; dimensional alignment, uniformly sampling statistical indicators from different time windows (e.g., 7 days, 30 days) into a 32-dimensional fixed-length sequence; rule derivation, calculating higher-order features such as fund concentration coefficient, trial transaction coefficient, and dormant account activation intensity based on preset business rules; and semantic encoding, combining the derived features with the original features in a preset order to form a 32-dimensional feature vector with clear anti-fraud semantics, such as the 12th dimension = "trial transaction coefficient = 42.1", the 21st dimension = "fund concentration coefficient = 0.98", and the 30th dimension = "multi-channel limit overlap = 1.0". This vector is a semantic representation of the "cash flow" on the bank's side. Each dimension corresponds to an interpretable fraud behavior pattern and is the sole input for subsequent cross-domain integration.

[0113] Step S304: Perform a second fusion operation on the above transaction feature vector and the above target user's communication feature vector to obtain a second target feature vector, wherein the above communication feature vector is a feature vector sent by the second object in encrypted form;

[0114] Optionally, the communication feature vector in this embodiment refers to the feature representation extracted locally by the telecommunications side based on the target user's communication data (SMS text, call recording transcription, call trajectory, etc.) through a customized Qwen-VL-Lite model. Its content includes: structured behavior, such as the frequency of overseas calls, high-frequency SMS periods, and the number of cross-regional call trajectories in a very short time; unstructured semantics, such as the density of fraudulent keywords (e.g., "safe account", "deposit", "verification code"), and the matching weight of the suspected fraudulent number database; and cross-modal fusion, which is a weighted vector of text semantic embedding and behavioral features.

[0115] Optionally, the second fusion operation in this embodiment refers to the operation process of fusing the locally generated transaction feature vector on the bank side with the encrypted communication feature vector sent by the telecommunications side using an encrypted domain attention mechanism.

[0116] Optionally, the second target feature vector in this embodiment is the output of the second fusion operation. It is an encrypted feature representation, each dimension of which carries the causal semantics of "bank transaction behavior caused by telecommunications communication". It is a high-order risk representation that integrates the strong correlation pattern of capital flow and information flow. This vector does not contain any original data and only reflects the joint strength of cross-domain behavior.

[0117] Optionally, the second object in this embodiment refers to a third-party organization that collaborates with this embodiment, namely a telecommunications department. It does not participate in local model training or data access, but only acts as a provider of encryption features to ensure the privacy compliance architecture of "data not leaving the domain" in vertical federated learning. The communication feature vectors it transmits are in an encrypted state.

[0118] Step S306: Calculate whether the target user has performed the target behavior based on the second target feature vector.

[0119] Optionally, in this embodiment, calculating whether a target user has engaged in the target behavior based on the second target feature vector refers to the process by which the bank performs risk scoring locally based on the second target feature vector using a trained model (logistic regression + lightweight gradient boosting tree).

[0120] Optionally, the target behavior in this embodiment refers to whether the target user has been defrauded. The target behavior can be a high-risk event that is highly related to telecommunications fraud, including but not limited to: being induced to transfer money from an account, having funds rapidly split and transferred, high-frequency limited transactions after a dormant account is activated, and binding a third-party payment platform after an overseas call. The determination of this behavior is based on the output probability value of the first target feature vector input to the local model, combined with the reinforcement learning dynamic threshold mechanism for classification. The determination result does not depend on manual rules or fixed thresholds, but is automatically derived through the implicit association of cross-domain behavior patterns learned by the model.

[0121] In this embodiment, the bank performs feature transformation on local transaction data to generate transaction feature vectors rich in fund flow semantics, breaking through the limitations of traditional single-dimensional modeling. Secondly, it receives communication feature vectors provided by the telecommunications side in encrypted form, and without exposing the original data, uses an encrypted domain attention mechanism to deeply fuse the two, generating a second target feature vector containing a strong semantic correlation between "fund operation—communication inducement," achieving for the first time privacy-preserving semantic alignment of cross-domain multimodal behavior. Finally, based on this high-dimensional fused feature, it accurately calculates whether the target user has engaged in the target behavior. By combining encrypted transmission with cross-domain feature fusion, the implicit correlation between fund transaction behavior and communication semantic behavior is mined while ensuring that the original data of both objects does not leave the domain and that privacy compliance is maintained. Therefore, it solves the technical problem that related technologies cannot accurately determine whether a target user has engaged in the target behavior due to reliance on single-modal data, achieving the technical effect of accurately determining whether a target user has engaged in the target behavior.

[0122] In an exemplary embodiment, calculating whether the target user has performed the target behavior based on the second target feature vector includes: simultaneously inputting the second target feature vector into a fourth model and a fifth model to obtain a third probability output by the fourth model and a fourth probability output by the fifth model, wherein the fourth model is used to perform linear weighted calculation on the second target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the third probability, and the fifth model includes multiple decision trees, each decision tree including multiple internal nodes and multiple leaf nodes, each internal node having a preset splitting threshold and a feature index, and a feature index corresponding to a dimension of the second target feature vector; weighting and aggregating the third probability and the fourth probability according to preset weights to generate a second target probability; and determining whether the target user has performed the target behavior based on the second target probability.

[0123] Optionally, the fourth model in this embodiment is a linear probability prediction model based on homomorphic encryption operations. Its structure is a logistic regression or weighted linear classifier, designed specifically for encrypted environments. The input is a second target feature vector. The feature vector is weighted and summed in each dimension through homomorphic addition and homomorphic multiplication. The linear combination operation is completed directly in the ciphertext state, and the output is the first probability in the range of 0-1 (i.e., the fraud probability score in encrypted form). Its weight parameters are learned through encrypted gradient updates during the federated training phase, without relying on plaintext labels. This ensures that the bank and the telecommunications company can collaboratively construct the discriminant function without disclosing the original features. It is suitable for real-time anti-fraud scenarios with extremely high requirements for computational efficiency and privacy compliance.

[0124] Optionally, the homomorphic addition and homomorphic multiplication operations in this embodiment refer to the ciphertext algebra operations supported by the Paillier homomorphic encryption system: homomorphic addition allows the sum of two ciphertexts to be decrypted as the sum of the plaintexts, and homomorphic multiplication allows the product of a ciphertext and a plaintext constant to be decrypted as the plaintext product. This mechanism enables the fourth model to complete operations such as Σ(w) without decrypting the second target feature vector. i ×x i The linear weighted calculation of ), where w i For encryption weights, x i The encrypted feature value is used to output an encrypted probability value, which is only used for decision-making after being decrypted locally, thus preventing intermediate data leakage throughout the process.

[0125] Optionally, the fifth model in this embodiment is a nonlinear prediction model based on a gradient boosting decision tree architecture. It consists of multiple independent decision trees, each containing multiple internal nodes and leaf nodes. Each internal node has a preset feature index (corresponding to a certain dimension in the first target feature vector, such as "trial transaction coefficient" or "number of overseas calls") and a splitting threshold (such as "trial transaction coefficient > 3.2"), which is used to perform layer-by-layer splitting judgment on the input vector during inference. The tree structure is built on encrypted features through federated training, and the splitting rules are automatically learned by the model during the training phase. It retains the high-order nonlinear modeling capability for feature interaction relationships (such as "dormant account activation + SMS keyword density"), and is suitable for capturing complex and nonlinear fraud behavior patterns.

[0126] Optionally, in this embodiment, the internal nodes are computational units in the decision tree used to perform binary split judgments. Each node contains two core parameters: a feature index (specifying the judgment based on the k-th dimension in the first target feature vector) and a split threshold (setting the cut point for that dimension, such as "fund concentration coefficient ≥ 0.8"). Its function is to recursively divide the input sample into a purer subset along the feature space. For example, if the value of the 5th dimension (trial transaction coefficient) in a user's second target feature vector is 4.1, which is higher than the node threshold of 3.2, then it enters the "high-risk branch"; otherwise, it enters the "low-risk branch" until it reaches the leaf node.

