Illegal fund transfer transaction identification method based on dynamic graph attention network

Abstract

The application relates to the technical field of artificial intelligence and financial risk control, and discloses an illegal fund transfer transaction identification method based on a dynamic graph attention network. The method obtains to-be-detected graph data and a previous time hidden state for pre-encoding, generates an initial embedding and an edge flow turnover rate matrix, inputs a double-branch network to extract graph convolution and graph attention features, performs weighted fusion by using a dynamic gate mask, performs dimension alignment on the previous time hidden state according to attention weights, maps the edge flow turnover rate into a forgetting penalty factor, combines a gating cycle unit update gate to generate an equivalent forgetting gate, and outputs a current time hidden state in combination with fusion features, and performs classification in combination with node states and edge embeddings. The scheme adaptively allocates the proportion of feature calculation, overcomes tensor dimension truncation, captures short-time high-frequency pulse transactions, and realizes the joint output of account and transaction link risks.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and financial risk control technology, specifically to a method for identifying illegal fund transfer transactions based on dynamic graph attention networks. Background Technology

[0002] Utilizing graph neural networks to uncover anomalous topological evolution patterns in financial transaction networks is a mainstream technical approach for identifying money laundering and other illicit fund transfers. When processing time-series transaction networks, conventional gated recurrent network mechanisms rely solely on smooth updates of hidden states over time steps. Their inherent memory decay mechanism fails to capture short-term, high-frequency, pulse-like fund flows in anomalous transactions, leading to the smooth erasure of critical, high-risk instantaneous states. Furthermore, illicit transactions are often accompanied by frequent account creation and cancellations, causing frequent fluctuations in the number of graph network nodes within adjacent time windows. This fluctuation directly results in misalignment of the graph state tensor dimensions between consecutive time steps, causing traditional time-series graph models to suffer feature dimension truncation during cross-time-cycle computation, thus interrupting the continuous calculation of historical time-series states.

[0003] Furthermore, in complex fund transfer networks, the static topological features of the same community and the dynamic edge features representing fund flows often alternately dominate. Conventional one-way graph computing networks lack adaptive adjustment mechanisms for network evolution. Forced splicing or fixed-ratio feature fusion can lead to feature conflicts between static and dynamic information, reducing the network's sensitivity to abnormal structures. At the data processing and risk output level of business terminals, existing technologies often coarsely combine multi-source heterogeneous ledger data and transaction logs, lacking a unified serialization mapping. Moreover, the final identification model is often limited to single-dimensional entity account assessment, failing to establish feature coupling calculation between node hidden states and transaction link channels, thus making it difficult to achieve a two-dimensional joint output of account suspicion probability and transaction edge risk. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method for identifying illegal fund transfer transactions based on dynamic graph attention networks. This method solves the technical problems of continuous computation interruptions caused by the misalignment of tensor dimensions between time steps due to frequent account additions and deletions when processing financial time-series transactions, as well as the inability of conventional recurrent network mechanisms to accurately capture short-term, high-frequency, pulse-like abnormal fund flows.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for identifying illicit fund transfer transactions based on dynamic graph attention networks, applied to computer equipment, comprising:

[0006] The process involves acquiring the transaction graph data to be detected, which includes node features, edge features, and topological relationships, along with the node hidden state at the previous time step. The node hidden state at the previous time step is then initialized. The transaction graph data to be detected is pre-encoded to generate an initial node embedding vector, an initial edge embedding vector, and an edge flow rate matrix.

[0007] The initial node is embedded into a vector input to a dual-branch network. The features of the first branch node are extracted through the graph convolution branch, and the features of the second branch node and the dynamic attention weight matrix are extracted through the graph attention branch.

[0008] Based on the hidden state of the node in the previous time step, a dynamic gating mask is generated, and the features of the first and second branch nodes are weighted and fused to generate fused node features.

[0009] Based on the dynamic attention weight matrix and the initial edge embedding vector, the hidden state of the node at the previous time step is dimensionally aligned to obtain the aligned historical state; the edge flow rate matrix is ​​mapped to the forgetting penalty factor, and the update gate of the gated recurrent unit is combined to generate an equivalent forgetting gate to control the decay retention of the aligned historical state; the hidden state of the node at the current time step is output in combination with the fused node features.

[0010] Based on the current node hidden state, initial edge embedding vector, and topological relationship, classification is performed, and the results of account and transaction link risk identification are output.

[0011] Specifically, the step of generating a dynamic gating mask based on the hidden state of the node at the previous time step, and then weighting and fusing the features of the first and second branch nodes to generate fused node features, is implemented through the following fusion formula:

[0012]

[0013] in: Indicates the current time Features of fusion nodes; This represents the characteristics of the first branch node; This represents the characteristics of the second branch node; This is the evolution gradient scalar. The evolution gradient scalar... The method for obtaining the weights is as follows: after performing mean pooling on the hidden state of the nodes at the previous time step, the weights are input into a multilayer perceptron for calculation. The network weight parameters of the multilayer perceptron are initialized based on historical experience data and automatically optimized during model training iterations. This fusion principle can adaptively allocate feature weights based on the historical fluctuations in the network topology, favoring local static structure in graph convolution and dynamic edge importance in graph attention.

