Banking flow data intelligent analysis method and system based on large model

Abstract

The application discloses a bank flow data intelligent analysis method and system based on a large model, relates to the technical field of data processing, and comprises the following steps: acquiring an original transaction record set, generating a first flow data sequence and a second flow data sequence, obtaining a first difference sequence, and obtaining a second difference sequence; acquiring a first coefficient and a second coefficient, generating a first dynamic active coefficient according to the first coefficient, the second coefficient and the first difference sequence, and generating a second dynamic active coefficient according to the first coefficient, the second coefficient and the second difference sequence; acquiring an initial fusion correlation coefficient based on a large language model, the first dynamic active coefficient and the second dynamic active coefficient, weighting and fusing the first flow data sequence and the second flow data sequence based on the initial fusion correlation coefficient, and generating a behavior representation vector; and outputting a risk assessment result according to the behavior representation vector and a preset risk discrimination boundary. The application has the advantages of self-adaptation, large model fusion and precise analysis.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to an intelligent analysis method and system for bank transaction data based on a large model. Background Technology

[0002] In the field of intelligent analysis of bank transaction data, especially in application scenarios for identifying transaction behavior and assessing risks for corporate or individual accounts, existing methods generally suffer from insufficient adaptability when dealing with dynamically changing transaction data.

[0003] Specifically, existing technical solutions typically employ fixed time windows to statistically analyze account transaction behavior. They characterize account features by calculating static indicators such as the total number of transactions and total transaction amount within a preset period. However, when an account experiences a sudden surge or drop in transaction frequency within a short period while net capital inflow remains relatively stable, or when transaction frequency remains stable but capital flow fluctuates dramatically, single-dimensional cumulative statistical indicators cannot effectively capture this abrupt coupling between transaction frequency and capital flow over time. This results in a lack of effective correlation modeling mechanisms between the generated transaction frequency statistics and net capital flow statistics. Furthermore, existing technical solutions rely heavily on fixed static thresholds to judge sequential data when handling abnormal transaction identification. For example, a preset threshold of more than 50 transactions per day is considered abnormal. This static threshold setting method fails to consider the inherent fluctuation characteristics of different account types and different transaction periods, leading to insensitivity to minor anomalies in high-frequency, low-value transaction accounts, while being overly sensitive to normal fluctuations in low-frequency, high-value transaction accounts. Furthermore, current technical solutions lack an adaptive noise filtering mechanism in the data preprocessing stage. They typically use a uniform filtering standard to process all difference data, failing to dynamically adjust the filtering threshold according to the fluctuation of the original data sequence itself. This results in retaining too much noise information when the data fluctuates drastically, while potentially filtering out valuable weak abnormal signals when the data fluctuation is gentle. Summary of the Invention

[0004] To address the technical problems mentioned above, this invention provides a method and system for intelligent analysis of bank transaction data based on a large model.

[0005] A method for intelligent analysis of bank transaction data based on a large model includes: acquiring a set of original transaction records for a target account within a preset time window; generating a first transaction data sequence and a second transaction data sequence based on the original transaction record set; calculating the difference between adjacent data in the first transaction data sequence to obtain a first difference sequence; calculating the difference between adjacent data in the second transaction data sequence to obtain a second difference sequence; acquiring a first coefficient and a second coefficient according to the preset time window; generating a first dynamic activity coefficient based on the first coefficient, the second coefficient, and the first difference sequence; generating a second dynamic activity coefficient based on the first coefficient, the second coefficient, and the second difference sequence; acquiring an initial fusion correlation coefficient based on a large language model, the first dynamic activity coefficient, and the second dynamic activity coefficient; performing weighted fusion on the first and second transaction data sequences based on the initial fusion correlation coefficient to generate a behavioral representation vector; and outputting a risk assessment result based on the behavioral representation vector and a preset risk discrimination boundary.

[0006] Optionally, generating the first and second transaction data sequences based on the original transaction record set includes: dividing the preset time window into multiple consecutive and equally long sliding time sub-windows; counting the number of transactions within each sliding time sub-window and forming the first transaction data sequence; and performing algebraic summation on the transaction amount within each sliding time sub-window according to the transaction direction and forming the second transaction data sequence.

[0007] Optionally, obtaining the first coefficient and the second coefficient according to the preset time window includes: obtaining the total duration of the preset time window and the standard sub-window length, dividing the total duration of the preset time window by the standard sub-window length to obtain a standard window quantity index; obtaining the first standard coefficient and the second standard coefficient, obtaining the first coefficient according to the number of sliding time sub-windows, the standard window quantity index and the first standard coefficient, and obtaining the second coefficient according to the number of sliding time sub-windows, the standard window quantity index and the second standard coefficient.

[0008] Optionally, generating the first dynamic activity coefficient based on the first coefficient, the second coefficient, and the first difference sequence includes: using the product of the standard deviation of the first pipeline data sequence and the first coefficient as a first noise threshold, and using the product of the standard deviation of the first pipeline data sequence and the second coefficient as a first anomaly detection threshold; removing data in the first difference sequence whose absolute value is less than the first noise threshold to obtain a first effective difference sequence; removing data in the first effective difference sequence whose deviation from the average value exceeds the first anomaly detection threshold to obtain a first target difference sequence; obtaining a first standard change threshold, counting the number of data in the first target difference sequence whose absolute value exceeds the first standard change threshold and using it as the first mutation number; and dividing the first mutation number by the total number of data in the first target difference sequence to obtain the first dynamic activity coefficient.

[0009] Optionally, generating the second dynamic activity coefficient based on the first coefficient, the second coefficient, and the second difference sequence includes: using the product of the standard deviation of the second pipeline data sequence and the first coefficient as a second noise threshold, and using the product of the standard deviation of the second pipeline data sequence and the second coefficient as a second anomaly detection threshold; removing data in the second difference sequence whose absolute value is less than the second noise threshold to obtain a second effective difference sequence; removing data in the second effective difference sequence whose deviation from the average value exceeds the second anomaly detection threshold to obtain a second target difference sequence; obtaining a second standard change threshold, counting the number of data in the second target difference sequence whose absolute value exceeds the second standard change threshold and using it as the second mutation number; and dividing the second mutation number by the total number of data in the second target difference sequence to obtain the second dynamic activity coefficient.

[0010] Optionally, obtaining the initial fusion correlation coefficient based on the large language model, the first dynamic activity coefficient, and the second dynamic activity coefficient includes: generating structured prompt text based on the first dynamic activity coefficient and the second dynamic activity coefficient; inputting the structured prompt text into the encoder layer of the large language model; modeling the first dynamic activity coefficient and the second dynamic activity coefficient through the attention mechanism of the large language model; and extracting numerical fusion weights from the output layer of the large language model as the initial fusion correlation coefficient.

[0011] Optionally, the weighted fusion of the first and second pipeline data sequences based on the initial fusion correlation coefficient to generate a behavior representation vector includes: normalizing the first and second pipeline data sequences respectively to obtain normalized sequences; and calculating the behavior representation vector based on the initial fusion correlation coefficient and the normalized sequences.

[0012] A large-model-based intelligent analysis system for bank transaction data is also provided. This system implements a large-model-based intelligent analysis method for bank transaction data. The system includes: a data integration module, used to acquire the original transaction record set of the target account within a preset time window, and generate a first transaction data sequence and a second transaction data sequence based on the original transaction record set; calculate the difference between adjacent data in the first transaction data sequence to obtain a first difference sequence; calculate the difference between adjacent data in the second transaction data sequence to obtain a second difference sequence; a dynamic coefficient generation module, used to acquire the first and second coefficients according to the preset time window, and generate a first dynamic activity coefficient based on the first coefficient, the second coefficient, and the first difference sequence; and generate a second dynamic activity coefficient based on the first coefficient, the second coefficient, and the second difference sequence; a large-model fusion module, used to acquire an initial fusion correlation coefficient based on a large language model, the first dynamic activity coefficient, and the second dynamic activity coefficient; perform weighted fusion of the first and second transaction data sequences based on the initial fusion correlation coefficient; and an evaluation processing module, used to output a risk assessment result based on the behavioral representation vector and a preset risk discrimination boundary.

[0013] Optionally, the data integration module is further configured to: divide the preset time window into multiple consecutive sliding time sub-windows of equal length; count the number of transactions in each sliding time sub-window and form the first transaction data sequence; and perform algebraic summation on the transaction amount in each sliding time sub-window according to the transaction direction and form the second transaction data sequence.

[0014] Optionally, the dynamic coefficient generation module is further configured to: obtain the total duration of the preset time window and the standard sub-window length; divide the total duration of the preset time window by the standard sub-window length to obtain a standard window quantity index; obtain a first standard coefficient and a second standard coefficient; obtain the first coefficient based on the number of sliding time sub-windows, the standard window quantity index and the first standard coefficient; and obtain the second coefficient based on the number of sliding time sub-windows, the standard window quantity index and the second standard coefficient.