[0127] Optionally, in this embodiment, the leaf nodes are the terminal nodes of the decision tree. Each leaf node stores a score (e.g., -1.2, 0.5, 2.1), which represents the prediction strength that the sample under this path belongs to the fraud category. This score is obtained through iterative optimization of the gradient boosting algorithm during the training phase and reflects the fraud ratio of historical samples under this path and the convergence result of the loss function. The sum of the scores of multiple leaf nodes is converted into the final fourth probability (0-1 interval) by the sigmoid function or probability calibration module, which is used to characterize the confidence level of the user being judged as a fraudster.

[0128] Optionally, in this embodiment, one dimension of the second target feature vector refers to each independent numerical channel in the 1024-dimensional fused feature. Each dimension represents a comprehensive representation of a cross-domain joint behavior. For example, the first dimension is "the number of large-amount transfers within 1 hour after an overseas call", the 12th dimension is "the density of the keyword 'safe account' in the SMS × the activation intensity of dormant accounts", and the 512th dimension is "the overlap of multi-channel limit transactions × the proportion of transactions during abnormal periods". Each dimension is weighted and fused through a cross-domain attention mechanism, carrying semantically dense fraud signals, and serves as the input basis for the decision tree to make split judgments.

[0129] Optionally, the third probability in this embodiment refers to the initial fraud probability value output by the fourth model (logistic regression) and calculated based on homomorphic encryption linear weighting. Its numerical range is [0, 1], reflecting the user's comprehensive risk level under the "linearly separable" dimension. For example, if the "capital concentration coefficient" and "trial transaction coefficient" in the feature vector are both extremely high, the third probability may be 0.82, indicating that the model has determined high risk based on linear correlation, but has not considered complex nonlinear combinations.

[0130] Optionally, in this embodiment, the fourth probability refers to the fraud probability value output by the fifth model (multiple decision trees), which is based on the aggregation of decision tree paths and the sum of leaf node scores and calibrated by Sigmoid. Its numerical range is [0, 1], reflecting the model's ability to discriminate "nonlinear, high-order interactive risk combinations". For example, if the second target feature vector triggers the three paths of "overseas call + keyword density + quota overlap", the corresponding leaf node scores are +0.51, +0.39, and -0.08, then the total score is 0.82, and the fourth probability after calibration is 0.86, indicating that the tree model identifies a stronger composite risk signal than the linear model.

[0131] In this embodiment, the encrypted second target feature vector generated through cross-domain fusion is input in parallel into two heterogeneous models. The fourth model uses Paillier homomorphic addition and multiplication to perform linear weighted calculations without decrypting the original features, outputting a robust but limited generalization third probability. The fifth model, based on a preset feature index and splitting threshold, performs multi-layer nonlinear path reasoning in the encrypted feature space, outputting a fourth probability that captures complex interaction relationships. The results of the two models are weighted and aggregated according to the weights dynamically learned during the training phase to form the second target probability. This comprehensive probability serves as the basis for decision-making, accurately determining whether the target user has engaged in the target behavior. This mechanism effectively overcomes the limitations of single models in financial anti-fraud scenarios: linear models tend to ignore multi-factor collaborative risks, and tree models are susceptible to noise interference. This solution, through encrypted domain collaborative reasoning, not only ensures data privacy and compliance but also significantly improves the accuracy, recall, and robustness of fraud identification, forming a new paradigm of intelligent risk control that is "explainable, computable, and self-balancing," providing a highly reliable, low-false-judgment, and highly adaptable technical foundation for cross-institutional anti-fraud in banks and telecommunications.

[0132] In an exemplary embodiment, the fifth model obtains the fourth probability by performing the following operations: determining a second correspondence between multiple dimension values ​​in the second target feature vector and multiple internal nodes included in the fifth model based on the feature index; comparing each dimension value in the second target feature vector with a preset splitting threshold of the internal node corresponding to each dimension value based on the second correspondence to obtain multiple second comparison results; determining branch paths for multiple dimension values ​​based on the multiple second comparison results to obtain leaf nodes corresponding to the multiple dimension values; calculating the sum of scores of the leaf nodes corresponding to the multiple dimension values, and performing a probability calibration operation on the sum to obtain the fourth probability.

[0133] Optionally, in this embodiment, the feature index refers to the dimension number used to specify the judgment basis for each internal node in the fifth model (multiple decision trees). Its value ranges from 1 to 1024, corresponding one-to-one with each semantic feature in the second target feature vector. For example, feature index "57" represents the 57th dimension in the first target feature vector, and its semantic meaning may be "the number of large transfers within 1 hour after an overseas call". Feature index "213" may represent "the density of the keyword 'safe account' in the SMS × the activation strength of dormant accounts". This index is automatically learned and generated by the model during the federated training phase based on information gain or Gini impurity, ensuring that the splitting decision focuses on the most discriminative cross-domain joint features, rather than the original low-dimensional input.

[0134] Optionally, the multiple dimension values ​​in the second target feature vector in this embodiment refer to several specific values ​​in the feature vector input to the fifth model that are referenced by the current decision tree node. For example, the value of the 57th dimension is 3.8 (indicating that the user made 3 large transfers within 1 hour after making an overseas call), and the value of the 213th dimension is 0.92 (indicating that the joint score of fraud keyword density and account activation strength is extremely high). These values ​​are all in ciphertext form after Paillier homomorphic encryption, but their relative size relationship remains unchanged in the encrypted domain, so that the decision tree can still perform secure reasoning based on threshold comparison, realizing a privacy-protected reasoning mechanism of "ciphertext can be distinguished and data is not leaked".

[0135] Optionally, the preset splitting threshold for internal nodes in this embodiment refers to the numerical splitting point automatically learned and fixed to each internal node by the federated learning algorithm based on the distribution of encrypted features during the decision tree training phase. This threshold is used to determine whether a sample should move to the left or right subtree. For example, if a node has a feature index of 57 (number of transfers after an overseas call), its splitting threshold is 2.5, meaning that when this dimension value is ≥2.5, it enters the "high-risk path," otherwise it enters the "low-risk path." This threshold is obtained by the model through gradient boosting iterative optimization on encrypted data. It does not rely on plaintext labels and is constructed solely based on the statistical distribution of encrypted features and the principle of minimizing the loss function, ensuring that the model can still construct highly discriminative splitting rules without accessing the original data.

[0136] Optionally, in this embodiment, the second correspondence refers to matching each selected dimension in the second target feature vector of the user to be judged with the feature index of its corresponding internal node in the current decision tree during the inference phase, thereby establishing a mapping relationship of "feature vector dimension → decision tree node index". For example, the 57th dimension of the user feature vector corresponds to the 3rd layer node of tree A, and the 213th dimension corresponds to the 5th layer node of tree B. This dynamic association allows each tree to extract only the feature subset most relevant to its own splitting logic, avoiding invalid calculations, improving inference efficiency, and ensuring the consistency and controllability of feature use under privacy constraints.

[0137] Optionally, the second comparison result in this embodiment refers to the binary judgment flag (e.g., "≥threshold" is 1, "<threshold" is 0) output after performing a ciphertext comparison operation on each dimension value and its corresponding node's splitting threshold during the inference process. This comparison is implemented in the encrypted domain through a secure multi-party computation protocol, such as a comparison circuit based on homomorphic encryption or a privacy-preserving sorting protocol, ensuring that the specific numerical value is not exposed and only the logical result is output. For example, when the ciphertext value of the 57th dimension is compared and "≥2.5" is found to be true (i.e., output 1), the sample continues to propagate downwards along the "high-risk branch" of that node, forming a branch decision chain of the tree path.

[0138] Optionally, the branch path in this embodiment refers to the complete judgment route from the root node to the leaf node of the decision tree, which is formed by sequentially connecting multiple second comparison results. For example: root node feature index 57 → 1 (≥2.5) → second layer feature index 213 → 1 (≥0.8) → third layer feature index 89 → 0 (<0.5), finally reaching the 15th leaf node; this path completely records the user's behavioral trajectory in the cross-domain feature space, which is the logical basis for the model to make risk judgments. Its path length and path combination reflect the complexity and hierarchy of fraudulent behavior, such as the four-step closed loop of "overseas call → SMS inducement → trial transaction → large transfer".

