Financial risk early warning method and system based on deep learning

Abstract

The application provides a kind of financial risk early warning method and system based on deep learning, belong to the financial risk early warning technical field based on deep learning, wherein the method comprises the following steps: obtaining the multi-source data of target financial entity in the preset time window, including real-time transaction data stream, entity association network data and market trend data;According to the multi-source data, a three-dimensional risk feature tensor is constructed, which contains time dimension, feature dimension and entity dimension;Generate current risk feature vector;Calculate the spatiotemporal similarity score;According to market volatility, dynamically adjust the risk determination threshold, when the spatiotemporal similarity score exceeds the dynamic threshold, trigger the early warning response operation corresponding to the risk level.The application breaks through the dependence of traditional risk assessment method on single dimension feature by introducing three-dimensional risk feature tensor structure.

Description

Technical Field

[0001] This invention relates to the field of deep learning-based financial risk early warning technology, specifically to a deep learning-based financial risk early warning method and system. Background Technology

[0002] With the increasing complexity and real-time nature of financial transactions, financial risk early warning has become crucial for ensuring transaction security and regulatory compliance. Traditional financial risk detection systems primarily rely on rule engines, assessing risk based on pre-defined single characteristics such as transaction amount and frequency. However, these systems face a significant technical challenge: the difficulty in effectively integrating multi-source heterogeneous data and dynamically adapting to market fluctuations leads to insufficient timeliness and accuracy in risk detection. For example, rule engines typically cannot process the complex relationships between transaction data, entity networks, and market conditions in real time, easily missing unknown risk patterns or generating high false positive rates, and their response times often reach minutes, failing to meet millisecond-level real-time requirements. Furthermore, traditional methods lack adaptability to dynamic market environments and cannot adjust risk assessment thresholds based on volatility, limiting their application in high-frequency trading scenarios. Summary of the Invention

[0003] The purpose of this invention is to provide a financial risk early warning method and system based on deep learning, so as to solve the problems of existing technologies that cannot efficiently integrate multi-source heterogeneous data, cannot dynamically adapt to market fluctuations, and have a lagging early warning response, thereby improving the accuracy, interpretability and real-time performance of financial risk identification.

[0004] To achieve the above objectives, the present invention adopts the following technical solution:

[0005] In a first aspect, the present invention provides a financial risk early warning method based on deep learning, comprising the following steps:

[0006] Acquire multi-source data of the target financial entity within a preset time window, including real-time transaction data streams, entity-related network data, and market data;

[0007] A three-dimensional risk feature tensor is constructed based on the multi-source data, and the tensor includes a time dimension, a feature dimension, and an entity dimension.

[0008] The first feature matrix of the feature dimension is extracted using a convolutional neural network; a second feature matrix and the current entity network graph are generated using a graph neural network based on the graph structure of the entity dimension; the first feature matrix and the second feature matrix are fused through a gating mechanism to generate a fused feature matrix; and a long short-term memory network with an attention mechanism is used to perform temporal modeling on the fused feature matrix to generate the current risk feature vector.

[0009] The spatiotemporal similarity score is calculated using the current risk feature vector, the risk feature vector library within the window, the current entity network graph, and the network graph within the window; the risk judgment threshold is dynamically adjusted based on market volatility, which is calculated based on the standard deviation of historical risk scores.

[0010] When the spatiotemporal similarity score exceeds the dynamic threshold, an early warning response operation corresponding to the risk level is triggered.

[0011] Secondly, the present invention provides a deep learning-based financial risk early warning system, comprising:

[0012] The data acquisition module is configured to acquire multi-source data of the target financial entity within a preset time window, including real-time transaction data streams, entity-related network data, and market data.

[0013] The tensor construction module is configured to construct a three-dimensional risk feature tensor based on the multi-source data. The tensor includes time dimension slices, transaction feature dimensions, and entity association dimensions.

[0014] The feature encoding module is configured to extract a first feature matrix of the feature dimension using a convolutional neural network; generate a second feature matrix and a current entity network graph based on the graph structure of the entity dimension using a graph neural network; fuse the first feature matrix and the second feature matrix through a gating mechanism to generate a fused feature matrix; and perform temporal modeling on the fused feature matrix using a long short-term memory network with an attention mechanism to generate a current risk feature vector.

[0015] The risk assessment module is configured to calculate a spatiotemporal similarity score using the current risk feature vector and the risk feature vector library within the window time, the current entity network graph, and the network graph within the window time; and to dynamically adjust the risk assessment threshold based on market volatility, wherein the market volatility is calculated based on the standard deviation of historical risk scores.

[0016] The early warning module is configured to trigger an early warning response operation corresponding to the risk level when the spatiotemporal similarity score exceeds the dynamic threshold.

[0017] Thirdly, the present invention provides a computer device, comprising:

[0018] processor;

[0019] Memory, which stores computer programs;

[0020] When the computer program is executed by the processor, it implements the deep learning-based financial risk early warning method as described in the first aspect.

[0021] Fourthly, the present invention provides a computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed as described in the first aspect: a deep learning-based financial risk early warning method.

[0022] Beneficial effects of this invention:

[0023] (1) By introducing a three-dimensional risk feature tensor structure, transaction behavior features, entity relationship structure and market environment indicators are integrated in the same representation space for the first time. This structure not only captures the interaction and evolution trend between financial entities, but also effectively portrays the time series characteristics and graph structure dependence of transaction behavior, breaking through the dependence of traditional risk assessment methods on single-dimensional features.

