Abnormality risk identification method and device, electronic equipment, medium and program product

Abstract

This application provides an anomaly risk identification method, apparatus, electronic device, medium, and program product, relating to the application of large-scale models in fintech scenarios, and applicable to the fields of big data technology, artificial intelligence technology, and fintech. The method includes: constructing a user profile based on historical transaction data of a target account; constructing an account transaction graph based on real-time transaction data of the target account; identifying a target transaction path corresponding to the target transaction based on the account transaction graph; and identifying anomaly risks of the target transaction based on the user profile and the target transaction path.

Description

Technical Field

[0001] This application relates to the application of large models in fintech scenarios, which can be applied to the fields of big data technology, artificial intelligence technology and fintech, and more specifically to an anomaly risk identification method, device, equipment, medium and program product. Background Technology

[0002] With the development of mobile internet and electronic payment technologies, digital payment has become a core component of banking operations. Mobile payment, biometric payment, and QR code transactions have greatly enhanced the user experience. However, the increasing diversification of payment scenarios has also led to the rapid evolution of abnormal attack methods. Especially in transactions involving remote operation, login from different locations, and switching between multiple devices, traditional risk control mechanisms based on rule engines and static thresholds are no longer sufficient to meet the requirements of real-time performance and accuracy.

[0003] Existing anti-anomaly systems generally suffer from the following problems: they cannot dynamically adapt to rapid changes in abnormal behavior patterns; at the same time, they lack the ability to model and analyze account network structures and transaction paths, which can easily lead to "falsely excluding normal users" or "allowing hidden anomalies"; in addition, it is difficult to achieve cross-institutional risk model collaboration without exposing user data; and after the system identifies anomalies, it cannot be effectively intervened and continuously optimized by human intervention. Summary of the Invention

[0004] In view of the above problems, this application provides methods, apparatus, equipment, media and program products for identifying abnormal risks.

[0005] According to a first aspect of this application, an abnormal risk identification method is provided, the method comprising: constructing a user profile based on historical transaction data of a target account; constructing an account transaction graph based on real-time transaction data of the target account; identifying a target transaction path corresponding to the target transaction based on the account transaction graph; and identifying abnormal risks of the target transaction based on the user profile and the target transaction path.

[0006] According to an embodiment of this application, the step of constructing a user profile based on the historical transaction data of a target account includes: extracting structured transaction features and time-series transaction features from the historical transaction data; inputting the structured transaction features into a first channel of a deep learning model for processing, and inputting the time-series transaction features into a second channel of a deep learning model for processing; and fusing the output features of the first channel and the second channel to obtain target behavior features, and constructing the user profile based on the target behavior features.

[0007] According to an embodiment of this application, the account transaction graph is a single graph structure or a dynamic graph sequence composed of multiple single graph structures generated under a sliding time window. The single graph structure includes multiple nodes and multiple edges. The multiple nodes include at least a payment account and a receiving account, and the multiple edges include at least directed edges representing transaction behavior between the payment account and the receiving account.

[0008] According to an embodiment of this application, the method further includes: inputting the account transaction graph into a graph convolutional neural network model; and using the graph convolutional neural network model to perform embedding representation learning on the plurality of nodes to generate embedding representation vectors corresponding to the plurality of nodes, wherein the embedding representation vectors are used at least to characterize the transaction behavior patterns of the plurality of nodes in the transaction network.

[0009] According to an embodiment of this application, the step of using the graph convolutional neural network model to learn the embedding representation of the plurality of nodes and generate the embedding representation vector corresponding to the plurality of nodes includes: for each of the plurality of nodes: obtaining node features and neighbor node features; aggregating the node features and neighbor node features to generate a context representation of the corresponding node; obtaining the edge attributes of the corresponding edge; and performing multi-layer propagation calculation based on the context representation and the edge attributes to generate the embedding representation vector.

[0010] According to an embodiment of this application, the step of identifying abnormal risks of the target transaction based on the user profile and the target transaction path includes: modeling the target transaction path to generate a transaction path vector; jointly inputting the transaction path vector and the user profile vector into a risk scoring model to output a scoring result; and identifying abnormal risks of the target transaction based on the scoring result.

[0011] According to an embodiment of this application, modeling the target transaction path and generating a transaction path vector includes: performing weighted aggregation of the target node features and corresponding neighbor node features for each hop in the target transaction path based on a graph attention network, wherein the weight of the weighted aggregation is obtained by dynamically learning the target node features and the neighbor node features after concatenation through an attention mechanism; and fusing the weighted aggregation results using a multi-head attention mechanism to generate the transaction path vector.

[0012] According to an embodiment of this application, the method further includes: training a risk scoring model based on local customer transaction data of each branch node in multiple branch nodes to obtain local model parameters; and sending the local model parameters to a central server, whereby the central server aggregates the multiple local model parameters to generate a global model, and distributes the global model to each branch node.

[0013] A second aspect of this application provides an anomaly risk identification device, the device comprising: a user profile construction module, configured to: construct a user profile based on historical transaction data of a target account; an account transaction graph construction module, configured to: construct an account transaction graph based on real-time transaction data of the target account; a target transaction path identification module, configured to: identify a target transaction path corresponding to the target transaction based on the account transaction graph; and an anomaly risk identification module, configured to: identify anomalies in the target transaction based on the user profile and the target transaction path.

[0014] According to embodiments of this application, the user profile construction module can also be used to extract structured transaction features and time-series transaction features from the historical transaction data; input the structured transaction features into the first channel of the deep learning model for processing, input the time-series transaction features into the second channel of the deep learning model for processing; and fuse the output features of the first channel and the second channel to obtain target behavior features, and construct the user profile based on the target behavior features.

[0015] According to embodiments of this application, the account transaction graph is a single graph structure or a dynamic graph sequence composed of multiple single graph structures generated under a sliding time window. The single graph structure includes multiple nodes and multiple edges. The multiple nodes include at least a payment account and a receiving account, and the multiple edges include at least directed edges representing transaction behavior between the payment account and the receiving account. The account transaction graph construction module can also be used to input the account transaction graph into a graph convolutional neural network model; and to use the graph convolutional neural network model to perform embedding representation learning on the multiple nodes, generating embedding representation vectors corresponding to the multiple nodes. These embedding representation vectors at least characterize the transaction behavior patterns of the multiple nodes in the transaction network.

[0016] According to embodiments of this application, the account transaction graph construction module can also be used for each of the plurality of nodes to: obtain node features and neighbor node features; aggregate the node features and neighbor node features to generate a context representation of the corresponding node; obtain the edge attributes of the corresponding edge; and perform multi-layer propagation calculation based on the context representation and the edge attributes to generate the embedding representation vector.

[0017] According to an embodiment of this application, the target transaction path identification module can also be used to model the target transaction path and generate a transaction path vector; input the transaction path vector and the user profile vector into a risk scoring model and output a scoring result; and identify abnormal risks of the target transaction based on the scoring result.