[0139] Optionally, in this embodiment, the leaf nodes are the final termination nodes of the decision tree. Each leaf node stores a score (e.g., -1.2, 0.3, 2.5), which is the prediction strength value obtained by optimizing in the encrypted domain through the gradient boosting algorithm during the training phase, reflecting the average fraud tendency of historical samples under this path. For example, a leaf node path is "high-frequency SMS + midnight transfer + unknown number + quick in and out of funds," and its score is 2.7, indicating that the historical fraud rate of this combination pattern is as high as 92%. This score is a real number, stored in encrypted form after federated training, and only participates in the summation operation during local decryption to ensure that the model knowledge is not leaked.

[0140] Optionally, in this embodiment, the sum of scores refers to the result of accumulating the scores of the leaf nodes output by each tree in a scenario integrating multiple decision trees. For example, if a user reaches a leaf node with a score of 2.1 through tree A, a leaf node with a score of 0.8 through tree B, and a leaf node with a score of -0.3 through tree C, the sum is 2.1 + 0.8 + (-0.3) = 2.6. This sum represents the overall assessment strength of the model on user risk, and its magnitude is positively correlated with the probability of fraud, serving as the input basis for subsequent probability calibration.

[0141] Optionally, the probability calibration operation in this embodiment refers to mapping the sum of scores output by multiple trees to a fourth probability within the 0–1 interval using a Sigmoid function or Isotonic regression, in order to solve the problems of uneven distribution and lack of probabilistic physical meaning in the original scores. For example, a sum of 2.6 is calculated by the Sigmoid function to obtain 0.93, meaning the output second probability is 93%. This process is completed in the local plaintext space and is only executed after decrypting the encrypted aggregation result, ensuring that intermediate model parameters are not leaked. At the same time, it makes the output probability interpretable and business-operable, facilitating weighted fusion with the third probability of the fourth model to ultimately form a unified risk score.

[0142] In this embodiment, the fifth model outputs a fourth probability by combining feature index matching, split threshold comparison, path tracing, and leaf node score aggregation with probability calibration. This achieves interpretable hierarchical decision-making for high-dimensional fused features, preserving model transparency without sacrificing accuracy. It makes the risk assessment process traceable and auditable, meeting the mandatory requirements of the financial and telecommunications industries for compliance and regulatory compliance of risk control models.

[0143] In an exemplary embodiment, a second fusion operation is performed on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector. This includes: performing association calculation on the transaction feature vector and the communication feature vector through a cross-domain attention mechanism to obtain a second weight coefficient, wherein the transaction feature vector serves as a query vector, and the communication feature vector serves as a key vector and a value vector, and the association calculation is used to calculate the second weight coefficients of the query vector and the key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency; and performing weighted aggregation on the value vector based on the second weight coefficients to generate the second target feature vector.

[0144] Optionally, the cross-domain attention mechanism in this embodiment is an encrypted domain feature alignment and association modeling module specifically designed for a vertical federated learning environment. To achieve privacy-preserving association between structured transaction data from the bank side and multimodal communication data from the telecommunications side, it performs an attention weight calculation and weighted aggregation process based on homomorphic encryption between the local encrypted feature vectors of both parties. Its core lies in dynamically calculating the implicit association strength between bank transaction behavior and telecommunications communication behavior through a Query-Key-Value structure without decrypting the original features.

[0145] Optionally, in this embodiment, the transaction feature vector as a query vector refers to the feature vector output by the bank. Each dimension encodes the financial behavior semantics of the user account, such as "fund concentration coefficient", "probing transaction coefficient", "dormant account activation intensity", "multi-channel limit transaction overlap", etc., representing the user's "intent tendency" at the level of fund operation. As a query, it actively initiates a retrieval request for communication behavior to ask: "Does this abnormal fund operation correspond to a high-risk communication trigger?" For example, when the value of the "probing transaction coefficient" dimension in the query vector increases significantly, the system searches on the communication side for pre-emptive signals such as "high-frequency unknown text messages" or "overseas calls".

[0146] Optionally, in this embodiment, the communication feature vector, serving as both a key and a value, refers to the multimodal feature vector output by the modified Qwen-VL-Lite model from the telecommunications side. This vector contains a joint representation of structured communication behaviors (such as the number of overseas calls and SMS frequency) and unstructured semantically enhanced text (such as keyword density and suspicious number matching weights). As a key, it is used to respond to the query and assess whether a certain communication feature is related to the current transaction behavior. As a value, it carries specific communication semantic content for subsequent weighted aggregation. For example, the combined dimension of "fraud keyword density × overseas call time correlation" in the communication vector serves as both a key for judging relevance and a value for providing supporting evidence.

[0147] Optionally, in this embodiment, the time correlation dimension refers to calculating the synchronicity weight of transaction and communication behaviors in a time series, used to capture typical fraud patterns of "fund operations occurring shortly after communication." For example, if a user receives a text message containing "safe account" at 2:15 AM (communication timestamp) and completes a large transfer at 2:17 AM (transaction timestamp), the time difference is less than 3 minutes, and the system assigns a weight of 0.92 to this dimension; if the time interval exceeds 2 hours, the weight drops to 0.15. This dimension calculates the time difference distribution of transaction and communication events and generates continuously decaying weights using a Gaussian kernel function, achieving highly sensitive identification of "instant inducement fraud" (such as "frozen funds if you don't transfer now").

[0148] Optionally, the behavioral synchronicity dimension in this embodiment refers to measuring the coordinated changing trends of transaction behavior and communication behavior in terms of frequency, intensity, and pattern, rather than relying solely on timestamps. For example, if a user receives a large number of text messages from unknown numbers at night for three consecutive days, and each day in the early morning there is a small trial transaction (e.g., 200 yuan) followed by a 50,000 yuan transfer 30 minutes later, the system determines that their "frequency synchronicity" score is 0.88; if it is only a single text message + a single transfer, the synchronicity weight is only 0.3. This dimension achieves nonlinear synchronicity modeling in the encrypted domain by calculating the covariance, Pearson correlation coefficient, or dynamic time warping (DTW) distance of two vectors within a time-series sliding window, and is used to identify "long-term inducement fraud" (e.g., "cultivating trust before harvesting").

[0149] Optionally, the semantic consistency dimension in this embodiment refers to evaluating the logical consistency between the semantic content of the transaction behavior and the communication text at the semantic level, i.e., "what the communication says, and whether the transaction does what it requires." For example, if the communication text contains keywords such as "please transfer funds to the escrow account" or "transfer is required to verify your identity," and the "recipient account type" in the transaction feature vector is "non-owner account," "off-site corporate account," or "newly registered account," and the "transfer purpose field" is empty or filled with "personal transactions," then the semantic consistency weight is as high as 0.95; if the communication is a "bank reminder" and the transaction is a daily salary deposit, then the weight is close to 0.05. This dimension achieves cross-modal semantic alignment by calculating the cosine similarity between the semantic embedding of the communication text and the semantic tags of the transaction behavior (such as "quick in and out of funds" or "multi-channel limit") within the encrypted domain.

[0150] Optionally, the second weight coefficient in this embodiment refers to the three normalized weight values ​​calculated from the above three dimensions, which sum to 1. These weights are assigned to the Value part of the communication feature vector to guide the aggregation process to focus on the most relevant fraudulent behavior signals. For example, if a user transfers money 12 minutes after an overseas call and the text message contains the keyword "deposit", then the time weight = 0.6, the semantic weight = 0.35, and the synchronization weight = 0.15. This indicates that the fraud pattern is dominated by "time urgency + semantic inducement". The system will focus on amplifying the feature dimensions corresponding to "overseas call" and "deposit" in the communication, suppressing interference from irrelevant dimensions, and achieving "precise focused fusion".

[0151] Optionally, the second target feature vector in this embodiment is the final output of the cross-domain attention mechanism, which is the result of encrypted semantic aggregation. Its essence is a risk representation after bidirectional reinforcement of "fund flow - information flow". It enables the subsequent model to identify a complete attack chain such as "first receiving a fraudulent call, then logging into online banking to change the reserved mobile phone number, and finally initiating a large transfer", rather than just identifying a single abnormal behavior. This vector is generated, transmitted and used in the encrypted domain throughout the process. The bank side cannot restore the original text message or call recording, and the telecommunications side is unaware of the transaction details. However, both parties jointly contribute joint risk knowledge that is "computable but not reproducible".