[0015] The beneficial effects of this invention are reflected in: In the entire intelligent analysis method of bank transaction data based on a large model, a sliding time window is first used to transform discrete transactions into equally spaced transaction data sequences, aligning transaction frequency with net capital inflow in the time dimension and providing a structured foundation for subsequent coupled analysis. Then, by calculating the difference between adjacent windows to obtain a rate of change sequence, the dynamic fluctuations of behavior are directly measured rather than the cumulative total. Based on this, a dynamic coefficient adjustment mechanism based on window density is introduced, adaptively correcting the filtering parameters according to the ratio of the actual number of sliding windows to the standard number of windows, allowing the noise threshold and anomaly detection threshold to scale reasonably with changes in data acquisition granularity. Furthermore, an adaptive noise filtering and anomaly removal process is constructed by combining the account's own standard deviation, matching the definition of small fluctuations and the identification of extreme values ​​with the inherent volatility level of the account, effectively resolving the contradiction of high-frequency accounts having high noise and low-frequency accounts having weak signals. The first and second dynamic activity coefficients obtained through two rounds of filtering quantify the density of mutations in the two dimensions of transaction frequency and net capital inflow, respectively. The calculation process incorporates window density and account volatility characteristics, making the activity coefficients between different accounts comparable. Furthermore, based on this, a large language model is introduced as an adaptive fusion machine. Its attention mechanism is used to semantically understand the relative importance of the two dynamic activity coefficients and output a fusion weight that conforms to business logic. This achieves intelligent integration of information from two dimensions rather than simple weighting. Finally, after eliminating the influence of dimensions through Z-score normalization, a behavior representation vector is generated. Its magnitude is used as the overall risk score and compared with the discrimination boundary optimized based on historical data to output an interpretable risk assessment result. Attached Figure Description

[0016] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. In all the drawings, similar elements or parts are generally identified by similar reference numerals. In the drawings, the elements or parts are not necessarily drawn to scale.

[0017] Figure 1 This is a schematic diagram illustrating the steps of the intelligent analysis method for bank transaction data based on a large model according to the present invention. Figure 2 This is a schematic diagram of part of step S1 in the intelligent analysis method for bank transaction data based on a large model of the present invention; Figure 3 This is a schematic diagram of part of step S2 in the intelligent analysis method for bank transaction data based on a large model of the present invention; Figure 4 This is a schematic diagram of another part of the steps in S2 of the intelligent analysis method for bank transaction data based on a large model in this invention; Figure 5This is a schematic diagram of another part of the steps in S2 of the intelligent analysis method for bank transaction data based on a large model in this invention; Figure 6 This is a flowchart illustrating some of the steps in S1 to S2 of the intelligent analysis method for bank transaction data based on a large model according to the present invention. Figure 7 This is a flowchart illustrating some of the steps in S2 to S3 of the intelligent analysis method for bank transaction data based on a large model according to the present invention. Figure 8 This is a flowchart illustrating some of the steps in S3 to S4 of the intelligent analysis method for bank transaction data based on a large model according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0019] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0020] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0021] like Figure 1 , Figure 6 , Figure 7 and Figure 8 As shown, a method for intelligent analysis of bank transaction data based on a large model is provided. In one implementation, the method includes: S1. Obtain the set of original transaction records of the target account within a preset time window, and generate a first transaction data sequence and a second transaction data sequence based on the set of original transaction records. Calculate the difference between adjacent data in the first transaction data sequence and obtain a first difference sequence. Calculate the difference between adjacent data in the second transaction data sequence and obtain a second difference sequence. S2. Obtain the first coefficient and the second coefficient according to the preset time window, and generate the first dynamic activity coefficient according to the first coefficient, the second coefficient and the first difference sequence, and generate the second dynamic activity coefficient according to the first coefficient, the second coefficient and the second difference sequence; S3. Based on the large language model, the first dynamic activity coefficient and the second dynamic activity coefficient, the initial fusion correlation coefficient is obtained. The first pipeline data sequence and the second pipeline data sequence are weighted and fused based on the initial fusion correlation coefficient to generate a behavior representation vector. S4. Output the risk assessment results based on the behavioral representation vector and the preset risk discrimination boundary.

[0022] In this embodiment, it should be noted that in S1, the first step is to obtain the original transaction record set of the target account within a preset time window. This set serves as the data foundation for all subsequent analysis steps. Taking a corporate account of a commercial bank, "C Trading Co., Ltd.", as an example, all transaction records of this account for 30 days from March 1, 2024 to March 30, 2024 are extracted, totaling 2,350 transactions. Each record includes a timestamp accurate to the second, a transaction amount with a positive or negative sign, and a clear transaction direction field. This raw data reflects the overall picture of the account's capital flow over a continuous period of time. However, directly using the raw records makes it difficult to capture the inherent patterns of behavior, thus requiring further structured processing. After obtaining the original transaction record set, the method proceeds to the first step, which involves generating a first and second flow data sequence based on these records. The former is used to quantify changes in the account's transaction frequency, while the latter is used to quantify fluctuations in net capital inflows. The core of this step is to transform discrete, non-uniformly distributed transaction events into equally spaced, comparable time series, laying the foundation for subsequent dynamic change analysis. By constructing sequences, the implicit time dimension information in the original records can be made explicit, making it possible to perform differential calculations on adjacent windows, thereby directly measuring the rate of change of account behavior over time, rather than just focusing on the cumulative total.

[0023] Furthermore, a sliding time window method is specifically adopted when generating the first and second pipeline data sequences. The preset 30-day time window is divided into multiple consecutive sliding time windows of equal length, each window being 1 hour long with a step size of 30 minutes. This means that adjacent window segments overlap by 50%. This overlapping design enhances the continuity of the time series and reduces the loss of abrupt information due to window boundary division. For a total duration of 43,200 minutes over 30 days, sliding with a step size of 30 minutes, the actual number of generated window segments is floor((43200-60) / 30)+1=1439. For the k-th window (k ranges from 1 to 1439), count the number of transactions occurring within that window to obtain the k-th element f_k of the first transaction data sequence F. For example, f1 might correspond to 5 transactions in the first hour, f2 might correspond to 7 transactions in the first 1.5 hours to the second 2.5 hours, and so on, ultimately forming an ordered sequence F = [f1, f2, ..., f_k] of length 1439. 1439 ].

[0024] Simultaneously, the algebraic sum of all transaction amounts within the window is calculated in each direction, with income being positive and expenditure being negative, resulting in a net inflow amount. This net inflow amount is then used as the k-th element m_k of the second transaction data sequence M. For example, m1 might be +15,000 yuan, and m2 might be -8,000 yuan, forming a sequence of the same length M=[m1, m2, ..., m...]. 1439 These two sequences correspond one-to-one in time, jointly depicting the dynamic changes in the frequency of transactions and net capital inflows of an account over a continuous time interval.

[0025] Furthermore, after obtaining the first pipeline data sequence F and the second pipeline data sequence M, the next step is to calculate the difference between their adjacent elements to measure the magnitude of behavioral variation. For F, the absolute value of the difference between adjacent elements is calculated to obtain the first difference sequence D_F = [|f2-f1|, |f3-f2|, ..., |f...]. 1439 -f 1438 |], its length is 1438; similarly, for M, calculate the second difference sequence D_M=[|m2-m1|,|m3-m2|,...,|m 1439 -m 1438The length of the difference sequence is 1438. These two difference sequences directly reflect the fluctuations in transaction frequency and net capital inflow between adjacent time windows. For example, if the number of transactions jumps from 5 to 12 in a certain window, the corresponding difference is 7, representing a frequency mutation. However, the difference sequences contain both meaningful abnormal fluctuations and a large number of small fluctuations and occasional extreme values. Directly using the original differences for subsequent analysis will introduce noise interference. Therefore, it is necessary to dynamically determine the filtering parameters, namely the first coefficient and the second coefficient, according to the characteristics of the preset time window, in order to adaptively clean the difference sequences and extract truly valuable mutation information. This dynamic parameter determination mechanism is the key difference between this method and the existing fixed threshold processing.

[0026] In S2, the first and second coefficients are determined based on the relative relationship between the total duration of the preset time window and the actual number of sliding windows. First, a standard sub-window length L0 is defined, typically taken as a baseline value for the sliding window length, for example, 1 hour (60 minutes). The ratio of the total preset time window duration T (in minutes) to L0 is calculated, yielding the standard window quantity index N0 = T / L0. Rounding is not necessary here to preserve precision; for a total duration of 30 days (43200 minutes), N0 = 43200 / 60 = 720. The actual number of sliding time sub-windows N is 1439. Based on the 3σ principle of normal distribution and empirical statistics, the first standard coefficient α0 is set to a range of 0.15–0.25 (0.2 in this example); the second standard coefficient β0 is set to a range of 2.5–3.5 (3 in this example). Since N > N0, the actual sub-windows are denser than the standard windows, and the time span of each sub-window is relatively shorter. Therefore, each data point in the difference sequence reflects changes over a shorter period. If a difference exceeds the threshold, the severity of the anomaly is relatively higher, requiring a stricter filtering standard. Accordingly, the first coefficient α1 is calculated using the formula α1 = α0 × N / N0, resulting in α1 = 0.2 × 1439 / 720 ≈ 0.4; the second coefficient β1 is calculated using the formula β1 = β0 × N0 / N, resulting in β1 = 3 × 720 / 1439 ≈ 1.5. Conversely, if N is less than N0, α1 will be less than α0 while β1 will be greater than β0, thus relaxing the filtering standard. This dynamic adjustment allows the filtering threshold to adapt to the window division density, ensuring a reasonable consistency in sensitivity to anomalous signals at different granularities.