[0018] According to an embodiment of this application, the target transaction path identification module can also be used to perform weighted aggregation of the target node features and the corresponding neighbor node features of each hop in the target transaction path based on a graph attention network, wherein the weight of the weighted aggregation is obtained by concatenating the target node features and the neighbor node features and then dynamically learning through an attention mechanism; and to fuse the weighted aggregation results using a multi-head attention mechanism to generate the transaction path vector.

[0019] According to embodiments of this application, the abnormal risk identification device further includes a federated learning module. The federated learning module can be used to train a risk scoring model based on local customer transaction data of each branch node in multiple branch nodes to obtain local model parameters; and to send the local model parameters to a central server, whereby the central server aggregates the multiple local model parameters to generate a global model, and distributes the global model to each branch node.

[0020] A third aspect of this application provides an electronic device comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the method described above.

[0021] A fourth aspect of this application also provides a computer-readable storage medium having a computer program or instructions stored thereon, which, when executed by a processor, implement the steps of the above-described method.

[0022] The fifth aspect of this application also provides a computer program product, including a computer program or instructions that, when executed by a processor, implement the steps of the above-described method.

[0023] According to embodiments of this application, by constructing user profiles based on historical transaction data, the long-term behavioral preferences and transaction patterns of accounts are comprehensively reflected, improving the stability and personalization capabilities of risk modeling. Simultaneously, the introduction of an account transaction graph and target transaction path identification mechanism enables efficient structural abstraction of transaction behavior and path-level focused processing, avoiding the traversal of redundant information across the entire graph and effectively improving model response speed and real-time identification capabilities. Furthermore, by comprehensively considering users' historical behavior and current transaction context, the accuracy and interpretability of risk judgment are improved, enhancing the credibility and understandability of the system output results, thereby achieving faster feedback and a better user experience. Attached Figure Description

[0024] The above-mentioned contents, other objects, features and advantages of this application will become clearer from the following description of embodiments with reference to the accompanying drawings, in which:

[0025] Figure 1The illustrations depict application scenarios of the abnormal risk identification method, apparatus, device, medium, and program products according to embodiments of this application.

[0026] Figure 2 A flowchart illustrating an anomaly risk identification method according to an embodiment of this application is shown schematically.

[0027] Figure 3 The flowchart illustrating a method for constructing and projecting an account transaction graph according to some exemplary embodiments of this application is shown schematically.

[0028] Figure 4 The flowchart illustrates a method for abnormal path identification and scoring using a graph neural network according to some exemplary embodiments of this application.

[0029] Figure 5 A schematic diagram illustrating the structure of an anomaly risk identification device according to an embodiment of this application is shown; and

[0030] Figure 6 A block diagram of an electronic device suitable for implementing an anomaly risk identification method according to an embodiment of this application is shown schematically. Detailed Implementation

[0031] The embodiments of this application will now be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of this application. In the following detailed description, numerous specific details are set forth to provide a thorough understanding of the embodiments of this application for ease of explanation. However, it will be apparent that one or more embodiments may be implemented without these specific details. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concepts of this application.

[0032] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of this application. The terms “comprising,” “including,” etc., as used herein indicate the presence of the stated features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0033] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein are to be interpreted in a manner consistent with the context of this specification, and not in an idealized or overly rigid way.

[0034] When using expressions such as "at least one of A, B and C", they should generally be interpreted in accordance with the meaning that is commonly understood by those skilled in the art (e.g., "a system having at least one of A, B and C" should include, but is not limited to, a system having A alone, a system having B alone, a system having C alone, a system having A and B, a system having A and C, a system having B and C, and / or a system having A, B and C, etc.).

[0035] First, the technical terms used in this article are explained and clarified as follows.

[0036] Graph Convolutional Neural Networks (GCNs) are a class of deep learning models specifically designed for processing graph-structured data. Unlike traditional neural networks, which primarily handle sequential or grid-like data, GCNs define convolutional operations on the graph structure, enabling nodes to aggregate feature information from their neighbors at each layer. This allows for efficient learning of representations of nodes, edges, or the overall structure of the graph. This model is particularly suitable for modeling irregularly structured data such as social networks, transaction graphs, and knowledge graphs, as it can capture broader contextual relationships while preserving local node structural information.

[0037] Graph Attention Network (GAT) is a model that introduces an attention mechanism on top of graph neural networks. Compared to the fixed neighbor feature aggregation method in traditional GCNs, GAT learns the attention weights between each node and its neighbors, adaptively adjusting the importance of information aggregation, thereby improving the model's robustness to heterogeneous connection structures and noisy nodes. Graph Attention Networks allow models to capture more refined differential dependencies between nodes, exhibiting stronger expressive power in scenarios such as social analysis, risk detection, and recommender systems.

[0038] Multi-head attention is an extension of attention mechanisms. Its core idea is to use multiple independent attention "heads" in parallel to capture feature associations in different subspaces of the input. Each head performs attention computation independently, and then the outputs of the various heads are concatenated or fused, thereby enhancing the model's modeling ability and expressive diversity.

[0039] Federated Learning is a distributed machine learning framework that allows collaborative modeling of local data from multiple participants without centralized data processing. In federated learning, each participant trains its model locally and reports its parameters or gradients, rather than the raw data, effectively protecting user privacy and data security. A central coordinating server aggregates local updates, optimizes the global model, and then synchronizes it to all participants.

[0040] With the continuous innovation and deep integration of mobile internet, cloud computing, and electronic payment technologies, banking operations are gradually transforming towards digitalization and intelligence. Digital payment has become a core component of the financial services system. New payment methods such as mobile payment, biometric payment, and QR code transactions not only enhance user convenience and service experience but also drive the restructuring of banking business boundaries and the comprehensive upgrading of technological infrastructure.

[0041] However, the diversification of payment methods and the increasing complexity of business scenarios have significantly expanded the potential scope for anomaly attacks. In recent years, the anomaly risks faced by banks have exhibited characteristics of intelligence, concealment, chain-like structures, and organized groups. Especially in scenarios such as remote mobile transactions, cross-device operations, and frequent switching between different locations, traditional risk control models based on rule engines and static threshold settings have gradually revealed significant drawbacks. Specifically, current bank anti-anomaly systems face the following problems:

[0042] 1. New types of abnormal behavior are often highly dynamic and strategic. For example, attackers may simulate user behavior to perform "low-noise" abnormal operations, or remotely control user devices through malicious programs to make transactions appear legitimate. These attacks are constantly evolving, making it difficult for systems based on fixed rules to respond in a timely manner, resulting in significant lag and blind spots in anomaly detection.

[0043] 2. Currently, most anti-anomaly models focus on the static feature analysis of individual transactions, neglecting the potential fund flow structure and multi-hop transaction paths between accounts. For example, an anomaly may be dispersed and cleaned up through multiple "stepping accounts," presenting a risk pattern only in the overall path, rather than showing anomalies in each individual transaction. Traditional systems fail to construct transaction network diagrams between accounts, making it difficult to reveal the underlying correlations and linkages.