[0014] Specifically, mapping the edge flow rate matrix to a forgetting penalty factor and generating an equivalent forgetting gate by combining the update gate of the gated loop unit is achieved through the following formula:

[0015] First, the forgetting penalty factor is generated through a linear mapping and a hyperbolic tangent activation function:

[0016]

[0017] Then, the equivalent forget gate is generated by combining the update gate state:

[0018]

[0019] in: The edge flow rate matrix is ​​calculated by counting the number of transaction edges associated with each node at the current time. and These are the learnable weight matrix and bias vector, which are initialized based on historical risk control experience data and trained through model backpropagation. The forgetting penalty factor is obtained through mapping; The standard gate state is updated within the gate control loop unit; It is a matrix of all 1s with the same dimension as the forgetting penalty factor, or a constant 1; Represents the Hadama product; This is the equivalent forget gate in the final output. The physical significance of this innovative mechanism lies in: using the frequency of fund transfers to forcibly intervene in the underlying memory decay mechanism. When a node engages in high-frequency transactions within a short period of time, the penalty factor is increased, forcing the model to remember the current high-risk state, thereby breaking through the limitation of traditional gated loop units that rely solely on time step updates.

[0020] Furthermore, addressing the issue of increasing or decreasing node numbers in dynamic networks, this invention, in the dimension alignment step, if the number of nodes at the current time step is less than the number of nodes at the previous time step, uses the dynamic attention weight matrix to weighted aggregate the hidden states of the vanishing node from the previous time step into neighboring nodes with topological relationships in the current graph topology, and removes the dimension of the vanishing node; if the number of nodes at the current time step is greater than the number of nodes at the previous time step, it finds a set of target nodes with topological relationships based on the initial edge embedding vector, performs mean pooling on the hidden states of the nodes from the previous time step of this set to generate a topological anchor vector, and concatenates it to the end of the dimension of the newly added node as the initial state. This processing logic ensures the continuous calculation of the temporal span and prevents distortion caused by feature dimension truncation.

[0021] This invention also provides an illicit fund transfer transaction identification system based on a dynamic graph attention network, comprising: a precoding module, a dual-branch extraction module, a dynamic fusion module, a temporal update module, and a multi-task classification module. The specific execution logic of its functional modules corresponds to the steps of the aforementioned identification method.

[0022] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the aforementioned method for identifying illegal fund transfer transactions.

[0023] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the aforementioned method for identifying illegal fund transfer transactions.

[0024] This invention provides a method for identifying illicit fund transfer transactions based on dynamic graph attention networks. It has the following beneficial effects:

[0025] 1. This invention extracts graph convolutional features and graph attention features through a dual-branch network, and uses the hidden state of the previous time step to generate a dynamic gating mask to perform weighted fusion. This scheme adaptively allocates the computational weight of static topology and dynamic edges, eliminating computational conflicts caused by the alternating dominance of network features over time.

[0026] 2. This invention utilizes dynamic attention weights to perform weighted aggregation on disappearing nodes and performs pooling on the association set of incremental nodes to generate topological anchors. This scheme can address the changes in graph matrix dimensions caused by account cancellation and new creation, reorganize historical hidden states in the spatial domain, and achieve continuous calculation of tensors of adjacent time windows.

[0027] 3. This invention extracts the transaction in-degree to generate the edge flow rate matrix, maps it to the forgetting penalty factor, and combines it with the gated cyclic unit update gate to generate an equivalent forgetting gate. This scheme uses the frequency of fund flow to intervene in the retention ratio of historical alignment states, breaks through the conventional cyclic network mechanism, and captures short-term pulse transaction behavior.

[0028] 4. This invention calls the node-gated recurrent network and the edge-gated recurrent network respectively to perform serialization processing on the node features containing ledger data and the edge features containing transaction logs. This scheme aligns multi-source heterogeneous business inputs to a unified feature space, generates an initial embedding vector, and establishes the basic tensor basis for graph computation.

[0029] 5. This invention extracts the hidden states of the source and target nodes, concatenates them with the initial edge embedding vector into a tensor, and inputs them into the classification layer. Combined with the synchronous forward propagation calculation of node states, this scheme integrates entity state parameters and fund flow path information to achieve the joint output of account suspected probability and transaction edge risk. Attached Figure Description

[0030] Figure 1 This is a flowchart of the illegal fund transfer transaction identification method based on dynamic graph attention network of the present invention;

[0031] Figure 2 This is a schematic diagram illustrating the evolution of the temporal dynamic transaction diagram structure of the present invention;

[0032] Figure 3 This is a diagram of the dual-branch spatial feature extraction and dynamic fusion network structure of the present invention;

[0033] Figure 4 This is a schematic diagram illustrating the dynamic dimension alignment and equivalent forgetting gate calculation of the present invention;

[0034] Figure 5 This is a schematic diagram of the illegal fund transfer transaction identification system of the present invention;

[0035] Figure 6 This is a schematic diagram of the internal hardware structure of the computer device of the present invention. Detailed Implementation

[0036] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Please see the appendix Figure 1 To be continued Figure 6 This invention provides a method for identifying illicit fund transfer transactions based on dynamic graph attention networks, including:

[0038] S1, acquire the transaction graph data to be detected, which includes node features, edge features, and topological relationships, and the node hidden state at the previous time step. If it is the initial time step, perform initialization. Pre-encode the transaction graph data to be detected to generate an initial node embedding vector, an initial edge embedding vector, and an edge flow rate matrix.

[0039] S2, embed the initial node into the vector input dual-branch network, extract the features of the first branch node through the graph convolution branch, and extract the features of the second branch node and the dynamic attention weight matrix through the graph attention branch;

[0040] S3, based on the node's hidden state at the previous time step, generate a dynamic gating mask, and perform weighted fusion of the features of the first and second branch nodes to generate fused node features;

[0041] S4. Based on the dynamic attention weight matrix and the initial edge embedding vector, the hidden state of the node at the previous time step is dimensionally aligned to obtain the aligned historical state; the edge flow rate matrix is ​​mapped to the forgetting penalty factor, and the update gate of the gated loop unit is combined to generate an equivalent forgetting gate to control the decay retention of the aligned historical state; the hidden state of the node at the current time step is output in combination with the fused node features.