[0027] In S2, after obtaining the first coefficient α1 and the second coefficient β1, the first dynamic activity coefficient is generated. First, the standard deviation σ1 of the first transaction data sequence F is calculated to characterize the overall volatility level of the account's transaction frequency during the observation period; in this example, σ1 is calculated to be approximately 3.2. Then, the first noise threshold T1_noise = σ1 × α1 = 3.2 × 0.4 = 1.28, used to filter out small fluctuations with an absolute value less than 1.28, as these fluctuations may originate from random factors rather than behavioral anomalies; the first anomaly detection threshold T1_outlier = σ1 × β1 = 3.2 × 1.5 = 4.8, used to eliminate extreme outliers deviating from the mean by more than 4.8, preventing single extreme fluctuations from distorting the overall statistics. The first difference sequence D_F is filtered in two steps: First, all elements with an absolute value less than 1.28 are removed to obtain the first effective difference sequence. Assuming that the original D_F has a total of 1438 elements, 1200 elements remain after filtering. Then, the mean of the effective sequence is calculated, and those elements that deviate from the mean by more than 4.8 are removed to obtain the first target difference sequence. Assuming that 1150 elements remain.

[0028] Next, obtain the preset first standard change threshold T1_std. This threshold is set based on business experience, for example, taking 5, meaning that a change of more than 5 transactions within 1 hour is considered a meaningful mutation. Count the number of elements with an absolute value greater than 5 in the first target difference sequence, denoted as the first mutation number C1, assumed to be 200.

[0029] Finally, the first dynamic activity coefficient α = C1 / total number of elements in the first target difference sequence = 200 / 1150 ≈ 0.174. This coefficient reflects the density of meaningful mutations in transaction frequency after noise and extreme anomalies have been removed; a higher α value indicates more unstable account frequency behavior.

[0030] Similarly, a second dynamic activity coefficient β is generated. First, the standard deviation σ2 of the second flow data sequence M is calculated, which reflects the overall fluctuation range of net capital inflow. In this example, σ2 is calculated to be approximately 12,500 yuan. Then, the second noise threshold T2_noise = σ2 × α1 = 12,500 × 0.4 = 5,000 yuan, used to filter out small fluctuations with an absolute value less than 5,000 yuan; the second anomaly detection threshold T2_outlier = σ2 × β1 = 12,500 × 1.5 = 18,750 yuan, used to remove extreme fluctuations with a deviation from the mean exceeding 18,750 yuan. The same two-step filtering is performed on the second difference sequence D_M: first, elements with an absolute value less than 5,000 yuan are removed, assuming that 980 elements remain in the second effective difference sequence; then, elements with a deviation from the mean exceeding 18,750 yuan are removed, resulting in 950 elements remaining in the second target difference sequence. A second standard change threshold T2_std is preset, for example, 20,000 yuan, meaning that a change in net inflow exceeding 20,000 yuan is considered a meaningful mutation. The number of elements C2 with an absolute value greater than 20,000 yuan in the second target difference sequence is counted, assuming it to be 85. Then the second dynamic activity coefficient β = C2 / 950 ≈ 0.089. This coefficient measures the density of meaningful mutations in net capital inflow; a higher β value indicates more drastic fluctuations in capital flow. Thus, two dynamic activity coefficients α and β are obtained through adaptive filtering. They quantify the instability of account behavior from the dimensions of transaction frequency and net capital inflow, respectively. Furthermore, the filtering parameters are correlated with the account's own volatility level and window segmentation density, making the results more comparable.

[0031] In S3, after obtaining α and β, they need to be fused into a comprehensive behavioral representation vector. Here, a pre-trained large language model is introduced as an adaptive fusion engine. First, α=0.174 and β=0.089 are assembled into structured prompt text, such as "Transaction frequency mutation rate is 0.174, net capital inflow mutation rate is 0.089. Please output a numerical fusion weight between 0 and 1 based on their relative importance." This prompt text is input into the encoder layer of the large language model. The model uses a self-attention mechanism to semantically understand the numerical relationship between α and β, and combines this with experience gained from fine-tuning on massive amounts of bank transaction data to output a fusion weight w. In this example, the model outputs w=0.65, indicating that the model considers transaction frequency mutations to be more indicative than net capital inflow mutations in the current scenario.

[0032] Furthermore, in S3, the large language model needs to be fine-tuned beforehand. During fine-tuning, a training sample set is constructed, where each sample contains a first dynamic activity coefficient α and a second dynamic activity coefficient β, along with a corresponding label—the optimal fusion weight w. w can be pre-calculated on the validation set using methods such as grid search or Bayesian optimization, with the goal of maximizing risk assessment accuracy. During fine-tuning, (α,β) are assembled into a prompt text input model, and the mean squared error between the predicted weights of the model output and w* is used as the loss function to update the model parameters through backpropagation. After training with a large number of samples, the model can apply reasonable fusion weights to the output based on the input dynamic activity coefficients.

[0033] Subsequently, Z-score normalization was performed on the first and second transaction data sequences F and M, respectively. This involved subtracting their own mean and dividing by the standard deviation to obtain normalized sequences F_norm and M_norm, ensuring uniformity of dimensions and a mean of 0 and a standard deviation of 1. The behavioral representation vector V_init = w × F_norm + (1-w) × M_norm was calculated based on the weight w. This vector, with a length of 1439, integrates frequency and monetary fluctuation information, but prioritizes frequency. The modulus of V_init is approximately 0.78, reflecting the degree to which the overall behavior deviates from the normal level. This step leverages the learning capability of the large language model, enabling the fusion weights to be dynamically adjusted based on specific α and β values, rather than being fixed presets, thus adapting to different transaction patterns.

[0034] In S4, after constructing the behavioral representation vector, the method enters the final risk discrimination stage, which outputs a risk assessment conclusion based on the comparison between the behavioral representation vector and the preset risk discrimination boundary. In practical applications, banks or financial institutions typically accumulate massive amounts of labeled account behavior data, including a large number of normal accounts and accounts verified to have engaged in high-risk behaviors such as money laundering and fraud. For each piece of historical data, a corresponding behavioral representation vector can be generated according to the aforementioned processing flow from S1 to S3. For example, for the set of normal accounts N, the modulus distribution of its behavioral representation vector is calculated as D_N; for the set of high-risk accounts R, the modulus distribution of its modulus distribution is calculated as D_R. By plotting the receiver operating characteristic (ROC) curve, using the true positive rate and false positive rate at different modulus thresholds as coordinates, the point that maximizes the Youden index (the difference between the true positive rate and the false positive rate) is selected as the optimal risk discrimination boundary. This boundary achieves a good trade-off between underreporting and false positives.

[0035] Taking a commercial bank's risk control system as an example, 100,000 accounts confirmed as normal and 10,000 accounts confirmed as high-risk were selected from the past year after manual review. Following processing steps S1 to S3, a behavioral representation vector magnitude for each account was generated, resulting in the magnitude distributions D_N for normal accounts and D_R for high-risk accounts. All possible thresholds between 0 and 1 were iterated with a step size of 0.01, calculating the true positive rate and false positive rate for each threshold and plotting the ROC curve. The Youden index (true positive rate - false positive rate) was calculated for each threshold, and the point maximizing the Youden index was selected as the optimal threshold. Experimental data showed that when θ = 0.75, the true positive rate was 0.82, the false positive rate was 0.06, and the Youden index was 0.76, the highest among all thresholds. Therefore, θ = 0.75 was determined as the risk discrimination boundary. If banks wish to more conservatively control underreporting, they can lower the threshold to 0.70, at which point the true positive rate rises to 0.88 but the false positive rate rises to 0.11; if they are more concerned about controlling false positives, they can raise it to 0.80, which lowers the true positive rate to 0.73 and the false positive rate to 0.03.