[0044] 3. Due to insufficient identification capabilities or crude rule settings, traditional risk control systems are prone to misjudging normal user behavior, resulting in numerous "false positives" and reduced customer satisfaction. At the same time, highly concealed abnormal behaviors may evade detection, leading to "missed detections" and causing banks to bear significant financial risks. This "lose-lose" situation exposes the fundamental shortcomings of the system in terms of identification accuracy and response strategies.

[0045] 4. Under the policy background of strengthening data security supervision, the problem of data isolation between banking institutions has become more prominent. As user transaction data is sensitive information, it cannot flow freely between different branches, regional banks or partner units. Existing systems are unable to build a unified abnormal risk identification model, which limits the model's wide adaptability and accuracy, and also makes it impossible to form an effective cross-institutional risk control joint defense.

[0046] 5. Even when the system identifies high-risk transactions, most current banking systems still rely on a simple "block or allow" strategy, lacking the ability to buffer intermediate transactions and failing to combine manual review with dynamic responses. Furthermore, the manual review process is often disconnected from the system model, and the review results cannot be fed back to the model in a timely manner for optimization and learning, causing the model to remain in a "static" state for a long time and making it difficult to adapt to new risks.

[0047] Based on this, embodiments of this application provide an abnormal risk identification method, the method comprising: constructing a user profile based on historical transaction data of a target account; constructing an account transaction graph based on real-time transaction data of the target account; identifying a target transaction path corresponding to the target transaction based on the account transaction graph; and identifying abnormal risks of the target transaction based on the user profile and the target transaction path. According to embodiments of this application, by constructing a user profile based on historical transaction data, the long-term behavioral preferences and transaction patterns of the account are comprehensively reflected, improving the stability and personalization of risk modeling. Simultaneously, the introduction of an identification mechanism for the account transaction graph and the target transaction path achieves efficient structural abstraction of transaction behavior and focused processing at the path level, avoiding traversal of redundant information across the entire graph, effectively improving model response speed and real-time identification capabilities. Furthermore, by comprehensively considering the user's historical behavior and the current transaction context, the accuracy and interpretability of risk judgment are improved, enhancing the credibility and understandability of the system output results, thereby achieving faster feedback and a better user experience on the user side.

[0048] It should be noted that the anomaly risk identification methods, devices, equipment, media, and program products defined in this application relate to the application of large-scale models in fintech scenarios. They can be applied to the fields of big data technology, artificial intelligence technology, and fintech, and can also be used in various other fields besides big data technology, artificial intelligence technology, and fintech. The application fields of the anomaly risk identification methods, devices, equipment, media, and program products provided in the embodiments of this application are not limited.

[0049] In the technical solution of this application, the user information (including but not limited to user personal information, user image information, user device information, such as location information) and data (including but not limited to data used for analysis, stored data, and displayed data) involved are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entry points for users to choose to authorize or refuse.

[0050] In scenarios involving automated decision-making using personal information, the methods, devices, and systems provided in this application all offer users corresponding entry points for choosing to agree to or reject the automated decision-making results. If the user chooses to reject, the process proceeds to the expert decision-making stage. Here, "automated decision-making" refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, and credit status through computer programs, and then making a decision. Here, "expert decision-making" refers to the activity of making decisions by personnel who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0051] Figure 1 The illustration shows an application scenario diagram of the abnormal risk identification method, apparatus, device, medium, and program product according to embodiments of this application.

[0052] like Figure 1 As shown, application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0053] Users can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 via the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0054] In the embodiments of this application, the first terminal device 101 can be an example of the first device, and the second terminal device 102 and / or the third terminal device 103 can be an example of at least one second device. The first device and the second device can communicate collaboratively through an internal client mechanism to implement the data distribution and rendering logic described in the abnormal risk identification method.

[0055] In some embodiments, the first device and at least one second device may be different display modules, windows or screens on the same computing terminal (such as a host), or multiple physical devices that work together through a network, such as different client instances deployed on a desktop computer, tablet terminal or mobile device respectively.

[0056] The first terminal device 101, the second terminal device 102, and the third terminal device 103 can be various electronic devices with displays and support web browsing, including but not limited to smart mobile terminals, tablet computers, laptop computers, and desktop computers.

[0057] Server 105 can be a server that provides various services, such as a backend management server that supports websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103 (this is just an example). The backend management server can analyze and process data such as received user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal devices.

[0058] It should be noted that the anomaly risk identification method provided in this application embodiment can generally be executed by server 105. Correspondingly, the anomaly risk identification device provided in this application embodiment can generally be located in server 105. The anomaly risk identification method provided in this application embodiment can also be executed by a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105. Correspondingly, the anomaly risk identification device provided in this application embodiment can also be located in a server or server cluster that is different from server 105 and capable of communicating with the first terminal device 101, the second terminal device 102, the third terminal device 103, and / or server 105.

[0059] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0060] The following will be based on Figure 1 The described scene, through Figures 2-4 The abnormal risk identification method of the disclosed embodiments is described in detail.

[0061] Figure 2 A flowchart illustrating an anomaly risk identification method according to an embodiment of this application is shown schematically.

[0062] like Figure 2 As shown, the abnormal risk identification method 200 of this embodiment includes operations S210 to S240.

[0063] In operation S210, a user profile is built based on the target account's historical transaction data.

[0064] In the embodiments of this application, historical transaction data may include information such as transaction amount, transaction frequency, transaction type (such as transfer, consumption, and recharge), transaction time distribution, transaction geographical distribution, and counterparty account type. The system can perform structured modeling on the above multi-dimensional features to form a user profile that characterizes the account's long-term transaction habits and risk characteristics.

[0065] For example, cluster analysis of behavioral patterns in historical transaction records can identify typical transaction paths or categories of transaction behavior for an account at different time periods, such as whether there are regular salary incomes, periodic bill payments, or irregular large-amount fund inflows and outflows. The system can also extract differences in account activity levels at different times (such as weekdays and holidays, daytime and nighttime) to construct time-sensitive behavioral tags, further enriching the temporal attributes of the user profile.

[0066] For example, user profiling can also incorporate statistical feature analysis of counterparty information, such as the number of counterparties, their activity level, the repetition rate of counterparties in historical transaction records, or the positional attributes of counterparty accounts within the entire transaction network, thereby reflecting the degree of connection between target accounts and potentially risky accounts. Through in-depth modeling of this information, the system can more comprehensively characterize the structural role and behavioral preferences of target accounts within the transaction network.