[0042] S5. Based on the current node hidden state, initial edge embedding vector, and topological relationship, perform classification and output the account and transaction link risk identification results.

[0043] The illegal fund transfer transaction identification scheme involved in this invention strictly adheres to laws and regulations such as the Data Security Law and the Personal Information Protection Law throughout its underlying logic and data processing lifecycle. When acquiring transaction graph data to be detected, the system employs forced de-identification and irreversible hash encryption techniques. All account entity nodes are mapped to de-identified globally unique identifiers, stripping away all identifiable personal privacy information. Simultaneously, during the feature pre-coding stage, the algorithm proactively removes attribute fields such as gender, age, region, and ethnicity from its feature engineering whitelist, eliminating discriminatory logic based on identity labels from the algorithm's underlying layer and ensuring the absolute fairness of the model's judgment. Addressing the potential social impact of illegal fund identification, such as account freezing, this system is positioned to assist in risk control decisions. The output probability results are linked to a manual review mechanism to ensure that the social impact of high-risk AI application scenarios is completely controllable.

[0044] The method described in this embodiment mainly operates on a computer device with efficient parallel matrix computing capabilities. This device, through a preset data interface, acquires raw business logs containing basic account information and transaction details from the financial business infrastructure in real time or periodically, and converts them into standard structured data that can be recognized by graph networks.

[0045] In specific business scenarios for identifying illicit fund transfers, high-risk activities such as money laundering exhibit high levels of concealment and dramatic temporal fluctuations in network topology. Specifically, abnormal funds often follow a rapid in-and-out flow pattern; that is, within a very short time window, a specific group of accounts suddenly establishes dense transactional connections to complete fund transfers, after which the relevant accounts quickly become dormant or are closed. This objective reality causes the number of nodes, the number of edges, and the topological connection structure of the real transaction network to exhibit non-stationary evolutionary characteristics over time.

[0046] In order to enable computer devices to accurately represent and capture the complex physical scene described above, this invention divides the continuous financial transaction flow into multiple discrete time windows and constructs a dynamic transaction graph sequence that progresses over time.

[0047] For any current moment The system strictly defines the transaction graph data to be detected acquired at this moment as a directed attribute graph. .

[0048] in: Indicates the current time A set of nodes existing in a network, corresponding to independent entity accounts in a real financial network. Due to limitations imposed by objective operations such as account creation and closure in financial transactions, the number of nodes in this set is limited. It is a dynamic integer value that changes over time.

[0049] Indicates the current time The set of directed edges between nodes represents the actual fund transfer transactions between accounts. Any edge in this set... Both indicate the existence of a source node. To the target node A one-way flow of funds initiated.

[0050] Indicates the current time The extracted node feature matrix, where This represents the objective node feature dimension of the input. The specific values ​​of each element in this matrix are obtained based on historical static ledger data and dynamic behavior snapshots retained within the business system, including objective basic factual data such as account registration duration, entity authentication level, and industry category.

[0051] Indicates the current time The extracted edge feature matrix, where This represents the objective edge feature dimension of the input. The specific values ​​of each element in this matrix are obtained by parsing the real transaction data recorded by the system, including objective transaction attributes such as the absolute value of the single transaction amount, the timestamp of the transaction, and the type of the transfer device terminal.

[0052] Through the mathematical model transformation described above, computer devices abstract the highly irregular and difficult-to-calculate fund transfer behavior in the real world into a high-dimensional feature matrix and a topologically connected set with clear physical meaning and temporal evolution characteristics.

[0053] In this embodiment, after the computer device completes the construction of the graph sequence to be detected, the first step is to execute the feature processing and initialization logic of step S1. The system acquires the transaction graph data to be detected, which includes node features, edge features, and topological relationships, as well as the node hidden state at the previous time step, to establish the basic data environment within the current calculation cycle.

[0054] In the initial stage of dynamic temporal network operation, the system lacks historical temporal references. When the time step equals the initial time, this invention performs an initialization operation, setting the hidden state matrix of the nodes from the previous time step to zero. Specifically, the system generates an initial tensor matrix with all elements having zero values ​​based on the objective number of nodes existing at the initial time of the graph network. The column dimension of this matrix is ​​equal to the pre-defined width of the hidden layer network, and its main function is to provide standardized historical space anchors for iterative operations in subsequent time steps, ensuring the continuity of the sequence operations.

[0055] This invention employs a feature mapping pipeline, utilizing a node-gated recurrent network and an edge-gated recurrent network respectively to perform serialization precoding processing on the node features and the edge features.

[0056] The system inputs the original node feature matrix extracted at the current time into a node-gated recurrent network (NRN). Utilizing the network's internal gating mechanism, it extracts the temporal dependencies of the nodes and outputs initial node embedding vectors of uniform dimension. Similarly, the system inputs the original edge feature matrix into a structurally similar but parameter-independent edge-gated recurrent network (GRN), performs feature extraction, and outputs initial edge embedding vectors. All weight matrices and bias parameters within the node-gated and edge-gated recurrent networks are initially randomly generated based on the normal distribution of historical transaction data and iteratively calculated according to the gradient direction of the cross-entropy loss during the overall backpropagation training cycle of the model.

[0057] After completing the basic feature vector encoding, the system simultaneously performs feature extraction calculations reflecting physical topological abrupt changes, that is, calculating the edge flow rate based on the number of transaction edges associated with each node at the current moment. Illegal fund transfers in real-world financial scenarios exhibit significant high-frequency pulse characteristics, often accompanied by a large number of payment and receipt transactions concentrated in a single account within a very short time window. This invention addresses this physical fact by proposing the extraction of an edge flow rate matrix to quantify the instantaneous fluctuation intensity of the fund network.