[0036] In actual operation, the magnitude of the final behavioral representation vector of the target account is compared with a preset threshold, and corresponding risk assessment information is output based on the comparison result. Continuing with the data from C Trading Co., Ltd. in the aforementioned embodiment, its behavioral representation vector V_init has a calculated magnitude of 0.78. Since historical feedback correction is not introduced, V_init is directly used as the final behavioral representation vector (V_final is used if iterative optimization is adopted). Compared with the threshold θ=0.75, 0.78 is greater than 0.75, therefore the account is determined to be high-risk, and an early warning record containing account identifier, time window, risk score, and key indicators (such as dynamic activity coefficient α=0.174, β=0.089, and fusion weight w=0.65) is automatically generated and pushed to the bank's anti-money laundering monitoring platform. After receiving the early warning, risk control personnel can retrieve the original transaction records of the account within the corresponding time window for review. They find that the account does indeed exhibit a suspicious pattern of a sudden increase in transaction frequency but small individual transaction amounts during the early morning hours, which matches the high-frequency exploratory transaction characteristics indicated. Conversely, for another normally operating trading company, D, its behavioral characteristic vector magnitude was calculated to be 0.62, below the threshold, resulting in a "low-risk" output. This data is only used for routine monitoring and archiving, without triggering any manual intervention. This judgment process transforms complex behavioral patterns into a single quantitative indicator, providing banks with an interpretable and traceable basis for risk decision-making. However, the final decision on whether to implement control measures still requires human judgment, and the output serves only as a supplementary reference. Through this combination of quantitative and manual methods, banks can efficiently screen for potential risk points from massive amounts of transactions while avoiding excessive interference with normal accounts.

[0037] In summary, the intelligent analysis method for bank transaction data based on a large model first employs a sliding time window to transform discrete transactions into equally spaced transaction data sequences, aligning transaction frequency with net capital inflow in the time dimension and providing a structured foundation for subsequent coupled analysis. Then, by calculating the difference between adjacent windows to obtain a rate of change sequence, the dynamic fluctuations of behavior are directly measured rather than the cumulative total. Based on this, a dynamic coefficient adjustment mechanism based on window density is introduced, adaptively correcting the filtering parameters according to the ratio of the actual number of sliding windows to the standard number of windows, allowing the noise threshold and anomaly detection threshold to scale reasonably with changes in data acquisition granularity. Furthermore, an adaptive noise filtering and anomaly removal process is constructed by combining the account's own standard deviation, matching the definition of minor fluctuations and the identification of extreme values ​​with the inherent volatility level of the account, effectively resolving the contradiction of high-frequency accounts having high noise levels and low-frequency accounts having weak signals. The first and second dynamic activity coefficients obtained through two rounds of filtering quantify the density of mutations in the two dimensions of transaction frequency and net capital inflow, respectively. The calculation process incorporates window density and account volatility characteristics, making the activity coefficients between different accounts comparable. Furthermore, based on this, a large language model is introduced as an adaptive fusion machine. Its attention mechanism is used to semantically understand the relative importance of the two dynamic activity coefficients and output a fusion weight that conforms to business logic. This achieves intelligent integration of information from two dimensions rather than simple weighting. Finally, after eliminating the influence of dimensions through Z-score normalization, a behavior representation vector is generated. Its magnitude is used as the overall risk score and compared with the discrimination boundary optimized based on historical data to output an interpretable risk assessment result.

[0038] like Figure 2 As shown, in one embodiment, generating the first and second transaction data sequences based on the original transaction record set in S1 includes: S11. Divide the preset time window into multiple consecutive sliding time sub-windows of equal length; S12. Count the number of transactions within each sliding time sub-window and form the first transaction data sequence; S13. The transaction amount within each sliding time sub-window is algebraically summed according to the transaction direction, and the sum is used to form the second flow data sequence.

[0039] In this embodiment, it should be noted that in S11, the preset time window first needs to be divided into multiple continuous and equally long sliding time sub-windows. This is the basic operation for converting discrete transaction records into continuous time series.

[0040] Taking the transaction data of Company C Trading Co., Ltd. from March 1, 2024 to March 30, 2024 (a total of 30 days) as an example, the preset total time window length is 43,200 minutes. To meticulously capture changes in transaction behavior over time and avoid losing key abrupt changes due to overly rigid window boundaries, this method employs a sliding window technique. Each sub-window is set to a length of 1 hour (60 minutes), with a sliding step of 30 minutes between adjacent sub-windows. This means there is a 50% overlap between adjacent windows. This overlapping design allows each transaction event to be included in two adjacent windows simultaneously, thereby enhancing the continuity of the time series and reducing deviations caused by different window boundary alignment methods.

[0041] When calculating the number of sliding windows, starting from the initial time of 0 minutes, the first window covers [0, 60] minutes, the second window covers [30, 90] minutes, and so on, until the windows cover the last moment of the 30th day. According to the formula, the number of windows is floor((total duration - window length) / step size) + 1, substituting the values, floor((43200-60) / 30) + 1 = 1439. Therefore, a total of 1439 equal-length and partially overlapping time sub-windows are obtained, each window containing a clear time interval, providing a unified time benchmark for subsequent statistics on transaction counts and net inflow amounts.

[0042] In S12, based on the predefined sliding time sub-windows, the number of transactions occurring within each window is counted to form the first transaction data sequence F. This sequence is used to quantify the change in account transaction frequency over time. Specifically, it iterates through all original transaction records of the target account within the preset time window. For each record, its timestamp determines its corresponding sliding window, and the counter for that window is incremented. Because windows overlap, a transaction record may fall into two adjacent windows simultaneously. Therefore, it is necessary to count independently for each window to ensure that the statistical value of each window reflects the actual number of transactions within the time period covered by that window.

[0043] Taking data from Trading Company C as an example, assuming there are 5 transactions in the first window (0:00-1:00), then f1=5; in the second window (0:30-1:30), there are 7 transactions, then f2=7; and so on for subsequent windows, ultimately resulting in a sequence F=[f1, f2, ..., f...] of length 1439. 1439This sequence fully records the fluctuation trajectory of transaction frequency over a continuous time interval. For example, the transaction frequency may surge in some periods (such as jumping from 5 transactions per hour to 15 transactions per hour), while it remains stable in other periods. By constructing this sequence, the originally disordered transaction time points are transformed into equally spaced ordered data, providing direct input for subsequent calculations of the frequency change magnitude between adjacent windows, making it possible to quantitatively analyze frequency mutation behavior.

[0044] In S13, also based on each sliding time sub-window, the amount of all transactions within that window is algebraically summed according to the transaction direction, thus forming the second flow data sequence M. This sequence is used to quantify the fluctuation of net capital inflow. Specifically, for each window, the transaction records belonging to that window are traversed, with income transactions recorded as positive numbers and expenditure transactions as negative numbers, and then the net inflow amount for that window is accumulated. This process reflects the overall flow of funds within the window period: if the net inflow is positive, it indicates that income exceeds expenditure; if it is negative, it indicates that expenditure dominates.

[0045] Taking data from Company C as an example, assuming the total revenue transaction amount in the first window is 50,000 yuan and the total expenditure transaction amount is 35,000 yuan, then the net inflow m1 = +15,000 yuan; in the second window, the revenue is 20,000 yuan and the expenditure is 28,000 yuan, then the net inflow m2 = -8,000 yuan; subsequent windows are calculated sequentially, ultimately resulting in a sequence M = [m1, m2, ..., m] of the same length as F. 1439 This sequence reveals the dynamic changes in net capital inflows over continuous time. For example, large amounts of capital may flow in or out rapidly during certain periods, while remaining stable during other periods. Similar to frequency sequences, the construction of net inflow sequences aligns previously discrete monetary records on a time axis, providing a basis for subsequent calculations of the magnitude of net inflow changes between adjacent windows, thus enabling accurate capture of dramatic fluctuations in capital flows.

[0046] like Figure 3 As shown, in one embodiment, obtaining the first coefficient and the second coefficient according to a preset time window in S2 includes: S21. Obtain the total duration of the preset time window and the length of the standard sub-window, divide the total duration of the preset time window by the length of the standard sub-window and obtain the standard window quantity index. S22. Obtain the first standard coefficient and the second standard coefficient. Obtain the first coefficient based on the number of sliding time sub-windows, the standard window number index and the first standard coefficient. Obtain the second coefficient based on the number of sliding time sub-windows, the standard window number index and the second standard coefficient.

[0047] Based on the number of sliding time sub-windows, the standard window number index, the first standard coefficient, and the second standard coefficient, the first and second coefficients are obtained as follows: ; ; in, The number of sliding time sub-windows, The standard window quantity indicator, The first standard coefficient, The second standard coefficient, As the first coefficient, This is the second coefficient.