[0067] In the embodiments of this application, to improve the generalization ability of user profiles, historical anomaly label data can be combined to summarize the profile features of known risky accounts, and a supervised learning model can be used to train a risk profile recognizer. This allows for comparative risk pattern modeling while constructing the target account profile, thereby enhancing its distinguishing ability in downstream anomaly identification tasks. Furthermore, to adapt to dynamic trading environments, user profiles can be updated periodically according to a preset strategy or incremental reconstruction can be triggered when there are significant behavioral deviations, ensuring the timeliness and consistency between the profile and account behavior.

[0068] In operation S220, an account transaction graph is constructed based on the real-time transaction data of the target account.

[0069] In the embodiments of this application, the account transaction graph can be represented by a graph structure, where nodes are used to represent each account (e.g., including the target account and its historical or current counterparty accounts), edges represent transaction behaviors between accounts, and the attributes of the edges can include information such as transaction amount, transaction time, transaction direction (receipt or payment), and transaction frequency. The construction of the graph can cover all valid transaction records within a certain time window to balance completeness and timeliness.

[0070] During the construction of the account transaction graph, incremental transaction events related to the target account can be captured from the transaction log system based on a preset real-time data acquisition mechanism. The system can continuously update the transaction graph structure based on a sliding time window strategy, that is, while retaining some historical context relationships, it prioritizes retaining the latest transaction behavior, thereby ensuring that the graph structure reflects real-time and sensitive information. For frequent transactions or sudden large transactions, the system can also automatically adjust the graph update frequency or sampling strategy to adapt to the significance of different transaction behaviors on the graph structure.

[0071] Furthermore, to enhance the ability of graph structures to model risk behavior, account transaction graphs can be designed as heterogeneous graph structures. These can include not only account nodes but also merchant nodes, terminal device nodes, and other types of entities. Different types of edges can represent different behavioral relationships, such as payment, binding, login, and registration, thereby enriching the semantic representation of the graph. In addition, behavioral labels (such as "frequent transactions," "nighttime activity," "new device login," etc.) or risk characteristic identifiers (such as "historically risky accounts," "blacklisted merchants," etc.) can be attached to the edges or nodes of the graph, enabling subsequent identification models to integrate structural and attribute information for deeper risk identification.

[0072] In the embodiments of this application, the construction of the account transaction graph can be based on a graph database or a graph processing framework to support graph update and query efficiency in high-concurrency scenarios. To ensure privacy and computational efficiency during the graph construction process, the system can also introduce a distributed computing architecture or combine a federated graph learning mechanism to perform hierarchical and weighted processing of graph construction and modeling tasks. In risk identification application scenarios, the account transaction graph not only serves to extract the current transaction path but can also serve as input to a graph neural network model, providing underlying support for node embedding, path evaluation, and graph structure anomaly detection.

[0073] In operation S230, based on the account transaction graph, the target transaction path corresponding to the target transaction is identified.

[0074] Specifically, a target transaction path refers to a sequence of paths originating from a target account, following the transaction edges between that account and other accounts, and involving several hops. This path reflects the flow and structural characteristics of funds within a network. When identifying target transaction paths, the system can combine factors such as the direction of the target transaction (e.g., payment or receipt), the time of occurrence, and the transaction amount to constrain the path's starting point and scope, ensuring a close correlation between the path and the current transaction event.

[0075] To enhance identification capabilities, various path search strategies can be introduced. For example, depth-first or breadth-first traversal can be used, with a limited number of hops or a time window as boundaries, to construct multi-level transaction paths between the target account and its neighboring nodes. Alternatively, a path ranking method based on weighted scoring can be employed, weighting indicators such as transaction frequency, amount, and counterparty account risk level within the path to select the most representative path subgraph. In certain scenarios, multiple similar or repeating paths can also be identified, reflecting complex behavioral patterns such as potentially fraudulent transaction chains.

[0076] In the embodiments of this application, the path identification process can also filter based on the behavior type of nodes and the attributes of edges. For example, the system can selectively ignore high-frequency, small-amount round-trip transactions in the short term, focusing on risk graph patterns such as abnormal structures, "spider web structures," "bidirectional closed loops," and "star-shaped abnormal concentrations," thereby improving the robustness and interpretability of the identification. For some special transaction behaviors (such as cross-border transfers and chain-based decentralized transfers), the system can identify predefined high-risk path templates through graph pattern matching algorithms and embed the target transaction into the corresponding structure for risk scoring.

[0077] In terms of path representation, the identified target transaction path can be transformed into a serialized structure or tensor form for downstream graph neural network models to perform path embedding learning. For example, the path can be represented as an alternating sequence of nodes and edges or an adjacency matrix in the path subgraph, and combined with the static attributes (such as account type and device information) and dynamic behaviors (such as transaction time and amount) of each node in the path, a multimodal path representation can be constructed, which helps to integrate user profiles for accurate risk assessment in the future.

[0078] In operation S240, based on the user profile and the target transaction path, abnormal risk identification of the target transaction is performed.

[0079] In the embodiments of this application, the user profile reflects the account's long-term behavioral patterns, asset flow characteristics, and preference stability; the target transaction path depicts the graph structure context of the current transaction and the potential risk propagation path. By combining these two types of information, a more context-sensitive, structurally sensitive, and individual-differentiated risk assessment of the target transaction can be achieved.

[0080] According to embodiments of this application, the system can encode user profiles into high-dimensional feature vectors, representing the statistical attributes of an account in the dimension of historical behavior, such as transaction activity, consumption habits, and capital fluctuations. Simultaneously, the target transaction path is represented as a graph structure input, fed into a graph convolutional neural network, graph attention network, or path modeling network to extract local structural embedding information from the path. Subsequently, the system can design a fusion layer to concatenate, weightedly fuse, or process the user profile vector and path embedding vector using attention mechanisms, thereby constructing a fused representation for use in downstream anomaly risk classification or scoring models.

[0081] In the embodiments of this application, the risk identification model can adopt various structural forms, such as multilayer perceptrons, graph neural networks, or ensemble learning methods, to adapt to the requirements of different business scenarios on risk discrimination accuracy and response speed. In some implementations, the model output can be a binary classification result (e.g., normal / abnormal), a multi-level risk level (e.g., high / medium / low), or a continuous risk score, to support fine-grained strategy execution.

[0082] To enhance the model's credibility and interpretability, the system can also visualize and track the identification process. For example, it can generate a "path risk heatmap," highlighting the nodes and edges with the highest risk contribution in the current transaction path, or provide "profile deviation analysis" results, indicating whether the target transaction deviates from its usual trading pattern. Such interpretable results can assist risk control personnel in making quick decisions and improve the efficiency of risk management.

[0083] Furthermore, to adapt to the evolving trends of novel abnormal behaviors, the system can introduce federated learning or online learning mechanisms to continuously iterate and optimize the risk identification model. In actual deployment, if the detection result is a high-risk transaction, the system can trigger multiple response mechanisms, including transaction interception, risk control review, customer verification, or behavior tracking, thereby constructing a closed-loop capability from identification to handling. By integrating user profiles and transaction paths for anomaly identification, not only is the accuracy of single transaction judgment improved, but the model's ability to perceive and respond to potential risk chains in complex transaction networks is also enhanced.