[0152] This embodiment utilizes a cross-domain attention mechanism, using transaction features as the query vector and communication features as the key and value vectors, to calculate the weights of three dimensions (temporal correlation, behavioral synchronization, and semantic consistency) and aggregate them to generate the first target feature vector. Within the encrypted domain, it accurately captures implicit collaborative patterns of fund flows and information flows (such as "transfer within one hour of an overseas call"), overcoming the limitations of traditional federated learning's shallow fusion approach that only involves simple feature concatenation or weighting. This enables deep behavioral correlation modeling across institutions and modalities, significantly improving the identification and recall rate of hidden fraud chains.

[0153] In an exemplary embodiment, performing a feature transformation operation on the transaction data of a target user to obtain a transaction feature vector includes: performing a preprocessing operation on the transaction data to obtain first data, wherein the preprocessing operation includes a normalization operation and a dimension alignment operation; calculating second data based on the first data according to a preset rule, wherein the preset rule includes at least one of the following: calculating the ratio of the transfer-in amount to the transfer-out amount to obtain a fund concentration coefficient; calculating the ratio between the first amount and the second amount within a first preset time period to obtain a trial transaction coefficient; calculating the ratio of the transaction frequency to the transaction intensity after the dormant account is activated to obtain the activation transaction intensity of the dormant account; wherein the transfer-in amount is the sum of transaction amounts with a value greater than a first threshold; the transfer-out amount is the sum of transaction amounts with a value greater than the first threshold; the first amount is the transaction amount with a value greater than the first threshold; the second amount is the transaction amount with a value less than the second threshold; and the transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account within a second preset time period after activation to the historical average transaction amount of the dormant account; and combining the first data and the second data in a preset order to obtain the transaction feature vector.

[0154] Optionally, the transaction data in this embodiment refers to structured transaction records related to the target user's account collected by the bank's core accounting system, electronic channel platform, risk control logs, and other original systems. The data granularity is at the single transaction level. It should be noted that the above transaction data are all original details retained locally by the bank and do not contain sensitive information such as customer names or ID numbers. Only account identifiers and transaction metadata are retained, complying with the de-identification requirements of the Personal Information Protection Law.

[0155] Optionally, in this embodiment, the frequency of fund transactions refers to the total number of fund transfers in and out of the account within a preset time window (such as the past 24 hours), which is used to measure abnormal account activity.

[0156] Optionally, the number of trial transactions in this embodiment refers to the number of transactions with a single amount less than the second threshold (e.g., 200 yuan) within a preset time window. This is usually a trial behavior by fraudsters to test whether the account is usable and whether the limit is effective.

[0157] Optionally, the transaction amount involved in each transaction in this embodiment refers to the original amount of each transaction, which is used to calculate derivative features such as fund concentration, probing ratio, and quick in-and-out index.

[0158] Optionally, in this embodiment, the number of transactions with a limit refers to the number of transactions where the amount of a single transaction is close to or reaches the daily / single transaction limit set by the bank (such as 90% or more of the limit). This often occurs in scenarios where fraudsters induce users to make multiple transfers in separate transactions.

[0159] Optionally, the preprocessing operation in this embodiment refers to the standardization, normalization, and alignment process performed on the original transaction data to improve feature quality and model compatibility. It includes the following two core sub-operations: normalization operation, which uses Min-Max standardization or Z-Score standardization to uniformly map the original values ​​of different units such as "transaction amount", "frequency", and "number of times" to the interval [0, 1] or [-1, 1] to eliminate the interference of unit differences on subsequent model training. For example, if a user's maximum single transaction amount is 500,000 yuan and the minimum is 0 yuan, then after normalization, the maximum value is 1, the minimum value is 0, and the intermediate value is linearly scaled; dimension alignment operation, which uniformly adjusts the transaction indicators statistically collected in different time windows (such as 7 days and 30 days) to the same dimension length (such as 1 sample per day, a total of 30 dimensions) to ensure that all user input feature vectors have a unified dimension structure (such as 32 dimensions), which is convenient for subsequent model input. For example, the "number of trial transactions in the past 7 days" and the "number of limit transactions in the past 30 days" are uniformly sampled as daily averages to form a 30-dimensional sequence for time series modeling.

[0160] Optionally, the first data in this embodiment refers to a standardized set of transaction features after normalization and dimension alignment. The data is in the form of a structured array with a fixed number of dimensions (e.g., 32 dimensions). Each dimension corresponds to a standardized original or derived indicator. For example, the first dimension is "24-hour transfer frequency (normalized)", the fifth dimension is "proportion of trial transactions (normalized)", and the twelfth dimension is "number of daily limit transactions (normalized)". This data has been noise-free and scaled uniformly, providing high-quality input for subsequent rule-driven feature engineering. It does not contain any plaintext sensitive information, satisfying the privacy premise of "local data not leaving the domain" in federated learning.

[0161] Optionally, the preset rules in this embodiment are a set of calculable and reproducible business logic formulas extracted by anti-fraud experts and risk control teams based on the characteristics of real cases. These formulas are used to mine highly discriminative derivative features from the first data, including but not limited to the following four rules: calculating the ratio of the inflow amount to the outflow amount to obtain the fund concentration coefficient, where "inflow amount" is the sum of all inflow amounts with a single amount greater than a first threshold (e.g., 5000 yuan), and "outflow amount" is the sum of all outflow amounts with a single amount greater than the first threshold. The ratio reflects a typical fraud pattern of "concentrated inflow and rapid outflow" of funds, such as "1 million yuan inflow → all transferred out within 2 hours." A ratio close to 1.0 indicates high suspicion. The ratio between the first amount and the second amount within a first preset time period is calculated to obtain the trial transaction coefficient. Here, "first amount" refers to a single transaction amount greater than the first threshold (e.g., 5000 yuan), and "second amount" refers to a single trial transaction amount less than the second threshold (e.g., 200 yuan). The ratio reflects a "trial first, then large amount" behavioral chain, such as: 10 After a trial transaction of 200 yuan, an 80,000 yuan transfer occurred. The coefficient = 80000 / 2000 = 40. The higher the coefficient, the greater the likelihood of fraud. The activation transaction intensity of a dormant account is calculated by comparing the transaction frequency to the transaction intensity after activation. Here, "dormant account" refers to an account with no transaction records in the past 6 months; "second preset time after activation" refers to the first 72 hours after activation; "transaction frequency" is the number of transactions after activation; and "transaction intensity" is the ratio of the cumulative transaction amount after activation to the account's historical average transaction amount. The ratio of the past 12 months is used to identify high-risk patterns where "zombie accounts are activated and immediately used for fraudulent transfers." For example, if the historical average is 500 yuan and the total transaction amount reaches 150,000 yuan within 3 days after activation, then the transaction intensity = 300, which is extremely high risk. The overlap of multi-channel limit transactions refers to the consistency of the frequency of transactions that reach more than 90% of the limit on a single day across mobile banking, online banking, and APP. If the limit is triggered on all three channels within 2 hours, the overlap is 1.0, indicating abnormal operation and being induced to make concentrated transfers.

[0162] Optionally, the second data in this embodiment refers to a set of high-order derived features with strong fraud discrimination power, which is calculated from the first data according to the above-mentioned preset rules. Its dimensions are independent of the first data, but its semantics are complementary, and together they constitute the core discrimination unit of the transaction feature vector. For example, the second data may include: fund concentration coefficient (1-dimensional), trial transaction coefficient (1-dimensional), dormant account activation transaction intensity (1-dimensional), multi-channel limit overlap degree (1-dimensional), etc. Each item is a dimensionless value, and its semantics have been enhanced through business rules, which is significantly better than the linear expression of the original transaction amount or frequency.

[0163] Optionally, the preset order in this embodiment refers to a fixed sequence in which the first data and the second data are arranged and combined according to a predetermined logic to adapt to the input structure of the bank-side model, so as to ensure that the model can correctly capture the hierarchical relationship of "basic behavioral features → higher-order semantic features"; for example, the preset order is: [1st-16th dimensions] are normalized original transaction indicators (such as frequency, amount, number of limit transactions, etc.), [17th-24th dimensions] are normalized derived features (such as capital concentration, trial transaction coefficient, etc.), and [25th-32nd dimensions] are behavioral time-series statistical indicators (such as 24-hour transaction volatility, proportion of transactions in the early morning).