[0058] For any node in the current time-to-time graph topology, the system calculates the out-degree of the node as a transaction initiator and the in-degree as a transaction receiver, and sums the two to obtain a scalar of the edge flow rate of a single node. The specific calculation formula is as follows:

[0059]

[0060] in: Represents any node At the present moment Calculate the edge flow rate obtained. (Set) Indicates the node in the current topology graph Let the set be the set of all legal directed edges generated for the fund remitter; correspondingly, the set... Represented by node This is the set of all legal directed edges generated for the fund receiving party. (Symbol) This indicates a discrete statistical summation operation on the number of elements contained in the set inside the brackets.

[0061] After the system traverses and calculates all active nodes in the current network, it vertically concatenates all the obtained scalars according to the node index order to form an edge flow rate matrix with the same dimension as the total number of nodes at the current time. This matrix depicts the level of business activity for each individual account entity during the current statistical period.

[0062] In this embodiment, after the computer device completes the precoding of the basic features of the graph topology, it immediately executes step S2 to extract the spatial feature depth representation. This invention synchronously inputs the initial node embedding vector into a parallel-designed dual-branch network, utilizing independent channels with the advantage of capturing heterogeneous information to perform parallel computation.

[0063] In the first computational branch, the system extracts the features of the first branch nodes through graph convolution based on the inherent connectivity of the graph topology. Graph convolution focuses on capturing the static homogeneous connectivity patterns of the financial network within a short time window, meaning that accounts in the same trading group tend to have similar feature expressions. The system extracts the normalized adjacency matrix containing self-loops from the graph structure at the current time step, and uses this as a weighted basis to perform a weighted summation and linear transformation on the initial node embedding vector of the target node and the embedding vectors of its first-order neighbor nodes with equal weights. Furthermore, a nonlinear activation function is applied to enhance the network's expressive power. The complete formula for calculating the feature matrix of the first branch nodes is as follows:

[0064]

[0065] in: This represents the feature matrix of the first branch node that describes the local topology at the current time, as output by the system. The matrix consisting of the initial node embedding vectors of all nodes at the current time; This indicates that an identity matrix has been added. The (i.e., self-loop) topological adjacency matrix allows nodes to retain their own characteristics when aggregating neighbor information; For corresponding The diagonal node degree matrix. To utilize the learnable weight matrix specific to the graph convolutional branch, the system employs ReLU as a non-linear activation function to filter out negative noise. Through this graph domain transformation, the system successfully extracts the features of the first branch node, reflecting the static correlation of the account group.

[0066] In the second computational branch operating in parallel, the features of the second branch nodes and the dynamic attention weight matrix are extracted through the graph attention branch. This invention dynamically evaluates the importance of fund flows by introducing a self-attention mechanism. In specific implementation, the system uses a multi-head attention mechanism to calculate the correlation score between the target node and its topologically related neighboring nodes, and converts this score into attention weights, thereby forming the dynamic attention weight matrix.

[0067] For any directed edge in the current graph topology, corresponding to the source node and the target node, the system uses the attention weight calculation formula to obtain the importance distribution between them:

[0068]

[0069] in: Indicates the target node at the current time. Neighboring nodes with whom it has transaction relationships The assigned single-head dynamic attention weight coefficients. and These represent the nodes generated by the precoding module. With nodes The initial node embedding vector. To perform a linear transformation, a shared weight matrix is ​​used for the parameters. This is the transpose of the weight vector within the attention mechanism. Both are randomly initialized based on the model's pre-training data and continuously optimized and updated via the backpropagation algorithm.

[0070] In the formula, the symbol This indicates a tensor concatenation operation performed on the transformed node vectors involved in the computation. LeakyReLU represents the linear unit activation function with leakage correction used by the system to ensure that a small gradient flow is maintained in the negative input region, preventing neuron failure and truncation problems in the computation chain. For the target node The system calculates the set of directly connected first-order neighboring nodes. It performs a standardized exponential operation on the attention scores generated by the target node and all its connected neighbors, ultimately obtaining a normalized weight distribution matrix with a sum of a constant.

[0071] After obtaining the dynamic attention weight matrix, the system performs aggregation and transformation operations on the initial node embedding vectors of neighboring nodes with topological connections based on this weight matrix, thereby outputting the features of the second branch node. This aggregation calculation process abandons the traditional average pooling strategy and instead relies on the obtained dynamic weight coefficients to perform a weighted summation of the feature contributions of neighboring nodes. The calculation formula is as follows:

[0072]

[0073] in: The corresponding node in the feature matrix of the second branch node representing the system output eigenvectors. The weighting coefficients derived from the previous calculation stage are used to accurately quantify the nodes. For nodes Characteristic delivery intensity. Symbol The system operates using a pre-defined nonlinear activation function. After traversing the entire graph topology set and performing weighted aggregation, the generated second branch node features effectively remove background noise interference from regular legitimate transactions, forcibly clustering the feature representation center of the network model onto key abnormal fund connections with high concealment and prominent weight.

[0074] In this embodiment, to avoid network oversmoothing caused by the aggregation of high-order neighbor nodes, the number of network layers in both the graph convolutional branch and the graph attention branch is fixed at 2. Within the internal computation mechanism of the graph attention branch, the number of independent computation heads for multi-head attention is set to 8. This branch calculates the association weights between nodes using 8 parallel and mutually exclusive attention heads, and performs tensor concatenation operations on these 8 sets of subspace features at the output of a single-layer network, thereby mapping them to the final second branch node features. This enhances the system's ability to capture features of multi-dimensional, concealed fund flows in complex money laundering transaction channels.