[0084] The method for identifying abnormal risks according to the present application will be specifically described below by way of preferred embodiments.

[0085] In the embodiments of this application, in order to improve the expressive power of user profiles and provide more robust behavioral feature support for high-risk scenarios such as transaction anomaly identification, the process of constructing user profiles based on the historical transaction data of the target account may include multi-dimensional feature extraction and multi-channel deep learning modeling.

[0086] Specifically, the historical transaction data of the target account can be preprocessed first to extract structured transaction features, such as static attributes including transaction amount statistics (e.g., mean, variance, maximum), transaction frequency, transaction type distribution, income-expenditure ratio, and transaction geographic distribution; as well as time series transaction features that reflect the dynamic trend of account behavior over time, such as daily / weekly / monthly transaction fluctuation curves, transaction interval time series, and activity changes within a specific period.

[0087] Subsequently, a dual-channel deep learning model can be constructed based on the extracted two types of features to achieve accurate modeling of different feature dimensions. The structured transaction features are input into the first channel of the model, which can employ structures such as multilayer perceptrons or convolutional networks to learn the static attribute feature distribution and nonlinear combination relationships of accounts. The time-series transaction features are input into the second channel, which can employ structures such as recurrent neural networks or temporal convolutional networks to model the temporal patterns and evolutionary trends of transaction behavior.

[0088] After completing the dual-channel feature encoding, the output features of the first and second channels can be further fused. This fusion process can be achieved through feature concatenation, weighted summation, attention mechanisms, or adaptive fusion layers to comprehensively capture key behavioral information of the account in both static structure and dynamic sequence dimensions. The fused target behavioral features can be represented as a high-dimensional vector, comprehensively reflecting the account's behavioral preferences, stability characteristics, and temporal variability, serving as a basic representation for user profiles. Based on these target behavioral features, user profiles of target accounts can be constructed for subsequent tasks such as transaction anomaly detection, personalized risk modeling, and group behavior analysis. Furthermore, these profiles are scalable and can be dynamically updated as account behavior evolves.

[0089] In the embodiments of this application, based on the modeling requirements for the timeliness and structural complexity of transaction data in different business scenarios, the account transaction graph can be a single graph structure or a dynamic graph sequence composed of multiple single graph structures generated under a sliding time window. For example, in a static analysis scenario, the system can construct a single graph structure. This single graph structure is based on transaction data within a fixed time range, uniformly representing the transaction relationships between accounts, thereby facilitating centralized graph structure analysis, path extraction, or feature aggregation operations. The single graph structure can consist of multiple nodes and multiple edges. Nodes represent various accounts participating in the transaction process, including payment accounts and receiving accounts; edges represent the transaction behavior between accounts and can be directed edges used to identify the transaction direction, i.e., from the payment account to the receiving account.

[0090] To enhance the ability to characterize the changing features of transaction behavior over time, a dynamic graph structure can be constructed. This involves periodically generating multiple consecutive single graph structures within a sliding time window mechanism, forming a time-sensitive dynamic graph sequence. Each single graph structure in each time slice reflects the transaction network state within that period, while changes in the graph structure between different time slices reveal the dynamic characteristics of account behavior evolving over time. The system can set the step size and coverage of the sliding window according to business needs, such as updating the graph structure hourly, daily, or weekly, to achieve a balance between real-time performance and controllability.

[0091] In constructing the account transaction graph, edges can carry rich attribute information, such as transaction amount, transaction timestamp, transaction channel, or transaction category. This allows the account transaction graph structure to not only have connectivity relationships but also carry semantic context, supporting more granular graph analysis tasks. Furthermore, to reflect the interaction strength or risk level between nodes, the system can assign weights to edges. These weights can be calculated based on factors such as transaction frequency, cumulative amount, and historical risk labels.

[0092] Figure 3 The flowchart illustrating a method for constructing and projecting an account transaction graph according to some exemplary embodiments of this application is shown schematically.

[0093] like Figure 3 As shown, for real-time transaction data of a target account, a dynamic graph sequence with a multi-graph structure can be dynamically constructed using a sliding time window mechanism, and GCN can be used to achieve node-level embedding representation learning to capture the behavioral characteristics and structural roles of the account in the dynamic transaction network. The embodiments of this application, by fusing multi-source heterogeneous features with graph structure information, can achieve structured modeling of high-dimensional transaction relationships and provide more expressive input features for downstream anomaly risk identification.

[0094] Specifically, a dynamic graph sequence can be constructed first based on real-time transaction data and sliding time windows. Within each time window, the real-time transaction data is organized into a single graph structure, where nodes represent trading accounts and edges represent transaction behaviors between accounts. Edges are directed, pointing in the direction of fund flow. Nodes in the graph structure include not only the target account but also associated accounts with which it has transaction activity, and edges are accompanied by multiple dimensions of transaction characteristics, such as transaction amount, device type, channel code, and transaction timestamp.

[0095] Subsequently, features can be initialized for each node in the graph, including statistical indicators of historical transaction behavior, such as the cumulative number of transactions for an account, the average number of transactions in the recent period, activity distribution, and the intensity of historical interactions with high-risk accounts. Initializing node features and edge attributes can be used together as input to the GCN. To enhance the GCN's ability to understand graph structures, further structural descriptive quantities such as K-order neighbor layer expansion features, path frequency distribution, and path length distribution can be extracted to strengthen the ability to model contextual interactions between nodes.

[0096] In the embodiments of this application, GCN adopts a two-layer structure design. Each layer includes a modified linear unit activation function and a random deactivation regularization mechanism to learn the embedded representations of multiple nodes. The first convolutional layer is used to learn the local neighborhood representation of the node. The system completes the aggregation and propagation of node information based on the adjacency matrix of the graph and edge features. The second convolutional layer further integrates the information of the K-order neighboring layers, improving the node's ability to perceive long-range dependencies in the transaction path. In each layer, the propagation of node features depends not only on the representations of its neighboring nodes but also on the adjustment of edge attributes. The system can control the propagation weights and perform multi-layer propagation calculations through edge weight normalization, attention mechanisms, or edge attribute encoding networks, thereby introducing stronger semantic perception capabilities.

[0097] During the propagation process, the system can dynamically select either "homogeneous graph propagation" or "heterogeneous subgraph nested propagation" strategies, and differentiate node representations based on differences in node type (e.g., ordinary account, merchant account, risky account) and edge type, thereby achieving refined modeling of node representations. Furthermore, in the fusion modeling of multi-graph structures, the system can use a graph sequence encoder to model graph structures at different time periods to capture the evolutionary trends of account behavior over time, and embed the time-series graphs into a unified fusion.