[0048] In this embodiment, it should be noted that in S21, the number of standard windows needs to be calculated based on the total duration of the preset time window and the length of the standard sub-window. This indicator serves as a benchmark for subsequent dynamic adjustment of the filtering parameters. The length of the standard sub-window, L0, is a preset benchmark value, and its value needs to balance the fineness of the time granularity with the computational complexity. Taking bank transaction analysis as an example, we take L0=60 minutes as the benchmark. This value is based on the time distribution characteristics of transaction behavior. Most companies' transaction activities have statistical regularities at the hourly level. Too short a time window (such as 1 minute) will lead to the sequence being too sparse and noisy, while too long a time window (such as 24 hours) will mask the details of intraday fluctuations. At the same time, through comparative experiments, we tested three values ​​of L0: 30 minutes, 60 minutes, and 120 minutes. We selected transaction data from 10,000 historical accounts and calculated the accuracy of the behavioral representation vectors generated under different L0 values ​​for identifying known risky accounts. The experimental results show that when L0=60 minutes, the area under the ROC curve reaches 0.87, which is higher than 0.82 for 30 minutes and 0.79 for 120 minutes. Therefore, we determined 60 minutes as the standard sub-window length.

[0049] Dividing the total duration T (in minutes) of the preset time window by the standard sub-window length L0 yields the standard window quantity index N0 = T / L0. For a total duration of 30 days (43200 minutes), N0 = 43200 / 60 = 720. This calculation does not require rounding; the decimal is retained for a more accurate reflection of the proportion. This N0 represents the theoretical number of windows that would be obtained if the standard window length were used for partitioning. It is not equal to the actual number of sliding windows but serves as a reference value. The actual number of sliding windows, N = 1439, was obtained using a sliding method with a step size of 30 minutes. This is significantly greater than N0, indicating that the actual window partitioning is denser than the standard baseline, and each window covers a shorter time span, thus enabling more precise capture of short-term changes. The introduction of the standard window quantity index provides a quantitative basis for subsequently adaptively adjusting the filtering strictness based on window density.

[0050] In S22, based on the standard window quantity index and the actual sliding window quantity, combined with the preset first and second standard coefficients, the first and second coefficients used for noise filtering and anomaly detection are dynamically calculated. The first standard coefficient α0 ranges from 0.15 to 0.25, and the second standard coefficient β0 ranges from 2.5 to 3.5. These ranges are determined based on the 3σ principle of normal distribution and empirical statistics of bank transaction data. For example, α0=0.2 means that small fluctuations below 20% of the standard deviation are to be filtered out, and β0=3 means that extreme outliers deviating from the mean by more than 3 times the standard deviation are to be removed.

[0051] However, due to the different actual window densities, directly using these fixed coefficients may not be appropriate: when the windows are denser, each difference in the difference sequence reflects a shorter time span, and changes of the same magnitude appear more prominent over a shorter time span, so stricter filtering criteria are required; conversely, when the windows are sparser, the criteria should be relaxed.

[0052] This method achieves adaptive adjustment by introducing correction coefficients: the first coefficient α1 = α0 × N / N0, and the second coefficient β1 = β0 × N0 / N. In this embodiment, N = 1439, N0 = 720, therefore α1 = 0.2 × 1439 / 720 ≈ 0.4, which is greater than α0; β1 = 3 × 720 / 1439 ≈ 1.5, which is less than β0. This means that when the windows are dense, the noise filtering threshold will increase (because α1 increases, and the first noise threshold T1_noise = σ1 × α1 also increases accordingly), thereby eliminating more small fluctuations; at the same time, the anomaly detection threshold will decrease (because β1 decreases, and the first anomaly detection threshold T1_outlier = σ1 × β1 also decreases accordingly), making the elimination of extreme values ​​more stringent. This adjustment makes the filtering standard match the window density, ensuring that the extracted mutation information is comparable at different granularities regardless of how the windows are divided, avoiding the deviation of analysis results caused by different window selections.

[0053] like Figure 4 As shown, in one embodiment, generating the first dynamic activity coefficient in S2 based on the first coefficient, the second coefficient, and the first difference sequence includes: S231. The product of the standard deviation of the first pipeline data sequence and the first coefficient is used as the first noise threshold, and the product of the standard deviation of the first pipeline data sequence and the second coefficient is used as the first anomaly detection threshold. S232. Remove data whose absolute value is less than the first noise threshold from the first difference sequence and obtain the first effective difference sequence; S233. Remove data from the first effective difference sequence that deviates from the average value by more than the first anomaly detection threshold, and obtain the first target difference sequence; S234. Obtain the first standard change threshold, and count the number of data in the first target difference sequence whose absolute value exceeds the first standard change threshold, and use it as the first mutation number; S235. Divide the number of first mutations by the total number of data in the first target difference sequence to obtain the first dynamic activity coefficient.

[0054] In this embodiment, it should be noted that in S231, the first noise threshold and the first anomaly detection threshold are calculated based on the standard deviation of the first transaction data sequence F and the dynamically determined first coefficient α1 and second coefficient β1, respectively. The first transaction data sequence F consists of the number of transactions in 1439 sliding windows, and its standard deviation σ1 reflects the overall fluctuation level of the account's transaction frequency during the observation period. In this example, σ1 is calculated to be approximately 3.2, which means that the number of transactions in most windows fluctuates within a range of approximately 3.2 transactions near the mean.

[0055] The first coefficient α1 in S22 has been dynamically adjusted to 0.4 based on the window density. Its function is to amplify or reduce the standard deviation to form a benchmark for noise filtering. The first noise threshold T1_noise = σ1 × α1 = 3.2 × 0.4 = 1.28. This threshold is used to define what constitutes "small fluctuations": if the absolute value of the change in the number of transactions between any adjacent windows is less than 1.28, it is considered noise that may be caused by random factors, rather than a meaningful abnormal signal.

[0056] The second coefficient β1 is adjusted to 1.5 to construct the anomaly detection threshold T1_outlier = σ1 × β1 = 3.2 × 1.5 = 4.8. This threshold is used to identify extreme outliers, i.e., those changes that deviate from the sequence mean by more than 4.8. The setting of these two thresholds fully combines the account's own volatility characteristics (reflected by standard deviation) and window density (reflected by dynamic coefficients), ensuring that the filtering criteria are neither static nor unrealistic, but rather match the statistical characteristics of the data itself. This lays a quantitative foundation for the subsequent accurate extraction of mutation information from the difference sequence.

[0057] In step S232, based on the first noise threshold T1_noise = 1.28 calculated in the previous step, the first difference sequence D_F is initially filtered, removing elements whose absolute values ​​are less than this threshold to obtain the first effective difference sequence. The first difference sequence D_F has a length of 1438 and records the absolute value of the change in the number of transactions between each adjacent sliding window. For example, it may contain various values ​​such as 0.5, 1.2, 2.3, 5.0, and 8.0. According to the noise threshold of 1.28, all differences less than 1.28 are considered to be within the normal fluctuation range and should be removed, as they are highly likely to originate from daily random factors rather than abnormal behavior. Assuming that statistical analysis shows that there are 238 elements in D_F with absolute values ​​less than 1.28, removing them leaves 1200 elements, constituting the first effective difference sequence. This step effectively reduces interference in subsequent calculations, allowing the analysis to focus on changes exceeding the normal fluctuation range. Meanwhile, since the noise threshold is dynamic, when the account itself fluctuates greatly (σ1 is large) or the windows are more dense (α1 is large), the threshold will be increased accordingly, and more small fluctuations will be eliminated; conversely, more details will be retained, thus maintaining the rationality of the filtering effect under different conditions.

[0058] In S233, a second round of filtering is performed on the first effective difference sequence to remove elements that deviate from the average value by more than the first anomaly detection threshold T1_outlier = 4.8, resulting in the first target difference sequence. First, the mean of the first effective difference sequence needs to be calculated, which reflects the central trend of the remaining fluctuations after noise filtering. Assuming the mean of the first effective difference sequence is 3.0, any element whose absolute difference from the mean exceeds 4.8 (i.e., an absolute value greater than 7.8 or less than -1.8; since the difference is non-negative, only elements greater than 7.8 are considered here) will be considered extreme outliers and removed. These extreme values ​​may originate from a single, accidental event, such as a surge in transactions due to a malfunction on a particular day. Although their amplitude is large, if they are too isolated, they should not represent the general behavior pattern of the account. After removal, assuming 50 extreme values ​​are removed from 1200 elements, the remaining 1150 elements constitute the first target difference sequence. This step further purifies the data, ensuring that the number of mutations in subsequent statistics is based on representative fluctuations, and avoiding the excessive impact of a single extreme event on the overall assessment.

[0059] In S234, a preset first standard change threshold T1_std is obtained. When setting this threshold, 50 risky accounts verified to have engaged in fraudulent trading within the past year are collected, and the distribution of changes in the number of transactions between adjacent one-hour windows is statistically analyzed. The results show that 85% of risky events had more than 5 frequency changes, while only 8% of normal accounts had more than 5 changes in that time period. To determine the optimal threshold, four values ​​of T1_std (3, 4, 5, and 6) are tested to evaluate the identification effect on risky accounts. When T1_std=5, 82% of risky accounts can be identified, while the false positive rate for normal accounts is 7%. When T1_std=4, the identification rate increases to 89%, but the false positive rate increases to 15%. When T1_std=6, the identification rate decreases to 70%, while the false positive rate is only 5%. Based on the bank's risk control department's tolerance limit for false positives (not exceeding 10%) and the requirement for a capture rate (not less than 80%), T1_std=5 is determined to be the optimal value.