[0164] In this embodiment, the first object acquires raw transaction data, performs normalization and dimensional alignment, and derives multiple risk coefficients based on business rules (such as fund concentration, trial transaction coefficient, and dormant / activated intensity), ultimately combining them to generate a transaction feature vector. This constructs a refined, interpretable, and business-oriented structured feature system for anti-fraud scenarios, solidifying the experience of bank risk control experts into computable model input. This effectively compensates for the shortcomings of purely data-driven models in understanding the semantics of financial behavior, significantly improving the fraud characterization capability and model interpretability of transaction-side features.

[0165] In one exemplary embodiment, calculating whether the target user has engaged in target behavior based on the second target feature vector includes: receiving an encrypted first target probability of the target user sent by the second object; performing a weighted summation operation on the decrypted first target probability and the second target probability to obtain a third target probability; comparing the third target probability with a target threshold, and determining that the target user has engaged in target behavior if the third target probability is higher than the target threshold, wherein the target threshold is a threshold that is updated in real time based on the degree of matching between the user's evaluation results in historical records and the actual situation.

[0166] Optionally, in this embodiment, the first target probability refers to the telecommunications fraud risk score for the target user output by the anti-fraud model independently trained locally by the telecommunications side (the second object) based on its encrypted communication feature vector. Its value range is [0, 1], reflecting the telecommunications side's judgment result on "communication inducement behavior". For example, when a user receives 12 text messages containing the keywords "safe account" and "verification code" within 1 hour, and the call record contains 3 high-frequency short-term calls from overseas, the first target probability output by the telecommunications side model is 0.89, which means that it believes the user is very likely to be subjected to voice or text message phishing attacks. This probability is transmitted to the bank side through a secure channel after being homomorphically encrypted by Paillier. The bank side can only decrypt its value and cannot reverse-engineer the original communication data.

[0167] Optionally, the second target probability in this embodiment refers to the comprehensive risk score generated by the bank side based on the second target feature vector after cross-domain encryption fusion, and after weighted aggregation by the fourth model (logistic regression) and the fifth model (lightweight gradient boosting tree). Its numerical range is [0, 1], reflecting the comprehensive judgment of "abnormal fund behavior" from the bank's perspective. For example, if a user account has a limit transaction across 3 channels at 2:15 am, and the fund quick in and quick out index reaches 0.97, after combining the fusion features of the telecommunications side, the second target probability output by the bank side model is 0.82, indicating that it judges that the account has high-risk transaction behavior, but it has not yet fully confirmed whether it was caused by communication inducement, and needs to be verified in conjunction with the judgment of the telecommunications side.

[0168] Optionally, in this embodiment, the decrypted first target probability refers to the plaintext value obtained by the bank in its local security sandbox environment after decrypting the first target probability transmitted by the telecommunications side using its private key. This process is only performed in a controlled encrypted computing environment, without exposing the original communication data or uploading it to any third party. The decrypted value is only used for weighted aggregation with the second target probability and is not saved or logged.

[0169] Optionally, the weighted summation operation in this embodiment refers to the linear fusion calculation process by which the bank side linearly integrates the decrypted first target probability with the second target probability generated on its own side according to preset weights. The formula is: Third target probability = α × First target probability + β × Second target probability, where α and β are weight coefficients obtained dynamically through historical matching accuracy during the federated training phase (e.g., α = 0.55, β = 0.45), reflecting the relative credibility of the telecommunications side and the bank side models under the current fraud mode. For example, when the fraud mode is mainly "SMS-induced transfer", the weight of the telecommunications side model is increased; when it is mainly "account theft + forged transfer", the weight of the bank side model increases, realizing the adaptive collaborative decision of "whoever is more accurate has a greater weight", avoiding misjudgment due to the bias of the unilateral model.

[0170] Optionally, the third target probability in this embodiment refers to the final comprehensive risk score generated after the fusion of the two-end probabilities. Its numerical range is [0, 1]. Essentially, it is the joint confidence of "communication inducement intensity" and "abnormality of funds" from a cross-institutional perspective, representing the highest consensus judgment of the current anti-fraud system on "whether the user is being defrauded". For example, when the first target probability = 0.89 (high suspicion on the telecommunications side) and the second target probability = 0.82 (significant abnormality on the bank side), the fused third target probability = 0.856, indicating that both parties jointly confirm the high risk, providing a solid basis for triggering interception. This value is better than any single judgment, significantly reducing the collaborative risk of "false alarm" (bank misjudgment) and "missed alarm" (telecommunications misjudgment).

[0171] Optionally, the target threshold in this embodiment refers to an adaptive interception threshold dynamically optimized by the reinforcement learning module based on historical evaluation results and manual review feedback. Its value is not fixed (such as 0.8 in the traditional solution), but is adjusted in real time as the fraud pattern evolves. For example, if the false positive rate among the "top 1% high-risk users" is found to be 12% recently, the system will automatically raise the threshold from 0.85 to 0.87 to tighten the interception; if the false negative rate is found to rise to 9%, the system will lower the threshold to 0.83 to improve recall. The update signal of this threshold comes from the review and labeling data of the bank's risk control and telecommunications anti-fraud platform, forming a closed-loop learning mechanism of "prediction → interception → review → feedback → threshold adjustment" to ensure that the system always maintains the optimal balance between "accuracy" and "recall".

[0172] Optionally, in this embodiment, the threshold that is updated in real time based on the matching degree between the user's evaluation results in historical records and the actual situation refers to the dynamic optimization basis of the target threshold being derived from the long-term alignment statistics of the "model prediction label" and the "final confirmation label". For example, in the past week, the system marked 2,100 high-risk accounts. After review, it was found that 252 of them were misjudged (actually normal), while 187 were missed (real fraud that was not intercepted). Based on this, the system calculates the downward trend of the F1-score, triggers a strategy update, and automatically adjusts the threshold to optimize the evaluation performance in the next cycle. This mechanism completely gets rid of the rigidity of misjudgment and the lag in missed judgment caused by the traditional static threshold "one-size-fits-all" approach, enabling the anti-fraud system to have the ability to "self-evolve".

[0173] In this embodiment, after receiving the encrypted first target probability from the telecom side, the bank decrypts it only in its local security sandbox and performs a weighted summation with the second target probability generated by itself to obtain the third target probability. Then, based on a dynamic threshold provided in real-time feedback, it determines whether to trigger the target behavior. This mechanism achieves "dual-end collaborative evaluation and single-end final decision-making," integrating the telecom side's experience in judging communication inducements while retaining the bank's deep understanding of financial behavior, avoiding misjudgments by a single institution. The dynamic threshold is continuously optimized by the reinforcement learning model based on the review results (such as false positive rate and false negative rate), achieving a closed-loop evolution of "identification-feedback-adjustment," completely solving the problems of false positive rigidity and false negative lag caused by traditional fixed thresholds, enabling the anti-fraud system to have adaptive evolution capabilities.