[0098] Finally, after processing by a two-layer graph convolutional network, a high-dimensional embedding representation vector is generated for each node. This embedding representation vector integrates transaction behavior patterns in the transaction network, such as account behavior patterns, transaction structure relationships, and contextual neighbor information, possessing strong discriminative and expressive capabilities. The embedding representation vector can not only be used for anomaly scoring in transaction paths but also directly serve as input features for downstream anomaly risk identification models (such as fully connected neural networks, graph classifiers, clusterers, etc.), enabling applications such as account risk level prediction and transaction anomaly probability judgment.

[0099] In the embodiments of this application, the process of identifying abnormal risks of a target transaction based on user profiles and target transaction paths may include the following modeling and reasoning steps: First, the transaction path associated with the target transaction can be structurally modeled, and key nodes in the path (such as transaction initiating account, receiving account, intermediate transit account, etc.) and their connection relationships can be extracted. At the same time, the edge attribute information of the transaction behavior in the path (such as transaction amount, time interval, channel type, etc.) can be combined, and the path can be vectorized through path coding network or sequence modeling mechanism to generate a transaction path vector that represents the structure and behavior pattern of the path.

[0100] Subsequently, the transaction path vector and the user profile vector can be concatenated or weighted and fused together as a whole input feature vector into the risk scoring model.

[0101] Risk scoring models can be deep neural networks, graph neural networks, ensemble learning models, or lightweight classification models. Their training objective is to output a probability score or risk level indicating whether the current transaction constitutes abnormal behavior. During the training phase, the model can utilize historical transaction labels for supervised learning, and during the inference phase, it outputs a score based on the joint vector of the inputs.

[0102] Based on the scoring result, the system can perform the final abnormal risk identification and judgment. For example, when the scoring result is higher than the preset risk threshold, it is determined that the target transaction has a high abnormal risk, and the system can further trigger subsequent prevention and control mechanisms such as interception, review, and user verification.

[0103] For example, the process of modeling the target transaction path and generating the transaction path vector can use GAT combined with a multi-head attention mechanism to model the correlation strength and propagation pattern between account nodes in the transaction path with higher accuracy, thereby enhancing the model's ability to perceive differences in local path structures.

[0104] Specifically, a local subgraph can be constructed first based on the target transaction path. This subgraph consists of the account nodes (i.e., the target node in each hop) and their corresponding neighbor nodes within the target transaction path. For each hop in the target transaction path, the system extracts the feature representation of the current target node, including account type, historical transaction frequency, and recent activity level, while also extracting the features of its neighbor nodes. Further, the system concatenates the features of the target node and its neighbor nodes as input for attention weight calculation. By introducing a learnable attention mechanism, the relative importance of each neighbor node to the target node can be dynamically evaluated, thereby generating weight coefficients and weighted aggregation of the neighbor features. Compared to fixed-weight aggregation, this method can adaptively highlight the influence of high-risk propagation nodes in the path, improving sensitivity to abnormal transaction patterns.

[0105] It's important to clarify that "each hop in the target transaction path" refers to a single transaction or connection between two adjacent nodes within that path. Specifically, in the context of an account transaction graph, a hop can represent a transaction or a flow of funds from one account to another. For example, suppose the following transaction path exists: Account A → Account B → Account C → Account D, containing three hops: hop 1 A → B, hop 2 B → C, and hop 3 C → D. In each hop, the "target node" can refer to the receiving node of that hop (e.g., B in A → B), while "neighboring nodes" can include other accounts that have a transaction relationship with B, such as A (the previous hop) or other nodes that have transacted with B. The system aggregates the features of the target node and its neighboring nodes, capturing local graph structure information to represent the behavioral patterns of the current path segment.

[0106] To enhance the stability and multi-perspective expressiveness of transaction path representations, a multi-head attention mechanism can be further employed. This involves using multiple independent attention heads in parallel to model the weights of the same node-neighbor pair in different subspaces. Each attention head can learn an independent set of feature combinations and attention patterns. Finally, the aggregation results of multiple attention heads are concatenated or averaged to generate a high-dimensional vector representation of the transaction path. The transaction path vector comprehensively reflects the semantic features, contextual structure, and interaction strength between key nodes in the path, exhibiting good discriminative ability and robustness.

[0107] Through the modeling approach based on graph attention and multi-head fusion, the system can not only finely mine abnormal propagation patterns in the target transaction path, but also capture potential behavioral commonalities in the cross-node propagation process, effectively improving the recognition performance of complex behavioral patterns such as chain anomalies and gang transactions.

[0108] Figure 4 The flowchart illustrates a method for abnormal path identification and scoring using a graph neural network according to some exemplary embodiments of this application.

[0109] like Figure 4 As shown, a combination of graph attention networks and multi-model risk scorers can be used to perform real-time anomaly risk assessment of transaction behavior. This process takes the target transaction path between the payment account and the receiving account as input, and through structural modeling and feature fusion, outputs a transaction risk score for risk classification, thereby triggering corresponding risk control strategies.

[0110] First, the transaction path vector and user vector can be jointly input into the risk assessment model. In this embodiment, the risk assessment model is built based on a hybrid model architecture, such as a first model and a second model. The first model excels at modeling non-linear relationships between structured features, quickly capturing patterns between transaction features such as transaction amount, timestamp, and device type, and account tags (such as account profile, historical frequency, and risk markers). The second model further integrates high-dimensional embedded features and unstructured information to enhance the model's expressive power and generalization performance. The fusion model outputs a transaction risk score, representing the probability or risk level of the current transaction being judged as abnormal behavior.

[0111] Based on the scoring results, the system can set multi-level risk response strategies to achieve automated differentiated handling. Specifically, when a transaction is determined to be low-risk, the system allows it to proceed normally without additional intervention; when a transaction is of medium risk, the system can choose to delay settlement, perform secondary verification, or require user confirmation; and in the case of a transaction determined to be high-risk, the system will immediately temporarily freeze the transaction and submit the transaction record to the manual review system for further verification.

[0112] Optionally, a visual human review interface can be provided. For example, it can display key stages of transaction risk response in a chronological order, including the identification results of the target transaction, the distribution status of strategy rules, whether the transaction has entered a deferred queue, whether a freeze has been triggered, and subsequent verification or unlocking steps. The visual interface can support interactive operations; for example, reviewers can click on any path node to view the account's behavioral characteristics and risk tags, or select a specific dimension in the scoring results to expand its corresponding explanation and historical reference cases. The system also supports a model scoring interpretability mechanism, displaying the source composition, path-related factors, and triggering logic chain of the transaction risk score, enabling human reviewers to understand, judge, and correct the model output.

[0113] In the embodiments of this application, to improve the adaptability and generalization ability of the risk scoring model in different regions and customer groups, while also taking into account data privacy protection requirements, a federated learning mechanism can be introduced to construct a collaborative modeling framework across branch nodes. This collaborative modeling framework supports joint training of the global risk identification model without directly exchanging users' original transaction data, effectively improving the model's robustness and fairness.