[0075] In this embodiment, after the computer device obtains the features of the first branch node and the second branch node, it proceeds to step S3 to execute time-series state-driven dynamic gating fusion. Because illegal fund transfer links exhibit alternating dominance of structural and transaction features at different evolutionary stages, a fixed-ratio feature splicing cannot adapt to the network topology that fluctuates drastically over time. Based on historical time-series memory, the system generates a dynamic gating mask based on the node's hidden state at the previous moment, and performs weighted fusion of the features of the first and second branch nodes to generate fused node features.

[0076] To generate mask coefficients reflecting the historical volatility of the system, the system first performs a global mean pooling operation on the hidden states of the nodes at the previous time step. This operation compresses the high-dimensional graph state tensor into a one-dimensional comprehensive state vector that can characterize the overall macro-level trading environment of the network by calculating the arithmetic mean of the hidden state vectors of all nodes. Subsequently, the system inputs this one-dimensional comprehensive state vector into a well-defined multilayer perceptron for computation. To ensure that the output weights have physical meaning, the output layer of the multilayer perceptron must use the sigmoid activation function for hard numerical range constraints, thereby generating an evolutionary gradient scalar with values ​​distributed in the (0,1) interval, the calculation formula of which is expressed as:

[0077]

[0078] in: This represents the hidden state of the node in the previous time step. and These represent the network weights and bias parameters of the multilayer perceptron.

[0079] Based on this, the system will obtain the scalar from the calculation. and the difference between the constant 1 and the scalar These are used as the first and second weighting coefficients, respectively, to form the dynamic gating mask. Since constant 1 and constant 0 constitute the basic probability interval, this masking mechanism ensures that the sum of the contributions of the features provided by the two branch networks in the final fusion result remains constant at 1. The allocation logic of the above mask coefficients and the calculation formula for the final feature fusion are as follows:

[0080]

[0081] in: This represents the fusion node feature matrix output by the system at the current moment after fusion calculation. The corresponding feature matrix of the first branch node generated by graph convolution branching; This corresponds to the feature matrix of the second branch node generated by the graph attention branch extraction.

[0082] In the formula, The evolutionary gradient scalar is calculated and output by a multilayer perceptron, and its numerical range is strictly distributed within the standard normalization interval by the activation function. This is the difference variable obtained through calculation. The two parameters mentioned above function as dynamic gating masks, acting as the first and second weighting coefficients, respectively. When the network is relatively static and the node connections are stable, the evolutionary gradient scalar value tends to be high, and the system tends to retain the static topological information of the first branch. Conversely, when the network is in an abnormally active period with local high-frequency trading outbreaks and abrupt changes in edge weights, the value of the difference variable increases, and the system's control feature expression is forcibly biased towards the second branch to capture potential risky capital flows.

[0083] The system calculates the above formula by performing matrix multiplication and element-wise addition. The resulting fused node features not only achieve tensor alignment in the feature dimension, but also realize adaptive coupling between the global static structure and local high-risk behavioral features in a physical sense.

[0084] In this embodiment, after completing the adaptive fusion of spatial domain features, the computer device proceeds to step S4 to execute the cross-domain dimensional alignment and equivalent forgetting gate control mechanism. Because the financial graph network is in a continuous dynamic evolution process, frequent account cancellations and creations inevitably lead to fluctuations in the number of graph nodes within adjacent time windows. This time-varying number of nodes directly causes abrupt changes in the tensor matrix dimension, preventing standard time-series networks from directly inheriting historical data. Therefore, the system performs dimensional alignment of the hidden state of the nodes at the previous time step based on the dynamic attention weight matrix and the initial edge embedding vector to obtain the aligned historical state.

[0085] When performing dimension alignment, the system monitors the difference in the number of nodes between the current time step and the previous time step in real time and follows three mutually exclusive dimension correction logics.

[0086] If the number of nodes at the current moment is less than the number of nodes at the previous moment, it indicates that there are dormant nodes in the network that have completed fund transfers and quickly deregistered. Let the set of disappeared nodes be denoted as . The set of nodes to be retained is The system utilizes the dynamic attention weight matrix obtained through spatial domain computation. The hidden state of the disappeared node at the previous time step is weighted and aggregated, and then compensated into the vectors of neighboring nodes in the current graph topology that have historical transaction connections with it. For any retained node... The corrected formula for calculating the hidden historical state is as follows:

[0087]

[0088] in: For the compensated node Historical status For nodes The set of neighbors. After completing the weighted aggregation allocation, the system forcibly removes the set from memory. The feature dimensions corresponding to each disappearing node.

[0089] If the number of nodes at the current moment is greater than the number of nodes at the previous moment, it indicates that there are new nodes that have opened accounts and immediately participated in trading. Let the newly added nodes be... The system finds nodes based on the initial edge embedding vector. A set of target neighbor nodes with active fund flows. The system performs mean pooling on the hidden state of the nodes in the previous time step for this set, generating a topological anchor vector representing the historical transaction inertia of this local region. The calculation formula is:

[0090]

[0091] Subsequently, the system uses this topological anchor vector as the initial state and directly appends it to the end of the newly added node dimension of the tensor matrix. If the number of nodes at the current time step equals the number of nodes at the previous time step, the system determines that the physical topological node scale remains in a steady state, and thus keeps the feature dimension of the historical state tensor unchanged. The matrix output by the above tensor recombination operation is the aligned historical state that achieves continuous computation across time steps.

[0092] After forced dimensional alignment, the system then maps the edge flow rate matrix to a forgetting penalty factor and generates an equivalent forgetting gate by combining the update gate of the gated loop unit, so as to control the decay retention of the aligned historical state.