[0174] Figure 4This is a flowchart illustrating the process of determining whether a target behavior has occurred based on vertical federated learning and a multimodal large model, according to an embodiment of this application. A large provincial commercial bank and a provincial telecommunications operator jointly deployed a "Bank-Telecommunications Cross-Domain Anti-Fraud Collaboration Platform" to identify potential telecommunications fraud behaviors (i.e., the aforementioned target behavior) in real time. On the platform, the bank side possesses structured transaction data (such as transfer records and channel behavior) of 500,000 customers, while the telecommunications side possesses the corresponding users' communication data (such as call records and SMS texts). One day, the system detected that a 65-year-old customer (account number ending in 8823) suddenly activated an account that had been dormant for 18 months at 22:45 and completed three cross-channel transfers close to the daily limit within 10 minutes, totaling 52,000 yuan. Simultaneously, their mobile phone number received three short-term calls from the Philippines between 22:30 and 22:44, and received 11 SMS messages containing keywords such as "safe account" and "regulatory verification." Figure 4 As shown, the system achieves accurate fraud identification by performing the following steps:

[0175] In step S402, the telecom side inputs the target user's structured communication data (number of overseas calls = 3, number of very short calls = 3, number of unknown text messages = 11, nighttime sending rate = 79%) and unstructured text data (full text of 11 text messages) into the locally deployed first model (customized Qwen-VL-Lite) to obtain the communication feature vector. Specifically, the first network (structured encoder) in the first model normalizes the above structured features and inputs them into the fully connected layer, outputting a 256-dimensional communication behavior anomaly vector (i.e., the above first vector). The second network (text encoder) performs word segmentation, semantic matching, and keyword weighting on the text message content to identify high-risk semantics such as safe account, regulated account, and immediate transfer, outputting a 256-dimensional semantic inducement vector (i.e., the above second vector). The third network (cross-modal fusion device) concatenates the two 256-dimensional vectors into a 512-dimensional vector and performs cross-enhancement through a lightweight attention mechanism to generate the final 512-dimensional communication feature vector (i.e., the above communication feature vector).

[0176] In step S404, the bank sends the target user's transaction feature vector (512-dimensional) to the telecommunications side in homomorphic encryption through a secure channel, and the telecommunications side sends the target user's communication feature vector to the bank side in homomorphic encryption through a secure channel. The transaction feature vector includes a fund concentration coefficient of 0.96, a trial transaction coefficient of 42.8, a multi-channel limit overlap of 1.0, and a dormant account activation strength of 5.3.

[0177] In step S406, both the telecommunications side and the bank side use the transaction feature vector as the query vector and the communication feature vector as the key vector and value vector in the encrypted domain to perform a fusion operation, thereby generating the first target feature vector and the second target feature vector respectively.

[0178] In step S408, the bank side and the telecom side respectively use their locally deployed models (logistic regression and lightweight GBDT) to generate the first target probability and the second target probability using the first target feature vector and the second target feature vector. The telecom side outputs the first target probability of 0.89, and the bank side outputs the second target probability of 0.83.

[0179] Step S410: The telecommunications side encrypts the first target probability and sends the encrypted first target probability to the bank side;

[0180] In step S412, the bank decrypts the first target probability and sums them by weight (the weight corresponding to the second target probability is 0.55, and the weight corresponding to the first target probability is 0.45) to obtain the third target probability of 0.857.

[0181] In step S414, the bank compares the probability of the third target with the dynamic target threshold (currently 0.85). If the probability of the third target is higher than the target threshold, the target user has engaged in the target behavior. Since 0.856 > 0.85, it is determined that the user has engaged in telecommunications fraud. The system immediately triggers a two-way linkage response: the bank freezes all transfer permissions of the account and sends a warning SMS, while the telecommunications side temporarily suspends the associated overseas number and reports it to the national anti-fraud platform.

[0182] This optional example demonstrates a fully closed-loop intelligent anti-fraud system for banks and telecommunications companies. It achieves zero data sharing and zero privacy leakage by employing three core innovations: multimodal large-scale modeling of communication inducements, encrypted domain attention mechanism capturing cross-domain causal chains, and dual-model collaborative prediction combined with reinforcement learning dynamic thresholding. This system constructs a closed-loop "identification-fusion-judgment-interception-feedback" system. Compared to traditional solutions relying on rule engines or one-sided models, this example solves the problem in related technologies where relying on single-modal data cannot accurately determine whether a target user has engaged in targeted behavior, achieving the technical effect of accurately judging whether a target user has engaged in targeted behavior.

[0183] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0184] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0185] According to another aspect of the embodiments of this application, an apparatus for calculating whether a target behavior has occurred is also provided. This apparatus can be used to implement the method for calculating whether a target behavior has occurred provided in the above embodiments, and will not be repeated hereafter. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0186] Figure 5 This is a structural block diagram of an apparatus for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 1 ,like Figure 5 As shown, the device includes:

[0187] The input module 52 is used to input the structured communication data and unstructured text data of the target user into the first model to obtain the communication feature vector output by the first model. The first model includes a first network, a second network and a third network. The first network and the second network are set in parallel and there is no direct connection between the first network and the second network. The output end of the first network is connected to the input end of the third network, and the output end of the second network is connected to the input end of the third network. The third network is used to fuse the first vector output by the first network based on the structured communication data and the second vector output by the second network based on the unstructured text data to obtain the communication feature vector.

[0188] The fusion module 54 is used to perform a first fusion operation on the aforementioned communication feature vector and the aforementioned target user's transaction feature vector to obtain a first target feature vector. The aforementioned transaction feature vector is a feature vector sent by the first object in encrypted form, and is obtained by the first object through the following operations: acquiring the target user's transaction data, including the frequency of fund transfers, the number of trial transactions, the transaction amount involved in each transaction, and the number of limit transactions; performing a preprocessing operation on the aforementioned transaction data to obtain first data, including normalization and dimension alignment; and calculating second data based on the first data according to a preset rule, wherein the preset rule includes at least one of the following: calculating the transfer amount and the transfer amount... The ratio is used to obtain the fund concentration coefficient. The ratio between the first amount and the second amount within a first preset time period is calculated to obtain the trial transaction coefficient. The ratio of the transaction frequency and transaction intensity after the dormant account is activated is calculated to obtain the activation transaction intensity of the dormant account. The inflow amount is the sum of transaction amounts with a value greater than the first threshold. The outflow amount is the sum of transaction amounts with a value greater than the first threshold. The first amount is the transaction amount with a value greater than the first threshold. The second amount is the transaction amount with a value less than the second threshold. The transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account within a second preset time period after activation to the historical average transaction amount of the dormant account. The first data and the second data are combined in a preset order to obtain the transaction feature vector.

[0189] The calculation module 56 is used to calculate whether the target user has performed the target behavior based on the first target feature vector.

[0190] It should be noted that the input module 52 in this embodiment can be used to perform the above-described step S202, the fusion module 54 in this embodiment can be used to perform the above-described step S204, and the calculation module 56 in this embodiment can be used to perform the above-described step S206. The above-described apparatus can be installed in the device used by the second object.

[0191] The first network is used to perform normalization and mapping operations on the structured communication data to obtain a first vector. The normalization operation maps the structured communication data to a uniform numerical range with a mean of 0 and a variance of 1 to obtain a third vector. The mapping operation generates the first vector by combining the risk of the structured communication data in the time dimension. The second network is used to perform a first operation on the unstructured text data to obtain a second vector. The first operation includes adding semantic weights to keywords in the unstructured text data based on a target vocabulary, and setting weights for caller ID numbers in the unstructured text data based on the matching degree between the caller ID numbers in the unstructured text data and phone numbers in a suspicious phone number database. The suspicious phone number database stores phone numbers marked as risky.

[0192] In an exemplary embodiment, the calculation module 56 is further configured to simultaneously input the first target feature vector into the second model and the third model to obtain a first probability output by the second model and a second probability output by the third model. The second model is configured to perform linear weighted calculation on the first target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the first probability. The third model includes multiple decision trees, each including multiple internal nodes and multiple leaf nodes. Each internal node has a preset splitting threshold and a feature index, and each feature index corresponds to a dimension of the first target feature vector. The first probability and the second probability are weighted and aggregated according to preset weights to generate a first target probability. Based on the first target probability, it is determined whether the target user has performed the target behavior.

[0193] In an exemplary embodiment, the apparatus is further configured to obtain the second probability by performing the following operations: determining a first correspondence between multiple dimension values ​​in the first target feature vector and multiple internal nodes included in the third model based on the feature index; comparing each dimension value in the first target feature vector with a preset splitting threshold of the internal node corresponding to each dimension value based on the first correspondence to obtain multiple first comparison results; determining branch paths of multiple dimension values ​​based on the multiple first comparison results to obtain leaf nodes corresponding to the multiple dimension values; calculating the sum of the scores of the leaf nodes corresponding to the multiple dimension values, and performing a probability calibration operation on the sum to obtain the second probability.