[0114] Specifically, local risk scoring models can be deployed across multiple business branch nodes (such as regional subsidiaries, geographical branches, or independent business units). Each branch node can independently train its local model based on local customers' historical transaction data, account profiles, and behavioral characteristics. During training, the system only calculates model gradients or parameter update information locally, without uploading the original transaction data, ensuring user privacy and data compliance requirements.

[0115] After local training is complete, each branch node encrypts its local model parameters (such as neural network weights, tree model structure, or embedding vectors) and sends them to the central server. The central server, acting as a coordinator, receives the model parameters from each node and aggregates them using weighted averaging and federated optimization algorithms to generate a unified global model. The aggregation process considers factors such as the number of samples from each node and the model's convergence level to enhance the generalization ability and training fairness of the global model. After aggregation, the central server redistributes the updated global model to each branch node, replacing the original local model or using it to initialize the next round of local training.

[0116] According to the embodiments of this application, while ensuring that user data does not leave the local machine, efficient collaborative training of the global anomaly identification model is achieved. This model is suitable for financial transaction scenarios that are sensitive to data and subject to strict regulation, and effectively supports the intelligent deployment of large-scale risk control systems under a distributed architecture.

[0117] According to embodiments of this application, by introducing a sliding time window to construct a dynamic account transaction graph, the system can perceive structural changes and fund flow paths between accounts in real time, effectively improving the response speed to new abnormal behaviors; by using graph convolutional networks and graph attention networks to perform multi-layer aggregation modeling of account nodes and their neighbors, combined with a multi-head attention mechanism, the system improves the perception and modeling capabilities of key behaviors in complex transaction structures; through joint modeling of user profiles and transaction paths, the system achieves deep integration of static long-term behavior and dynamic structural context, thereby enhancing the model's accuracy in identifying concealed, chain-like, or gang-like abnormal behaviors.

[0118] Meanwhile, the system supports a distributed collaborative modeling mechanism based on federated learning. This mechanism, while ensuring data privacy and security, integrates the local model capabilities of multiple business nodes, significantly improving the model's generalization and stability. In terms of risk scoring, a hybrid model is used to comprehensively determine transaction embedding features, outputting a more discriminative risk score. Based on the risk level, a multi-layered response strategy is implemented, forming an intelligent and hierarchical transaction processing system. Furthermore, a visual manual review interface can be provided, supporting a comprehensive display of scoring sources, path structures, account relationships, and behavioral logs. This constructs a closed-loop collaborative mechanism of "automatic model identification, manual review feedback, and continuous learning optimization," further enhancing the interpretability and adaptability of risk control.

[0119] Corresponding to the above-described method for identifying abnormal risks, embodiments of this application also provide an apparatus for identifying abnormal risks.

[0120] Figure 5 A schematic block diagram of an anomaly risk identification device according to an embodiment of this application is shown.

[0121] like Figure 5 As shown, the abnormal risk identification device 500 in this embodiment includes a user profile construction module 510, an account transaction graph construction module 520, a target transaction path identification module 530, and an abnormal risk identification module 540.

[0122] The user profile building module 510 can be used to build a user profile based on the historical transaction data of the target account. In one embodiment, the user profile building module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0123] The account transaction graph construction module 520 can be used to construct an account transaction graph based on the real-time transaction data of the target account. In one embodiment, the account transaction graph construction module 520 can be used to perform the operation S220 described above, which will not be repeated here.

[0124] The target transaction path identification module 530 can be used to identify the target transaction path corresponding to the target transaction based on the account transaction graph. In one embodiment, the target transaction path identification module 530 can be used to perform the operation S230 described above, which will not be repeated here.

[0125] The anomaly risk identification module 540 can be used to identify anomalies in the target transaction based on the user profile and the target transaction path. In one embodiment, the anomaly risk identification module 540 can be used to perform the operation S240 described above, which will not be repeated here.

[0126] According to an embodiment of this application, the user profile construction module 510 can also be used to extract structured transaction features and time-series transaction features from the historical transaction data; input the structured transaction features into the first channel of the deep learning model for processing, input the time-series transaction features into the second channel of the deep learning model for processing; and fuse the output features of the first channel and the second channel to obtain target behavior features, and construct the user profile based on the target behavior features.

[0127] According to embodiments of this application, the account transaction graph is a single graph structure or a dynamic graph sequence composed of multiple single graph structures generated under a sliding time window. The single graph structure includes multiple nodes and multiple edges. The multiple nodes include at least a payment account and a receiving account, and the multiple edges include at least directed edges representing transaction behavior between the payment account and the receiving account. The account transaction graph construction module 520 can also be used to input the account transaction graph into a graph convolutional neural network model; and to use the graph convolutional neural network model to perform embedding representation learning on the multiple nodes, generating embedding representation vectors corresponding to the multiple nodes. The embedding representation vectors are used to characterize the transaction behavior patterns of the multiple nodes in the transaction network.

[0128] According to an embodiment of this application, the account transaction graph construction module 520 can also be used for each of the plurality of nodes to: obtain node features and neighbor node features; aggregate the node features and neighbor node features to generate a context representation of the corresponding node; obtain the edge attributes of the corresponding edge; and perform multi-layer propagation calculation based on the context representation and the edge attributes to generate the embedding representation vector.

[0129] According to an embodiment of this application, the target transaction path identification module 530 can also be used to model the target transaction path and generate a transaction path vector; input the transaction path vector and the user profile vector into a risk scoring model and output a scoring result; and identify abnormal risks of the target transaction based on the scoring result.

[0130] According to an embodiment of this application, the target transaction path identification module 530 can also be used to perform weighted aggregation of the target node features and the corresponding neighbor node features of each hop in the target transaction path based on a graph attention network, wherein the weight of the weighted aggregation is obtained by concatenating the target node features and the neighbor node features and then dynamically learning through an attention mechanism; and to fuse the weighted aggregation results using a multi-head attention mechanism to generate the transaction path vector.

[0131] According to an embodiment of this application, the abnormal risk identification device 500 further includes a federated learning module. The federated learning module can be used to train a risk scoring model based on local customer transaction data of each branch node in multiple branch nodes to obtain local model parameters; and to send the local model parameters to a central server, whereby the central server aggregates the multiple local model parameters to generate a global model, and distributes the global model to each branch node.

[0132] According to embodiments of this application, any multiple modules among the user profile construction module 510, account transaction graph construction module 520, target transaction path identification module 530, and abnormal risk identification module 540 can be merged into one module, or any one of these modules can be split into multiple modules. Alternatively, at least some of the functions of one or more of these modules can be combined with at least some of the functions of other modules and implemented in one module. According to embodiments of this application, at least one of the user profile construction module 510, account transaction graph construction module 520, target transaction path identification module 530, and abnormal risk identification module 540 can be at least partially implemented as hardware circuits, such as field-programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems-on-a-chip, systems-on-a-substrate, systems-on-package, application-specific integrated circuits (ASICs), or any other reasonable means of integrating or packaging circuits, or implemented in software, hardware, or firmware, or in any one of the three implementation methods or a suitable combination of any of them. Alternatively, at least one of the user profile building module 510, the account transaction graph building module 520, the target transaction path identification module 530, and the abnormal risk identification module 540 can be at least partially implemented as a computer program module, which can perform corresponding functions when the computer program module is run.