[0093] The system uses a mapping network containing a hyperbolic tangent activation function and a linear layer to perform a nonlinear transformation on the edge flow rate matrix generated in the previous steps. The formula for calculating the penalty factor is as follows:

[0094]

[0095] in: The side flow rate matrix represents the input system operation. This represents the learning weight matrix involved in the linear mapping calculation. This represents the additional bias vector. The above parameters are randomly generated during the model initialization phase and continuously updated iteratively during the gradient descent operation. The hyperbolic tangent activation function selected for the system stably restricts the output value range to a specific positive and negative interval. The output tensor is calculated using this formula. This is the matrix of forgetting penalty factors required by the system.

[0096] Subsequently, the system calculates the difference between the constant 1 and the forgetting penalty factor, and applies this difference directly to the original update gate state calculated by the gated loop unit to generate the equivalent forgetting gate. The calculation formula for this logic control is as follows:

[0097]

[0098] in: This represents the native update gate state generated by the system calling the standard gated loop unit component. This is a constant matrix with identical dimension and penalty factor. After performing element-wise subtraction, the system uses the Hadamard product operator. The original update gate is multiplied element-wise, and the final output is the calculated and corrected equivalent forget gate. .

[0099] Complete the equivalent forgetting gate After the state is generated, the system uses this gating variable to precisely control the retention ratio of aligned historical states, and then combines it with the candidate hidden states generated under the gating mechanism at the current moment to participate in a weighted mathematical calculation, ultimately outputting the hidden state of the node at the current moment. The complete update formula is as follows:

[0100]

[0101] in: The current hidden state of the node is the final output of the system. This refers to the aligned historical state obtained after the aforementioned steps of weighted aggregation and splicing. To combine the characteristics of the current fusion nodes The candidate hidden states are calculated by aligning with the historical states.

[0102] The physical significance of the aforementioned innovative mechanism lies in the fact that when a certain account node experiences a sudden surge in high-frequency, large-amount transfers, the value of the edge flow rate matrix spikes, causing the forgetting penalty factor to amplify synchronously. This, in turn, forces the equivalent forgetting gate to be forced through interpolation. The value decreases, reaching an approximately truncated state. This operational logic forces the system to significantly weaken the alignment with historical states. The retained weights are used to force attention toward the currently extracted anomalous candidate states. The tilting mechanism overcomes the technical limitations of traditional networks that rely solely on smooth updates over time steps, thus ignoring the risk of short-term pulses.

[0103] In this embodiment, after completing the cross-temporal deep feature update iteration, the computer device immediately proceeds to step S5 to perform multi-task risk joint classification. Through the deep representation learning of the aforementioned series of spatiotemporal features, the hidden state tensor output by the system fully encodes the static attributes, dynamic fund flow frequency, and global topological relationship structure inherent in the account entity. Based on the current node hidden state, initial edge embedding vector, and topological relationships, the system performs joint classification calculations and outputs risk identification results containing both the account entity and transaction link dimensions.

[0104] In the account risk classification task, the system inputs the current hidden state of the nodes, updated over time, into the node classification layer for processing. The node classification layer, composed of a multilayer perceptron and a normalized exponential function, is responsible for mapping high-dimensional hidden layer features to discrete risk probability distributions. For each entity node in the current network, the node classifier outputs its probability distribution of suspected illegal fund transfer transactions, which is then used as the final account risk identification result.

[0105] The mathematical formula for this classification prediction is as follows:

[0106]

[0107] in: This represents the hidden state matrix of nodes, which contains all the features of all nodes, output by the system at the current moment. This represents the weight matrix, which represents the learnable parameters within the node classifier. This represents the bias vector during the feature mapping process. The system uses Softmax as the normalized exponential activation function, forcibly converting the real-valued outputs in each dimension into continuous probability values ​​distributed between 0 and 1, while ensuring that the sum of the probabilities of all classes is a constant. The output prediction vector is then calculated. This indicates the probability of whether the independent account belongs to a normal trading entity or an illegal high-risk entity.

[0108] In the transaction link risk classification task, the system extracts the source node hidden vector and the target node hidden vector corresponding to each real transaction edge. To fully capture the risk attributes of the transaction path, the system performs a tensor concatenation operation on the feature dimension using the above two node hidden vectors and the initial edge embedding vector corresponding to the graph topology. Subsequently, the system inputs the concatenated high-dimensional hybrid vector into the edge classification layer containing a specific activation function for forward propagation.

[0109] Edge classification directly assesses whether a single fund flow involves illegal operations such as money laundering, which is a binary classification problem. The system uses an edge classifier with a sigmoid activation function to calculate the specific probability that the link has a risk, and outputs this as the transaction link risk identification result. The corresponding link risk prediction formula is as follows:

[0110]

[0111] in: and These represent the source node hidden features and the target node hidden features extracted from the node hidden state matrix at the current time, respectively. This represents the initial edge embedding vector of a specific transaction edge extracted and retained during the precoding stage. (Symbol) This indicates that the three tensors involved in the computation are concatenated.

[0112] In the formula, and These represent the feature map weight vector with a transposed structure and the linear bias parameter in the edge classifier, respectively. The computation system uses the Sigmoid standard activation function to perform a non-linear transformation on the feature map results. The scalar output calculated by this formula... This intuitively reflects the current moment from the account node. To account node The predicted probability that the initiated fund transfer belongs to an illegal transaction chain.

[0113] During the actual model training and parameter optimization process, the system calculates the cross-entropy difference between the risk classification outputs of individual nodes and edge links and the objective data labeled in the real business system. To achieve multi-task driven operation, the system weighted and summed these two sets of classification difference data to construct a global joint loss function. The specific calculation formula is as follows:

[0114]

[0115] in: For account nodes The true risk label (0 or 1). Predicted risk probabilities for the node classification layer; For the trading side The true illegal transfer label, This is the risk probability predicted by the edge classification layer. and The system sets the node classification task weight and edge classification task weight respectively (for example, 0.4 and 0.6 respectively, to emphasize transaction link tracing).