[0194] In an exemplary embodiment, the fusion module 54 is further configured to perform association calculation on the transaction feature vector and the communication feature vector through a cross-domain attention mechanism to obtain a first weight coefficient, wherein the transaction feature vector serves as a query vector, the communication feature vector serves as a key vector and a value vector, and the association calculation is used to calculate the first weight coefficient of the query vector and the key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency; and to perform weighted aggregation on the value vector based on the first weight coefficient to generate the first target feature vector.

[0195] Figure 6 This is a structural block diagram of an apparatus for calculating whether a target behavior has occurred according to an embodiment of this application. Figure 2 ,like Figure 6 As shown, the device includes:

[0196] The conversion module 62 is used to perform feature conversion operations on the target user's transaction data to obtain a transaction feature vector;

[0197] The fusion module 64 is used to perform a second fusion operation on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector, wherein the communication feature vector is a feature vector sent by the second object in encrypted form.

[0198] The calculation module 66 is used to calculate whether the target user has performed the target behavior based on the second target feature vector.

[0199] It should be noted that the conversion module 62 in this embodiment can be used to perform the above-described step S302, the fusion module 64 in this embodiment can be used to perform the above-described step S304, and the calculation module 66 in this embodiment can be used to perform the above-described step S306. The above-described apparatus can be installed in the device used by the first object.

[0200] In an exemplary embodiment, the calculation module 66 is further configured to simultaneously input the second target feature vector into the fourth model and the fifth model to obtain the third probability output by the fourth model and the fourth probability output by the fifth model. The fourth model is configured to perform linear weighted calculation on the second target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the third probability. The fifth model includes multiple decision trees, each including multiple internal nodes and multiple leaf nodes. Each internal node has a preset splitting threshold and a feature index, and each feature index corresponds to a dimension of the second target feature vector. The third probability and the fourth probability are weighted and aggregated according to preset weights to generate a second target probability. Based on the second target probability, it is determined whether the target user has performed the target behavior.

[0201] In an exemplary embodiment, the apparatus is further configured to obtain the fourth probability by performing the following operations: determining a second correspondence between multiple dimension values ​​in the second target feature vector and multiple internal nodes included in the fifth model based on the feature index; comparing each dimension value in the second target feature vector with a preset splitting threshold of the internal node corresponding to each dimension value based on the second correspondence to obtain multiple second comparison results; determining branch paths of multiple dimension values ​​based on the multiple second comparison results to obtain leaf nodes corresponding to the multiple dimension values; calculating the sum of the scores of the leaf nodes corresponding to the multiple dimension values, and performing a probability calibration operation on the sum to obtain the fourth probability.

[0202] In an exemplary embodiment, the fusion module 64 is further configured to perform association calculation on the transaction feature vector and the communication feature vector through a cross-domain attention mechanism to obtain a second weight coefficient, wherein the transaction feature vector serves as a query vector, the communication feature vector serves as a key vector and a value vector, and the association calculation is used to calculate the second weight coefficients of the query vector and the key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency; and the value vector is weighted and aggregated based on the second weight coefficients to generate the second target feature vector.

[0203] In an exemplary embodiment, the conversion module 62 is further configured to perform preprocessing operations on the transaction data to obtain first data, wherein the preprocessing operations include normalization operations and dimension alignment operations; calculate second data based on the first data according to preset rules, wherein the preset rules include at least one of the following: calculating the ratio of the transfer-in amount to the transfer-out amount to obtain a fund concentration coefficient; calculating the ratio between the first amount and the second amount within a first preset time period to obtain a trial transaction coefficient; calculating the ratio of the transaction frequency to the transaction intensity after the dormant account is activated to obtain the activation transaction intensity of the dormant account; wherein the transfer-in amount is the sum of transaction amounts with a value greater than a first threshold; the transfer-out amount is the sum of transaction amounts with a value greater than the first threshold; the first amount is the transaction amount with a value greater than the first threshold; the second amount is the transaction amount with a value less than the second threshold; and the transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account within a second preset time period after activation to the historical average transaction amount of the dormant account; and combine the first data and the second data in a preset order to obtain the transaction feature vector.

[0204] In an exemplary embodiment, the calculation module 66 is further configured to receive the encrypted first target probability of the target user sent by the second object; perform a weighted summation operation on the decrypted first target probability and the second target probability to obtain a third target probability; compare the third target probability with a target threshold, and determine that the target user has engaged in target behavior if the third target probability is higher than the target threshold, wherein the target threshold is a threshold that is updated in real time based on the degree of matching between the user's evaluation results in historical records and the actual situation.

[0205] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0206] According to another aspect of the embodiments of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein the program executes the steps in any of the above method embodiments when it is run.

[0207] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0208] According to another aspect of the embodiments of this application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor is configured to perform the steps of any of the method embodiments described above via the computer program. In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0209] Specific examples in this embodiment can be found in the examples described in the above embodiments and exemplary implementations, and will not be repeated here.

[0210] According to another aspect of the embodiments of this application, a computer program product is also provided, comprising a computer program / instructions containing program code for performing the methods shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit 701, it performs various functions provided in the embodiments of this application. The sequence numbers of the embodiments of this application above are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0211] Figure 7 This is a computer system architecture block diagram of an electronic device according to an embodiment of this application. For example... Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can determine the data stored in ROM (corresponding to...). Figure 7 The program is stored in the read-only memory 702 or loaded from the storage section 708 into the RAM (corresponding to the read-only memory 702). Figure 7 The system executes various appropriate actions and processes by storing programs in the random access memory (RAM) 703. The RAM 703 also stores various programs and data required for system operation. The central processing unit 701, the read-only memory 702, and the RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0212] The following components are connected to the I / O interface (corresponding to...) Figure 7 The input / output interface 705 includes an input section 706 such as a keyboard and mouse; an output section 707 including devices such as a cathode ray tube (CRT), a liquid crystal display (LCD), and speakers; a storage section 708 including a hard disk; and a communication section 709 including network interface cards such as LAN cards and modems. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the input / output interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 710 as needed so that computer programs read from it can be installed into the storage section 708 as needed.

[0213] Specifically, according to embodiments of this application, the processes described in the various method flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit 701, it performs various functions defined in the system of this application.

[0214] It should be noted that, Figure 7The computer system 700 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0215] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. They can be implemented using computer-executable program code, and thus can be stored in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those described herein, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0216] The above are merely preferred embodiments of this application and are not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for calculating whether a target behavior has occurred, characterized in that, include: Structured communication data and unstructured text data of the target user are input into a first model to obtain a communication feature vector output by the first model. The first model includes a first network, a second network, and a third network. The first network and the second network are set in parallel and there is no direct connection between the first network and the second network. The output of the first network is connected to the input of the third network, and the output of the second network is connected to the input of the third network. The third network is used to fuse the first vector output by the first network based on the structured communication data and the second vector output by the second network based on the unstructured text data to obtain the communication feature vector. A first fusion operation is performed on the communication feature vector and the transaction feature vector of the target user to obtain a first target feature vector, wherein the transaction feature vector is a feature vector sent by the first object in encrypted form; Calculate whether the target user has performed the target behavior based on the first target feature vector.

2. The method according to claim 1, characterized in that, The first network is used to perform normalization and mapping operations on the structured communication data to obtain a first vector. The normalization operation is used to map the structured communication data to a uniform numerical range with a mean of 0 and a variance of 1 to obtain a third vector. The mapping operation is used to generate the first vector by combining the risk of the structured communication data in the time dimension. The second network is used to perform a first operation on the unstructured text data to obtain a second vector, wherein the first operation includes an operation to increase the semantic weight of keywords in the unstructured text data based on a target vocabulary, and an operation to set the weight of the caller number in the unstructured text data based on the matching degree between the caller number in the unstructured text data and the phone numbers in a suspicious phone database, wherein the suspicious phone database stores phone numbers marked as risky.

3. The method according to claim 1, characterized in that, Calculating whether the target user has engaged in the target behavior based on the first target feature vector includes: The first target feature vector is simultaneously input into the second model and the third model to obtain the first probability output by the second model and the second probability output by the third model. The second model is used to perform linear weighted calculation on the first target feature vector based on homomorphic addition and homomorphic multiplication to obtain the first probability. The third model includes multiple decision trees. Each decision tree includes multiple internal nodes and multiple leaf nodes. Each internal node has a preset splitting threshold and a feature index. One feature index corresponds to a dimension of the first target feature vector. The first probability and the second probability are weighted and aggregated according to a preset weight to generate a first target probability; Based on the first target probability, determine whether the target user has performed the target behavior.