[0133] Figure 6 A block diagram of an electronic device suitable for implementing an anomaly risk identification method according to an embodiment of this application is shown schematically.

[0134] like Figure 6As shown, an electronic device 600 according to an embodiment of this application includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage portion 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or an associated chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of this application.

[0135] RAM 603 stores various programs and data required for the operation of electronic device 600. Processor 601, ROM 602, and RAM 603 are interconnected via bus 604. Processor 601 executes various operations of the method flow according to embodiments of this application by executing programs in ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 may also execute various operations of the method flow according to embodiments of this application by executing programs stored in said one or more memories.

[0136] According to embodiments of this application, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to a bus 604. The electronic device 600 may also include one or more of the following components connected to the input / output (I / O) interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 610 as needed so that computer programs read from it can be installed into the storage section 608 as needed.

[0137] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or it may exist independently and not assembled into the device / apparatus / system. The computer-readable storage medium carries one or more programs, which, when executed, implement the method according to the embodiments of this application.

[0138] According to embodiments of this application, the computer-readable storage medium can be a non-volatile computer-readable storage medium, such as including but not limited to: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, the computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to embodiments of this application, the computer-readable storage medium may include ROM 602 and / or RAM 603 and / or one or more memories other than ROM 602 and RAM 603 described above.

[0139] Embodiments of this application also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowchart. When the computer program product is run on a computer system, the program code enables the computer system to implement the anomaly risk identification method provided in the embodiments of this application.

[0140] When the computer program is executed by the processor 601, it performs the functions defined in the system / apparatus of this application embodiment. According to the embodiments of this application, the systems, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0141] In one embodiment, the computer program may rely on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may also be transmitted and distributed in the form of signals over a network medium, and downloaded and installed via the communication section 609, and / or installed from the removable medium 611. The program code contained in the computer program can be transmitted using any suitable network medium, including but not limited to: wireless, wired, etc., or any suitable combination thereof.

[0142] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, it performs the functions defined in the system of this application embodiment. According to the embodiments of this application, the systems, devices, apparatuses, modules, units, etc., described above can be implemented by computer program modules.

[0143] According to embodiments of this application, program code for executing the computer programs provided in the embodiments of this application can be written in any combination of one or more programming languages. Specifically, these computational programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C", or similar programming languages. The program code can be executed entirely on the user's computing device, partially on the user's device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0145] Those skilled in the art will understand that the features described in the various embodiments of this application can be combined and / or combined in various ways, even if such combinations or combinations are not explicitly described in this application. In particular, the features described in the various embodiments of this application can be combined and / or combined in various ways without departing from the spirit and teachings of this application. All such combinations and / or combinations fall within the scope of this application.

[0146] The embodiments of this application have been described above. However, these embodiments are merely illustrative and not intended to limit the scope of this application. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. Without departing from the scope of this application, those skilled in the art can make various substitutions and modifications, all of which should fall within the scope of this application.

Claims

1. An abnormal risk identification method, characterized in that, The method includes: Build user profiles based on the target account's historical transaction data; Construct an account transaction graph based on the real-time transaction data of the target account; Based on the account transaction graph, identify the target transaction path corresponding to the target transaction; and Based on the user profile and the target transaction path, abnormal risks of the target transaction are identified.

2. The method according to claim 1, characterized in that, The process of constructing a user profile based on the target account's historical transaction data includes: Extract the structured transaction features and time-series transaction features from the historical transaction data; The structured transaction features are input into the first channel of the deep learning model for processing, and the time-series transaction features are input into the second channel of the deep learning model for processing; and The output features of the first channel and the second channel are fused to obtain target behavior features, and the user profile is constructed based on the target behavior features.

3. The method according to claim 1, characterized in that, The account transaction graph is a single graph structure or a dynamic graph sequence consisting of multiple single graph structures generated under a sliding time window. The single graph structure includes multiple nodes and multiple edges. The multiple nodes include at least a payment account and a receiving account, and the multiple edges include at least a directed edge representing the transaction behavior between the payment account and the receiving account.

4. The method according to claim 3, characterized in that, The method further includes: Input the account transaction graph into a graph convolutional neural network model; and The graph convolutional neural network model is used to learn the embedding representation of the plurality of nodes to generate embedding representation vectors corresponding to the plurality of nodes. The embedding representation vectors are used to characterize the transaction behavior patterns of the plurality of nodes in the transaction network.

5. The method according to claim 4, characterized in that, The step of using the graph convolutional neural network model to learn the embedding representations of the multiple nodes and generating embedding representation vectors corresponding to the multiple nodes includes: For each of the plurality of nodes: obtain node features and neighbor node features; aggregate the node features and neighbor node features to generate a context representation of the corresponding node; obtain the edge attributes of the corresponding edge; and The embedding representation vector is generated by performing multi-layer propagation calculations based on the context representation and the edge attributes.

6. The method according to claim 1, characterized in that, The step of identifying abnormal risks in the target transaction based on the user profile and the target transaction path includes: The target transaction path is modeled to generate a transaction path vector; The transaction path vector and the user profile vector are jointly input into the risk scoring model, and a scoring result is output; and Based on the scoring results, abnormal risks of the target transaction are identified.

7. The method according to claim 6, characterized in that, The step of modeling the target transaction path and generating a transaction path vector includes: A weighted aggregation of the target node features and corresponding neighbor node features for each hop in the target transaction path is performed based on a graph attention network. The weights of this aggregation are dynamically learned through an attention mechanism after concatenating the target node features and neighbor node features. A multi-head attention mechanism is used to fuse the weighted aggregation results to generate the transaction path vector.

8. The method according to claim 6, characterized in that, The method further includes: In multiple branch nodes, a risk scoring model is trained based on the local customer transaction data of each branch node to obtain local model parameters; and The local model parameters are sent to the central server, which aggregates the multiple local model parameters to generate a global model and distributes the global model to each branch node.

9. An anomaly risk identification device, characterized in that, The device includes: The user profile building module is used to: build user profiles based on the target account's historical transaction data; The account transaction graph construction module is used to: construct an account transaction graph based on the real-time transaction data of the target account; The target transaction path identification module is used to: identify the target transaction path corresponding to the target transaction based on the account transaction graph; and An anomaly risk identification module is used to identify anomalies in the target transaction based on the user profile and the target transaction path.

10. An electronic device, comprising: One or more processors; Memory, used to store one or more computer programs. The characteristic feature is that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 8.

11. A computer-readable storage medium having a computer program or instructions stored thereon, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the steps of the method according to any one of claims 1 to 8.

Images