[0060] The number of elements in the first target difference sequence whose absolute value is greater than T1_std is counted and denoted as the first mutation number C1. The first target difference sequence contains 1150 elements, representing all non-extreme fluctuations in the account that exceed the noise level during the observation period. These elements are iterated through, and each value is compared to 5, recording the number of all values ​​greater than 5. Assuming that after counting, there are 200 elements with differences exceeding 5, then C1 = 200. This number reflects the frequency of meaningful changes in the account's actual trading frequency after removing noise and extreme anomalies. For example, if the number of trades jumps from 5 to 12 per hour in a certain period, a change of 7 trades, it will be counted in C1. The size of C1 is directly related to the degree of instability in the account's behavior.

[0061] In S235, the first mutation number C1 is divided by the total number of elements in the first target difference sequence to obtain the first dynamic activity coefficient α. The total number of elements in the first target difference sequence is 1150, C1=200, therefore α=200 / 1150≈0.174. This coefficient is a normalized dimensionless indicator, ranging from 0 to 1, representing the density of mutations occurring in available meaningful volatility data. The higher the α value, the higher the frequency of mutations in the account's transaction frequency during the observation period, and the more unstable the behavior. For example, α=0.174 means that there are more than 5 frequency changes between approximately 17.4% of adjacent windows. This coefficient provides a key input for subsequent integration with the large language model. It integrates the account's own volatility level, window density, and business-defined mutation criteria, making the behavioral instability between different accounts comparable.

[0062] like Figure 5 As shown, in one embodiment, generating the second dynamic activity coefficient in S2 based on the first coefficient, the second coefficient, and the second difference sequence includes: S241. The product of the standard deviation of the second pipeline data sequence and the first coefficient is used as the second noise threshold, and the product of the standard deviation of the second pipeline data sequence and the second coefficient is used as the second anomaly detection threshold. S242. Remove data whose absolute value is less than the second noise threshold from the second difference sequence, and obtain the second effective difference sequence; S243. Remove data from the second effective difference sequence that deviate from the average value by more than the second anomaly detection threshold, and obtain the second target difference sequence; S244. Obtain the second standard change threshold, and count the number of data in the second target difference sequence whose absolute value exceeds the second standard change threshold, and use it as the second mutation number. S245. Divide the number of second mutations by the total number of data in the second target difference sequence to obtain the second dynamic activity coefficient.

[0063] In this embodiment, it should be noted that in S241, the processing of the second flow data sequence M first calculates the second noise threshold and the second anomaly detection threshold. The M sequence consists of the net inflow amount of 1439 sliding windows, with a standard deviation σ2 of approximately 12,500 yuan, reflecting the overall fluctuation range of net capital inflow. The first coefficient α1 remains 0.4, and the second coefficient β1 is 1.5. These two coefficients are consistent with the frequency dimension, ensuring that the filtering standards of the two dimensions are coordinated under the same window density. The second noise threshold T2_noise = σ2 × α1 = 12,500 × 0.4 = 5,000 yuan, used to filter out small fluctuations in the amount change, that is, the net inflow change of adjacent windows with an absolute value less than 5,000 yuan is regarded as noise rejection. The second anomaly detection threshold T2_outlier = σ2 × β1 = 12,500 × 1.5 = 18,750 yuan, used to identify extreme amount fluctuations, that is, changes deviating from the mean by more than 18,750 yuan will be rejected. The setting of these two thresholds also takes into account the account's own amount fluctuation characteristics and window density, ensuring that the filtering scale matches the inherent characteristics of the data.

[0064] In step S242, based on the second noise threshold T2_noise = 5,000 yuan, the second difference sequence D_M is initially filtered, removing all elements with an absolute value less than 5,000 yuan, resulting in the second effective difference sequence. D_M has a length of 1438 and records the absolute value of the net inflow amount change between adjacent windows, which may include various values ​​such as 3,000 yuan, 8,000 yuan, and 20,000 yuan. All fluctuations less than 5,000 yuan are considered small daily fluctuations and are removed. Assuming that statistically, 458 elements in D_M are less than 5,000 yuan, the remaining 980 elements constitute the second effective difference sequence. This step removes a large number of meaningless small amount changes, allowing subsequent analysis to focus on amount changes exceeding the daily fluctuation range. Since the noise threshold is proportional to the standard deviation of the account's amount, the threshold is increased for accounts with large amount fluctuations to avoid over-filtering; for accounts with small fluctuations, the threshold is decreased to retain more details.

[0065] In S243, a second round of filtering is performed on the second effective difference sequence, removing elements that deviate from the average by more than the second anomaly detection threshold T2_outlier = 18,750 yuan, resulting in the second target difference sequence. First, the mean of the second effective difference sequence is calculated, assumed to be 12,000 yuan. Then, any element whose absolute difference from the mean exceeds 18,750 yuan (i.e., an absolute value greater than 30,750 yuan or less than -6,750 yuan, but actually greater than 30,750 yuan considering non-negativity) will be considered an extreme outlier and removed. These extreme values ​​may originate from a single large transaction, such as a sudden large remittance; if they are too isolated, they do not represent a general pattern. Assuming 30 extreme values ​​are removed from the 980 elements, the remaining 950 elements constitute the second target difference sequence. This purification process ensures that the number of mutations in subsequent statistics is based on representative monetary fluctuations.

[0066] In S244, a preset second standard change threshold T2_std is obtained. Fifty risk accounts confirmed to have engaged in money laundering are selected, and the distribution of the absolute value of net inflow changes between adjacent one-hour windows is statistically analyzed. The results show that in 75% of risk events, the amount change exceeded 20,000 yuan, while in normal accounts, only 6% of the time periods reached this level. To determine the threshold, historical data from 100,000 normal accounts and 10,000 risk accounts are collected. Four values ​​of T2_std are tested: 10,000, 15,000, 20,000, and 25,000 yuan. The Youden index (sensitivity + specificity - 1) is calculated for each threshold. The results showed that the Youden index reached its highest value of 0.73 when T2_std = 20,000 yuan, with a sensitivity of 0.75 and a specificity of 0.98. When T2_std = 15,000 yuan, the sensitivity was 0.84, but the specificity dropped to 0.91. When T2_std = 25,000 yuan, the sensitivity was 0.62 and the specificity was 0.99. Therefore, 20,000 yuan was determined to be the optimal threshold. This means that a change in net inflow amount exceeding 20,000 yuan between adjacent windows is considered a significant change in funding.

[0067] The number of elements in the second objective difference sequence with an absolute value greater than 20,000 yuan is counted and denoted as the second mutation number C2. The second objective difference sequence has 950 elements. Each value is iterated over, and it is compared to see if it exceeds 20,000 yuan. Assuming that 85 elements meet the condition, then C2 = 85. These 85 events represent drastic fluctuations in fund flows exceeding the business-defined threshold during the observation period, such as a sudden change in net inflow from -50,000 yuan to +100,000 yuan within a half-hour period. The number of C2 is directly related to the degree of instability in the fund dimension.

[0068] In S245, the second mutation number C2 is divided by the total number of elements in the second target difference sequence to obtain the second dynamic activity coefficient β. The total number of elements in the second target difference sequence is 950, C2=85, therefore β=85 / 950≈0.089. β is also a normalized indicator, representing the density of fund mutations in meaningful monetary fluctuation data. A β value of 0.089 means that approximately 8.9% of adjacent windows experienced net inflow changes exceeding 20,000 yuan. Similar to α, β provides a quantitative input for the fund dimension in subsequent integration with the large language model. Thus, through a series of adaptive filtering and statistics, dynamic activity coefficients α and β in two dimensions are obtained. They characterize the instability of account behavior from the perspectives of frequency and amount, respectively. The calculation process fully considers the account's own volatility level and window division density, laying a reliable data foundation for subsequent intelligent fusion analysis.

[0069] In one implementation, obtaining the initial fusion correlation coefficient based on the large language model, the first dynamic activity coefficient, and the second dynamic activity coefficient in S3 includes: S31. Generate structured prompt text based on the first dynamic activity coefficient and the second dynamic activity coefficient; S32. Input the structured prompt text into the encoder layer of the large language model; S33. The first and second dynamic activity coefficients are modeled and processed using the attention mechanism of the large language model. S34. Extract numerical fusion weights from the output layer of the large language model and use them as initial fusion correlation coefficients.

[0070] In this embodiment, it should be noted that after obtaining the first dynamic activity coefficient α = 0.174 and the second dynamic activity coefficient β = 0.089 in S31, these two values ​​need to be converted into an input format that the large language model can understand, i.e., generating structured prompt text. The core of this conversion lies in combining quantitative indicators with natural language instructions, enabling the model to obtain specific numerical information and clearly define its output task. The design of structured prompt text needs to consider two key factors: the accurate transmission of numerical values ​​and the constraints of the output format.