[0116] By invoking the backpropagation algorithm and Adam gradient descent optimizer within deep learning frameworks (such as PyTorch or TensorFlow), the system utilizes the aforementioned global joint loss function. Calculate the network gradient and continuously update the weight matrix and bias parameters in all modules in the above steps automatically until the joint loss of the network model converges to a stable threshold range, thus completing the training and inference closed loop of the entire recognition system.

[0117] During the model training and parameter optimization phase, the original financial dynamic transaction graph dataset is divided into training set, validation set and test set according to the time sequence, with the division ratios set to 70%, 10% and 20% respectively, in order to cut off the feature leakage channel caused by the information crossing of future time windows.

[0118] For the gradient backpropagation of the aforementioned multi-task joint loss function, the system employs the AdamW optimizer to iterate the network parameters. The initial learning rate is set to 0.001, and a cosine annealing mechanism is used to dynamically control the learning step size. The network throughput time window batch size is configured to 128, and the maximum number of training iterations is set to 200. An early stopping mechanism is triggered in parallel during training, with a monitoring tolerance of 15 iterations. When the joint loss calculated on the validation set fails to decrease for 15 consecutive iterations, the hardware tensor core will truncate the training process and solidify the output model weight tensor at the minimum value of the validation loss.

[0119] In this embodiment, based on the disclosed method logic for identifying illegal fund transfer transactions using dynamic graph attention networks, the present invention also provides a system for identifying illegal fund transfer transactions using dynamic graph attention networks. This system, as a virtual logic device executing the core computational steps of the above method, is pre-deployed and runs on a corresponding server cluster or risk control host platform.

[0120] The system specifically includes a precoding module, a dual-branch extraction module, a dynamic fusion module, a time-series update module, and a multi-task classification module.

[0121] Specifically, the precoding module is used to obtain the transaction graph data to be detected, which includes node features, edge features and topological relationships, and the node hidden state at the previous time step. It initializes the node hidden state at the initial time step and generates the initial node and edge embedding vector and edge flow rate matrix by precoding the features.

[0122] The dual-branch extraction module is used to input the initial node embedding vector into the dual-branch network. It extracts the features of the first branch nodes, the features of the second branch nodes, and the dynamic attention weight matrix through the internally encapsulated graph convolution branch and graph attention branch, respectively. The dynamic fusion module is responsible for generating a dynamic gating mask based on the node hidden state of the previous time step, performing adaptive weighted fusion calculation on the features of the two branch nodes, generating fused node features, thereby effectively resolving the feature conflict between static topology and dynamic connections.

[0123] The temporal update module is the core engine component of the system. It is used to align the hidden state of the node at the previous time step with the dimension based on the dynamic attention weight matrix and the initial edge embedding vector to obtain the aligned historical state. The system's embedded mapping network maps the edge flow rate matrix to the forgetting penalty factor, and then combines the update gate of the gated recurrent unit to generate an equivalent forgetting gate to control the decay and retention of the historical state. Finally, it combines the fused node features to output the hidden state of the node at the current time step.

[0124] The multi-task classification module is configured at the system's data output end. It is used to perform forward propagation classification calculations based on the current node hidden state, initial edge embedding vector, and topological relationship, and finally outputs the account risk identification results and transaction link risk identification results to the external business platform.

[0125] In this invention, to realize the physical implementation of the aforementioned virtual system and complex network inference, a computer device is also provided. This device is custom-built at the hardware level and has the hardware foundation to support matrix multiplication and tensor concatenation calculations within a graph neural network framework.

[0126] The computer device includes a memory and a processor that are interconnected via a system-level internal bus. The memory is divided into a non-volatile storage area and a high-speed internal memory, which stores a computer program that can run on the processor. The processor, as the core of the device's computational control, reads and executes the computer program in the memory to implement all the computational control steps of the aforementioned detailed method for identifying illegal fund transfer transactions. The processor is a central processing unit equipped with a tensor acceleration core.

[0127] In this embodiment, the present invention provides a computer-readable storage medium on which a computer program for executing algorithmic logic is physically stored. When the computer program is loaded, read, and executed by the processor of a terminal or server device, the complete execution steps of the aforementioned illegal fund transfer transaction identification method can be reproduced without loss. This computer-readable storage medium employs non-transient data recording technology, specifically encompassing solid-state physical media such as magnetic storage devices, optical data storage disks, and solid-state drive arrays, to ensure that the core risk control model of the present invention still possesses the ability for persistent deployment and multi-node distributed distribution even offline.