4. The method according to claim 3, characterized in that, The third model obtains the second probability by performing the following operation: Based on the feature index, a first correspondence is determined between multiple dimension values ​​in the first target feature vector and multiple internal nodes included in the third model; Based on the first correspondence, each dimension value in the first target feature vector is compared with the preset splitting threshold of the internal node corresponding to each dimension value to obtain multiple first comparison results; Based on multiple first comparison results, branch paths for multiple dimension values ​​are determined to obtain leaf nodes corresponding to multiple dimension values; Calculate the sum of the scores of the leaf nodes corresponding to the multiple dimension values, and perform a probability calibration operation on the sum to obtain the second probability.

5. The method according to claim 1, characterized in that, Perform a first fusion operation on the communication feature vector and the transaction feature vector of the target user sent by the first object to obtain a first target feature vector, including: The transaction feature vector and the communication feature vector are correlated and calculated using a cross-domain attention mechanism to obtain a first weight coefficient. The transaction feature vector serves as a query vector, and the communication feature vector serves as a key vector and a value vector. The correlation calculation is used to calculate the first weight coefficient of the query vector and the key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency. The value vector is weighted and aggregated based on the first weight coefficient to generate the first target feature vector.

6. The method according to claim 1, characterized in that, The transaction feature vector is obtained by the first object through the following operation: Obtain the transaction data of the target user, wherein the transaction data includes the frequency of fund transactions, the number of trial transactions, the transaction amount involved in each transaction, and the number of transactions within the limit; Perform preprocessing operations on the transaction data to obtain first data, wherein the preprocessing operations include normalization operations and dimension alignment operations; Based on the first data, the second data is calculated according to preset rules, wherein the preset rules include at least one of the following: calculating the ratio of the transfer-in amount to the transfer-out amount to obtain the fund concentration coefficient; calculating the ratio between the first amount and the second amount within a first preset time period to obtain the trial transaction coefficient; calculating the ratio of the transaction frequency to the transaction intensity after the dormant account is activated to obtain the activation transaction intensity of the dormant account; wherein the transfer-in amount is the sum of transaction amounts with a value greater than a first threshold; the transfer-out amount is the sum of transaction amounts with a value greater than the first threshold; the first amount is the transaction amount with a value greater than the first threshold; the second amount is the transaction amount with a value less than the second threshold; and the transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account within a second preset time period after activation to the historical average transaction amount of the dormant account. The first data and the second data are combined in a preset order to obtain the transaction feature vector.

7. A method for calculating whether a target behavior has occurred, characterized in that, include: Perform feature transformation operations on the target user's transaction data to obtain a transaction feature vector; A second fusion operation is performed on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector, wherein the communication feature vector is a feature vector sent by the second object in encrypted form; Calculate whether the target user has performed the target behavior based on the second target feature vector.

8. The method according to claim 7, characterized in that, Calculating whether the target user has engaged in the target behavior based on the second target feature vector includes: The second target feature vector is simultaneously input into the fourth model and the fifth model to obtain the third probability output by the fourth model and the fourth probability output by the fifth model. The fourth model is used to perform linear weighted calculation on the second target feature vector based on homomorphic addition and homomorphic multiplication operations to obtain the third probability. The fifth model includes multiple decision trees, each of which includes multiple internal nodes and multiple leaf nodes. Each internal node has a preset splitting threshold and a feature index. One feature index corresponds to a dimension of the second target feature vector. The third probability and the fourth probability are weighted and aggregated according to a preset weight to generate a second target probability; Based on the second target probability, it is determined whether the target user will engage in the target behavior.

9. The method according to claim 8, characterized in that, The fifth model obtains the fourth probability by performing the following operation: Based on the feature index, a second correspondence is determined between multiple dimension values ​​in the second target feature vector and multiple internal nodes included in the fifth model; Based on the second correspondence, each dimension value in the second target feature vector is compared with the preset splitting threshold of the internal node corresponding to each dimension value to obtain multiple second comparison results; Based on multiple second comparison results, branch paths for multiple dimension values ​​are determined to obtain leaf nodes corresponding to multiple dimension values; The sum of the scores of the leaf nodes corresponding to the multiple dimension values ​​is calculated, and a probability calibration operation is performed on the sum to obtain the fourth probability.

10. The method according to claim 7, characterized in that, A second fusion operation is performed on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector, including: The transaction feature vector and the communication feature vector are correlated and calculated using a cross-domain attention mechanism to obtain a second weight coefficient. The transaction feature vector serves as a query vector, and the communication feature vector serves as a key vector and a value vector. The correlation calculation is used to calculate the second weight coefficient of the query vector and the key vector in three dimensions: temporal correlation, behavioral synchronization, and semantic consistency. The value vector is weighted and aggregated based on the second weight coefficient to generate the second target feature vector.

11. The method according to claim 7, characterized in that, Perform feature transformation operations on the target user's transaction data to obtain a transaction feature vector, including: Perform preprocessing operations on the transaction data to obtain first data, wherein the preprocessing operations include normalization operations and dimension alignment operations; Based on the first data, the second data is calculated according to preset rules, wherein the preset rules include at least one of the following: calculating the ratio of the transfer-in amount to the transfer-out amount to obtain the fund concentration coefficient; calculating the ratio between the first amount and the second amount within a first preset time period to obtain the trial transaction coefficient; calculating the ratio of the transaction frequency to the transaction intensity after the dormant account is activated to obtain the activation transaction intensity of the dormant account; wherein the transfer-in amount is the sum of transaction amounts with a value greater than a first threshold; the transfer-out amount is the sum of transaction amounts with a value greater than the first threshold; the first amount is the transaction amount with a value greater than the first threshold; the second amount is the transaction amount with a value less than the second threshold; and the transaction intensity is used to represent the ratio of the cumulative transaction amount of the dormant account within a second preset time period after activation to the historical average transaction amount of the dormant account. The first data and the second data are combined in a preset order to obtain the transaction feature vector.

12. The method according to claim 7, characterized in that, Calculating whether the target user has engaged in the target behavior based on the second target feature vector includes: Receive the encrypted first target probability of the target user sent by the second object; A weighted summation operation is performed on the decrypted first target probability and the second target probability to obtain the third target probability; The third target probability is compared with the target threshold, and if the third target probability is higher than the target threshold, it is determined that the target user has committed the target behavior. The target threshold is a threshold that is updated in real time based on the degree of matching between the user's evaluation results in the historical records and the actual situation.

13. A probability generation device, characterized in that, include: An input module is used to input structured communication data and unstructured text data of the target user into a first model to obtain a communication feature vector output by the first model. The first model includes a first network, a second network, and a third network. The first network and the second network are set in parallel and there is no direct connection between the first network and the second network. The output end of the first network is connected to the input end of the third network, and the output end of the second network is connected to the input end of the third network. The third network is used to fuse the first vector output by the first network based on the structured communication data and the second vector output by the second network based on the unstructured text data to obtain the communication feature vector. A fusion module is used to perform a first fusion operation on the communication feature vector and the transaction feature vector of the target user to obtain a first target feature vector, wherein the transaction feature vector is a feature vector sent by the first object in encrypted form; The calculation module is used to calculate whether the target user has performed the target behavior based on the first target feature vector.

14. An apparatus for calculating whether a target behavior has occurred, characterized in that, include: The conversion module is used to perform feature conversion operations on the target user's transaction data to obtain a transaction feature vector. The fusion module is used to perform a second fusion operation on the transaction feature vector and the communication feature vector of the target user to obtain a second target feature vector, wherein the communication feature vector is a feature vector sent by the second object in encrypted form; The calculation module is used to calculate whether the target user has performed the target behavior based on the second target feature vector.

15. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6, or the steps of the method according to any one of claims 7 to 12.

16. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to any one of claims 7 to 12.

17. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6, or the steps of the method according to any one of claims 7 to 12.

Images