[0071] In this embodiment, the constructed prompt text is "Transaction frequency mutation rate is 0.174, net capital inflow mutation rate is 0.089. Please output a numerical fusion weight between 0 and 1 based on their relative importance." This text first explicitly informs the model of the mutation rate values ​​for the two dimensions, where 0.174 comes from the transaction frequency dimension and 0.089 from the net capital inflow dimension. Secondly, by stating "based on their relative importance," it guides the model to semantically understand these two values, rather than simply performing mathematical calculations. Finally, by specifying "output a numerical fusion weight between 0 and 1," it clarifies the output format, ensuring that the model's returned result can be directly used for subsequent calculations. This structured prompt text design fully leverages the natural language understanding capabilities of large language models, enabling the model to combine the numerical relationship between α and β with its risk pattern knowledge learned from training data, thereby outputting a fusion weight that conforms to business logic.

[0072] In step S32, the structured prompt text generated in the previous step is input into the encoder layer of the large language model, initiating the model's forward computation process. The encoder layer of the large language model consists of multiple stacked Transformer blocks, each containing a multi-head self-attention mechanism and a feedforward neural network. Upon input, the prompt text is first segmented into a sequence of tokens by a token segmenter. Each token is mapped to a high-dimensional embedding vector, which contains the semantic information of the token and its positional encoding within the text. For example, the phrase "the mutation rate of transaction frequency" will be segmented into multiple tokens, and the embedding vector corresponding to each token continuously interacts with contextual information in subsequent layers. The encoder layer transforms the input token sequence into a series of context-dependent representation vectors. These vectors not only encode the meaning of each token itself but also incorporate the semantic information of the entire prompt text through the self-attention mechanism. In particular, the values ​​“0.174” and “0.089” are not treated as isolated numbers during the encoding process. Instead, they are used together with the surrounding text descriptions “transaction frequency mutation rate” and “net capital inflow mutation rate” to form semantic units, enabling the model to understand what these two values ​​represent.

[0073] In S33, the large language model models the relative importance of the first and second dynamic activity coefficients through its core self-attention mechanism. This self-attention mechanism allows the model to dynamically focus on all other words in the input sequence while processing each word, assigning different weights based on their relevance to the current word. In this embodiment, when the model processes the value "0.174", the attention mechanism calculates its correlation strength with "transaction frequency mutation rate," while also paying attention to the words "net capital inflow mutation rate" and "0.089". Through multi-layered stacked attention calculations, the model can capture the relative magnitude relationship between two values ​​and their respective semantic bindings to their corresponding dimensions.

[0074] For example, the model might notice that "0.174" is greater than "0.089," and that the description of "transaction frequency mutation rate" is strongly correlated with high-frequency trading risk, thus reinforcing the weight of the frequency dimension in its internal representation. This process is not a simple numerical comparison, but rather integrates the world knowledge learned by the model from massive amounts of text during the pre-training phase, and the risk patterns learned from bank transaction data during the fine-tuning phase. Through multiple layers of abstraction and transformation, the model ultimately generates a hidden state representation at the highest level that reflects the relative importance of the two dimensions, preparing for the next step of outputting fused weights.

[0075] In S34, numerical fusion weights are extracted from the output layer of the large language model as initial fusion correlation coefficients. The model's output layer is typically connected to a fully connected network that maps the hidden states of the last layer to the desired output format. In this embodiment, the output layer is configured as a single neuron, and the sigmoid activation function is used to compress the output value to between 0 and 1 to meet the constraints on the output range in the prompt text. When generating the output, the model comprehensively considers the semantics of the entire prompt text as well as the relative importance of the two coefficients modeled through an attention mechanism.

[0076] Given inputs α=0.174 and β=0.089, the model outputs w=0.65 after internal calculation. This 0.65 signifies that the model considers abrupt changes in the transaction frequency dimension to account for 65% of the weight, while net capital inflows account for 35%. This weight allocation reflects the model's assessment of the importance of the two dimensions—since the α value (0.174) is higher than the β value (0.089), and considering historical experience, frequency mutations are often associated with risky patterns such as exploratory trading, the frequency dimension receives a higher weight. It's worth noting that the model's output weights are not fixed. When different combinations of α and β are input, the model dynamically adjusts its output based on the new numerical relationships; this is the core advantage of adaptive fusion. The output layer design ensures that the model can convert semantic understanding into numerical output in a differentiable manner, facilitating integration into the entire analysis process.

[0077] In one implementation, S3 involves weighted fusion of the first and second pipeline data sequences based on the initial fusion correlation coefficient to generate a behavior representation vector, including: S35. Normalize the first pipeline data sequence F and the second pipeline data sequence M respectively to obtain normalized sequences F_norm and M_norm; S36. Calculate the behavior representation vector based on the initial fusion correlation coefficient w, the normalized sequences F_norm and M_norm. 0 <w<1。

[0078] In this embodiment, it should be noted that in S35, after obtaining the initial fusion correlation coefficient w=0.65, the first transaction data sequence F and the second transaction data sequence M need to be normalized to prepare for weighted fusion. The F and M sequences have different dimensions and numerical ranges: F represents the number of transactions, typically ranging from 0 to tens; M represents the net inflow amount, potentially ranging from negative hundreds of thousands to positive hundreds of thousands. Directly weighting and fusing the original sequences would lead to the larger dimension dominating the result, failing to accurately reflect the contributions of the two dimensions. Therefore, the Z-score normalization method is used, subtracting the mean from each sequence and dividing by its standard deviation. First, calculate the mean μ_F and standard deviation σ_F of F. Assuming μ_F = 4.2 and σ_F = 3.2, then for each element f_k in F, calculate f_norm_k = (f_k - 4.2) / 3.2. Similarly, calculate the mean μ_M and standard deviation σ_M of M. Assuming μ_M = 2,500 and σ_M = 12,500, then m_norm_k = (m_k - 2500) / 12500. After normalization, both F_norm and M_norm become dimensionless sequences with a mean of 0 and a standard deviation of 1, making the two dimensions numerically comparable. The value of each element represents its deviation from the average level.

[0079] For example, if a window has 7 transactions, the normalized value is approximately (7-4.2) / 3.2=0.875, indicating it's 0.875 standard deviations above the average. Conversely, if a window has a net inflow of -20,000 yuan, the normalized value is approximately (-20000-2500) / 12500=-1.8, indicating it's 1.8 standard deviations below the average. This processing eliminates the influence of dimensions, allowing subsequent weighted fusion to accurately reflect the combined fluctuations of both dimensions.

[0080] In S36, based on the initial fusion correlation coefficient w=0.65 and the normalized sequences F_norm and M_norm, the behavioral representation vector V_init is calculated. V_init is a vector of length 1439, where each element v_k is obtained by weighted summation of the normalized values ​​at the corresponding positions: v_k=w×f_norm_k+(1-w)×m_norm_k, where k ranges from 1 to 1439. Taking the 100th window as an example, assuming f_norm_100=1.2 and m_norm_100=-0.5, then v_100=0.65×1.2+0.35×(-0.5)=0.78-0.175=0.605. This value combines the information of a high transaction frequency (1.2) and a low net capital inflow (-0.5) in this window, and because the frequency weight is higher, the final result is biased towards a positive value. After completing the calculation for the entire sequence, we obtain V_init. To obtain a scalar that can comprehensively assess the risk level of the account, we further calculate the modulus of V_init, which is the square root of the sum of the squares of each element.

[0081] In this example, the calculated modulus is approximately 0.78. This modulus represents the length of the vector in a 1439-dimensional space, reflecting the overall magnitude of the account's volatility throughout the observation period. A larger modulus indicates a greater deviation of the account's behavior from the average level at multiple points in time, indicating higher overall instability. This value of 0.78 will become the input for subsequent risk assessment, compared with a preset threshold. Through this series of steps, the original discrete transaction records are ultimately transformed into a single numerical value that quantifies the overall risk level, and each step in the transformation process is closely linked to the statistical characteristics of the data itself and the business logic.

[0082] A large-model-based intelligent analysis system for bank transaction data is also provided. This system is used to implement the large-model-based intelligent analysis method for bank transaction data in any of the above embodiments. The system includes: The data integration module is used to obtain the set of original transaction records of the target account within a preset time window, and generate a first transaction data sequence (first transaction data sequence) and a second transaction data sequence (second transaction data sequence) based on the set of original transaction records. It calculates the difference between adjacent data in the first transaction data sequence and obtains a first difference sequence, and calculates the difference between adjacent data in the second transaction data sequence and obtains a second difference sequence. The dynamic coefficient generation module is used to obtain the first coefficient and the second coefficient according to a preset time window, generate the first dynamic active coefficient according to the first coefficient, the second coefficient and the first difference sequence, and generate the second dynamic active coefficient according to the first coefficient, the second coefficient and the second difference sequence. The large model fusion module is used to obtain the initial fusion correlation coefficient based on the large language model, the first dynamic activity coefficient and the second dynamic activity coefficient, and to perform weighted fusion on the first pipeline data sequence and the second pipeline data sequence based on the initial fusion correlation coefficient to generate a behavior representation vector. The assessment and processing module is used to output risk assessment results based on the behavioral representation vector and the preset risk discrimination boundary.