Claims

1. A method for identifying illicit fund transfer transactions based on dynamic graph attention networks, characterized in that, Applied to computer equipment, including: S1, acquire the transaction graph data to be detected, which includes node features, edge features, and topological relationships, and the node hidden state at the previous time step. If it is the initial time step, perform initialization. Pre-encode the transaction graph data to be detected to generate an initial node embedding vector, an initial edge embedding vector, and an edge flow rate matrix. The node characteristics correspond to independent entity accounts in the actual financial network; The edge feature corresponds to the actual fund transfer transaction records generated between accounts; The edge flow rate is calculated based on the number of transaction edges associated with each node at the current time, and the edge flow rate matrix is ​​constructed. S2, embed the initial node into the vector input dual-branch network, extract the features of the first branch node through the graph convolution branch, and extract the features of the second branch node and the dynamic attention weight matrix through the graph attention branch; S3, Based on the node's hidden state at the previous time step, a dynamic gating mask is generated, and the features of the first and second branch nodes are weighted and fused to generate fused node features; S4. Based on the dynamic attention weight matrix and the initial edge embedding vector, the hidden state of the node at the previous time step is dimensionally aligned to obtain the aligned historical state; the edge flow rate matrix is ​​mapped to the forgetting penalty factor, and the update gate of the gated loop unit is combined to generate an equivalent forgetting gate to control the decay retention of the aligned historical state; the hidden state of the node at the current time step is output in combination with the fused node features. S5, perform classification based on the current node hidden state, initial edge embedding vector and topological relationship, and output the account and transaction link risk identification results; In step S3, a dynamic gating mask is generated based on the hidden state of the node at the previous time step, including: The hidden state of the node at the previous time step is subjected to mean pooling and input into a multilayer perceptron to generate an evolutionary gradient scalar. The scalar and the difference between the constant 1 and the scalar are used as the first and second weighting coefficients to form the dynamic gating mask, respectively. In S4, an equivalent forget gate is generated to control the decay retention of the aligned history state, including: The edge flow rate matrix is ​​mapped to a forgetting penalty factor by using a hyperbolic tangent activation function and a linear layer; Calculate the difference between constant 1 and the forgetting penalty factor, and perform a Hadamard product operation on the difference and the update gate state of the gated loop unit to generate the equivalent forgetting gate; The equivalent forget gate is used to control the degree of retention of the aligned historical state, and the hidden state of the node at the current time is calculated and output in combination with the candidate hidden state.

2. The method according to claim 1, characterized in that, In S1, the initial node and edge embedding vectors and the edge flow rate matrix are generated, including: The node features and edge features are serialized using a node-gated recurrent network and an edge-gated recurrent network, respectively, to output the initial node and edge embedding vectors.

3. The method according to claim 1, characterized in that, In S2, the features of the second branch node and the dynamic attention weight matrix are extracted, including: The attention weights between the target node and its neighboring nodes are calculated using a multi-head attention mechanism to form the dynamic attention weight matrix; Based on the weight matrix, the initial node embedding vectors of neighboring nodes are weighted, aggregated, and nonlinearly mapped to output the features of the second branch node.

4. The method according to claim 1, characterized in that, In step S4, dimensional alignment is performed to obtain the alignment history state, including: If the number of nodes at the current time is less than the number of nodes at the previous time, then the hidden state of the previous time node of the disappearing node is weighted and aggregated into the neighboring nodes with topological relationships in the current graph topology using the dynamic attention weight matrix, and the dimension of the disappearing node is removed. If the number of nodes at the current time step is greater than the number of nodes at the previous time step, then find the set of target nodes that have a topological relationship with the newly added node based on the initial edge embedding vector, and perform mean pooling on the hidden state of the nodes at the previous time step of the set to generate a topological anchor vector, which is then concatenated to the end of the dimension of the newly added node as the initial state. If the number of nodes at the current time step is equal to the number of nodes at the previous time step, then the dimension remains unchanged.

5. The method according to claim 1, characterized in that, In step S5, the risk identification results are output through classification, including: Input the current hidden state of the node into the node classification layer, and predict the probability distribution of each node's suspected illegal fund transfer transactions as the account risk identification result; Extract the hidden vectors of the source node and target node corresponding to each transaction edge, concatenate them with the initial edge embedding vector, and input them into an edge classification layer containing a Sigmoid activation function. Predict the probability distribution of each edge belonging to an illegal fund transfer transaction as the result of transaction link risk identification.

6. An illegitimate fund transfer transaction identification system based on dynamic graph attention networks, characterized in that, include: The precoding module is used to acquire the transaction graph data to be detected, which includes node features, edge features, and topological relationships, and the hidden state of the nodes at the previous time step. It initializes the hidden state of the nodes at the previous time step and precodes the features to generate initial node and edge embedding vectors and an edge flow rate matrix. The node features correspond to independent entity accounts in the actual financial network; the edge features correspond to actual fund transfer transaction records generated between accounts; and the edge flow rate is calculated based on the number of transaction edges associated with each node at the current time step, forming the edge flow rate matrix. The dual-branch extraction module is used to input the initial node embedding vector into the dual-branch network, and extract the features of the first branch node, the features of the second branch node, and the dynamic attention weight matrix through the graph convolution branch and the graph attention branch, respectively. The dynamic fusion module is used to generate a dynamic gating mask based on the hidden state of the node in the previous time step, and to generate fused node features by weighted fusion of the features of the two branch nodes; wherein, mean pooling is performed on the hidden state of the node in the previous time step and input into a multilayer perceptron to generate an evolutionary gradient scalar; the scalar and the difference between the constant 1 and the scalar are used as the first and second weighting coefficients to form the dynamic gating mask. The temporal update module is used to align the hidden state of the node at the previous time step with the dynamic attention weight matrix and the initial edge embedding vector to obtain the aligned historical state; it maps the edge flow rate matrix to a forgetting penalty factor, and generates an equivalent forgetting gate by combining the update gate of the gated recurrent unit to control the retention of the historical state; and outputs the hidden state of the node at the current time step by combining the fused node features. Specifically, the edge flow rate matrix is ​​mapped to a forgetting penalty factor by a hyperbolic tangent activation function and a linear layer; the difference between the constant 1 and the forgetting penalty factor is calculated, and the difference is multiplied by the Hadamard product of the update gate state of the gated recurrent unit to generate the equivalent forgetting gate; the equivalent forgetting gate is used to control the retention degree of the aligned historical state, and the hidden state of the node at the current time step is calculated and output by combining the candidate hidden states. The multi-task classification module is used to perform classification based on the current node hidden state, initial edge embedding vector, and topological relationship, and output the risk identification results of account and transaction links.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1 to 5.

Images