[0083] In one embodiment, the data integration module is further configured to: divide the preset time window into multiple consecutive sliding time sub-windows of equal length; count the number of transactions within each sliding time sub-window and form the first transaction data sequence; and perform algebraic summation on the transaction amount within each sliding time sub-window according to the transaction direction and form the second transaction data sequence.

[0084] In one embodiment, the dynamic coefficient generation module is further configured to: obtain the total duration of a preset time window and the length of a standard sub-window; divide the total duration of the preset time window by the length of the standard sub-window to obtain a standard window quantity index; obtain a first standard coefficient and a second standard coefficient; obtain the first coefficient based on the number of sliding time sub-windows, the standard window quantity index, and the first standard coefficient; and obtain the second coefficient based on the number of sliding time sub-windows, the standard window quantity index, and the second standard coefficient.

[0085] In this embodiment, it should be noted that the specific methods of performing operations in the above-mentioned intelligent analysis system for bank transaction data based on large models have been described in detail in the embodiments of the intelligent analysis method for bank transaction data based on large models, and will not be elaborated here.

[0086] The preferred embodiments of this disclosure have been described in detail above with reference to the accompanying drawings. However, this disclosure is not limited to the specific details of the above embodiments. Within the scope of the technical concept of this disclosure, various simple modifications can be made to the technical solutions of this disclosure, and these simple modifications all fall within the protection scope of this disclosure.

[0087] It should also be noted that the various specific technical features described in the above embodiments can be combined in any suitable manner without contradiction. To avoid unnecessary repetition, this disclosure will not describe the various possible combinations separately.

[0088] Furthermore, various different embodiments of this disclosure can be combined in any way, as long as they do not violate the spirit of this disclosure, they should also be regarded as the content disclosed in this disclosure.

[0089] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A method for intelligent analysis of bank transaction data based on a large model, characterized in that, The methods include: Obtain the set of original transaction records of the target account within a preset time window, and generate a first transaction data sequence and a second transaction data sequence based on the set of original transaction records. Calculate the difference between adjacent data in the first transaction data sequence and obtain a first difference sequence. Calculate the difference between adjacent data in the second transaction data sequence and obtain a second difference sequence. The first coefficient and the second coefficient are obtained according to a preset time window, and the first dynamic activity coefficient is generated according to the first coefficient, the second coefficient and the first difference sequence, and the second dynamic activity coefficient is generated according to the first coefficient, the second coefficient and the second difference sequence. The initial fusion correlation coefficient is obtained based on the large language model, the first dynamic activity coefficient and the second dynamic activity coefficient. The first pipeline data sequence and the second pipeline data sequence are weighted and fused based on the initial fusion correlation coefficient to generate a behavior representation vector. The risk assessment results are output based on the behavioral representation vector and the preset risk discrimination boundary.

2. The intelligent analysis method for bank transaction data based on a large model according to claim 1, characterized in that, The generation of the first and second transaction data sequences based on the original transaction record set includes: The preset time window is divided into multiple consecutive sliding time sub-windows of equal length; The number of transactions within each sliding time sub-window is counted and used to construct the first transaction data sequence; The transaction amounts within each sliding time sub-window are algebraically summed according to the transaction direction, and this summation forms the second flow data sequence.

3. The intelligent analysis method for bank transaction data based on a large model according to claim 2, characterized in that, The step of obtaining the first coefficient and the second coefficient according to the preset time window includes: Get the total duration of the preset time window and the length of the standard sub-window, divide the total duration of the preset time window by the length of the standard sub-window, and get the standard window quantity index. Obtain a first standard coefficient and a second standard coefficient. Obtain the first coefficient based on the number of sliding time sub-windows, the standard window number index, and the first standard coefficient. Obtain the second coefficient based on the number of sliding time sub-windows, the standard window number index, and the second standard coefficient.

4. The intelligent analysis method for bank transaction data based on a large model according to claim 1, characterized in that, The step of generating the first dynamic activity coefficient based on the first coefficient, the second coefficient, and the first difference sequence includes: The product of the standard deviation of the first pipeline data sequence and the first coefficient is used as the first noise threshold, and the product of the standard deviation of the first pipeline data sequence and the second coefficient is used as the first anomaly detection threshold. Remove data in the first difference sequence whose absolute value is less than the first noise threshold, and obtain the first effective difference sequence; Remove data from the first effective difference sequence that deviates from the average value by more than the first anomaly detection threshold, and obtain the first target difference sequence; Obtain the first standard change threshold, and count the number of data in the first target difference sequence whose absolute value exceeds the first standard change threshold, and use this as the first mutation number; The first number of mutations is divided by the total number of data in the first target difference sequence to obtain the first dynamic activity coefficient.

5. The intelligent analysis method for bank transaction data based on a large model according to claim 1, characterized in that, The second dynamic activity coefficient is generated based on the first coefficient, the second coefficient, and the second difference sequence, including: The product of the standard deviation of the second pipeline data sequence and the first coefficient is used as the second noise threshold, and the product of the standard deviation of the second pipeline data sequence and the second coefficient is used as the second anomaly detection threshold. Remove data in the second difference sequence whose absolute value is less than the second noise threshold, and obtain the second effective difference sequence; Remove data from the second effective difference sequence that deviate from the average value by more than the second anomaly detection threshold, and obtain the second target difference sequence; Obtain the second standard change threshold, and count the number of data in the second target difference sequence whose absolute value exceeds the second standard change threshold, and use this as the second mutation number; The second number of mutations is divided by the total number of data in the second target difference sequence to obtain the second dynamic activity coefficient.

6. The intelligent analysis method for bank transaction data based on a large model according to claim 1, characterized in that, The method of obtaining the initial fusion correlation coefficient based on the large language model, the first dynamic activity coefficient, and the second dynamic activity coefficient includes: Structured prompt text is generated based on the first and second dynamic activity coefficients; The structured prompt text is input into the encoder layer of the large language model; The first and second dynamic activity coefficients are modeled using the attention mechanism of a large language model. Numerical fusion weights are extracted from the output layer of the large language model and used as initial fusion correlation coefficients.

7. The intelligent analysis method for bank transaction data based on a large model according to claim 1, characterized in that, The step of weighted fusion of the first and second pipeline data sequences based on the initial fusion correlation coefficient to generate a behavior representation vector includes: The first and second pipeline data sequences are normalized respectively to obtain normalized sequences; The behavioral representation vector is calculated based on the initial fusion correlation coefficient and the normalized sequence.

8. A smart analysis system for bank transaction data based on a large model, characterized in that, The system is used to implement the intelligent analysis method for bank transaction data based on a large model as described in any one of claims 1 to 7, the system comprising: The data integration module is used to obtain the set of original transaction records of the target account within a preset time window, and generate a first transaction data sequence and a second transaction data sequence based on the set of original transaction records. It calculates the difference between adjacent data in the first transaction data sequence and obtains a first difference sequence, and calculates the difference between adjacent data in the second transaction data sequence and obtains a second difference sequence. The dynamic coefficient generation module is used to obtain the first coefficient and the second coefficient according to a preset time window, generate the first dynamic active coefficient according to the first coefficient, the second coefficient and the first difference sequence, and generate the second dynamic active coefficient according to the first coefficient, the second coefficient and the second difference sequence. The large model fusion module is used to obtain the initial fusion correlation coefficient based on the large language model, the first dynamic activity coefficient and the second dynamic activity coefficient, and to perform weighted fusion on the first pipeline data sequence and the second pipeline data sequence based on the initial fusion correlation coefficient to generate a behavior representation vector. The assessment and processing module is used to output risk assessment results based on the behavioral representation vector and the preset risk discrimination boundary.

9. The intelligent analysis system for bank transaction data based on a large model according to claim 8, characterized in that, The data integration module is also used for: The preset time window is divided into multiple consecutive sliding time sub-windows of equal length; The number of transactions within each sliding time sub-window is counted and used to construct the first transaction data sequence; The transaction amounts within each sliding time sub-window are algebraically summed according to the transaction direction, and this summation forms the second flow data sequence.

10. The intelligent analysis system for bank transaction data based on a large model according to claim 8, characterized in that, The dynamic coefficient generation module is also used for: Get the total duration of the preset time window and the length of the standard sub-window, divide the total duration of the preset time window by the length of the standard sub-window, and get the standard window quantity index. Obtain a first standard coefficient and a second standard coefficient. Obtain the first coefficient based on the number of sliding time sub-windows, the standard window number index, and the first standard coefficient. Obtain the second coefficient based on the number of sliding time sub-windows, the standard window number index, and the second standard coefficient.

Images