[0024] (2) In terms of risk feature extraction, a multimodal deep coding mechanism was adopted: the local dynamic patterns of the transaction data were extracted using a convolutional neural network; the topology of the entity network was modeled using a graph neural network; and the fusion of different feature spaces was achieved by using a gating mechanism. Finally, by introducing a long short-term memory network with an attention mechanism to model the time series information, the model's ability to capture risk anomalies was effectively enhanced, which is especially suitable for rapidly changing scenarios in high-frequency trading environments.

[0025] (3) In the risk assessment stage, a mechanism linking spatiotemporal similarity calculation with dynamic threshold is proposed. This mechanism not only considers the dynamic time warping distance of the transaction behavior vector, but also integrates the topological similarity of the entity graph structure, and dynamically adjusts the risk assessment threshold based on this, so that the system has good adaptability to the market environment. For example, when market volatility increases significantly, the risk threshold is adaptively reduced, thereby improving the sensitivity to potential risks and avoiding systemic loss of control.

[0026] (4) By constructing a three-dimensional tensor representation that integrates multi-source information, introducing a multi-level deep neural network architecture, and designing a dynamic spatiotemporal pattern matching and threshold adjustment mechanism, an intelligent, adaptive, and interpretable financial risk early warning method is realized. This method has strong generalization ability and application scalability, and is suitable for real-time risk control needs in various financial scenarios such as banking, securities, futures, and payment platforms. It has broad practical application prospects and commercial value.

[0027] The advantages of additional aspects of the invention will be set forth more clearly in the following description or will be learned by practice of the invention. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart of the deep learning-based financial risk early warning method according to an embodiment of the present invention.

[0030] Figure 2 This is a functional framework diagram of the deep learning-based financial risk early warning system according to an embodiment of the present invention.

[0031] Figure 3 This is a functional framework diagram of the computer device according to an embodiment of the present invention. Detailed Implementation

[0032] Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0033] To facilitate understanding of the present invention, the present invention will be further explained and described below with reference to the accompanying drawings and specific embodiments. However, the specific embodiments do not constitute a limitation on the embodiments of the present invention.

[0034] Those skilled in the art should understand that the accompanying drawings are merely schematic diagrams of embodiments, and the components in the drawings are not necessarily essential for implementing the present invention.

[0035] Please refer to Figures 1-3 In one specific embodiment, a deep learning-based financial risk early warning method is provided, comprising the following steps:

[0036] S1. Obtain multi-source data of the target financial entity within a preset time window, including real-time transaction data streams, entity-related network data, and market data.

[0037] S2. Construct a three-dimensional risk feature tensor based on the multi-source data. The tensor includes time dimension slices, transaction feature dimensions, and entity association dimensions.

[0038] S3. Use a convolutional neural network to extract the first feature matrix of the feature dimension; use a graph neural network to generate a second feature matrix based on the graph structure of the entity dimension; fuse the first feature matrix and the second feature matrix through a gating mechanism to generate a fused feature matrix; use a long short-term memory network with an attention mechanism to perform temporal modeling on the fused feature matrix to generate the current risk feature vector.

[0039] S4. Perform dynamic pattern matching between the current risk feature vector and the historical risk feature vector library, and calculate the spatiotemporal similarity score; dynamically adjust the risk judgment threshold according to market volatility, which is calculated based on the standard deviation of historical risk scores.

[0040] S5. When the spatiotemporal similarity score exceeds the dynamic threshold, a warning response operation corresponding to the risk level is triggered.

[0041] To better illustrate the implementation process of this invention, the following example of financial risk early warning based on a real-time trading scenario is used. In one or more embodiments, the above method can be divided into five main steps: multi-source data acquisition, three-dimensional risk feature tensor construction, deep feature encoding, spatiotemporal similarity matching and dynamic threshold determination, and risk level response operation. The core technical implementation methods and key terminology definitions for each step will be detailed below.

[0042] In the step of acquiring multi-source data of the target financial entity, namely step S1, this embodiment collects behavioral and environmental information of the financial entity from multiple sources, specifically including: real-time transaction data streams (such as transaction amount, timestamps, counterparty information, etc.), entity-related network data (such as shareholder relationships, cross-platform account links, legal entity control chains), and market data (such as interest rate fluctuations, industry sector rises and falls, external event impacts, etc.). The collection of the above multi-source data is heterogeneous and unstructured, requiring alignment of all data through a unified timestamp mechanism to ensure dimensional consistency in subsequent tensor construction. Furthermore, for unstructured data such as text news and financial reports, natural language processing models can be used to extract event tags or sentiment polarity values, transforming them into structured variables to supplement the tensor.

[0043] After acquiring multi-source data, the next step is to construct a three-dimensional risk feature tensor, i.e., step S2. A tensor is a data structure or high-dimensional array with multiple dimensions. In this embodiment, the three dimensions of the tensor are defined as the time dimension, feature dimension, and entity dimension. The time dimension represents the time series of financial activities, usually divided into 5-minute time slices to meet the real-time requirements of high-frequency financial trading. The feature dimension includes multiple categories, including trading behavior features (such as trading frequency per unit time, standard deviation of trading amount), entity graph features (such as betweenness centrality, PageRank value), and market indicator features (such as VIX volatility index, sector correlation coefficient, etc.). The entity dimension is used to identify the entity nodes related to financial transactions and their representation in the graph, that is, to represent multiple data subjects participating in financial activities. This dimension corresponds to the set of risk monitoring objects, including but not limited to various accounts, users, institutions, or trading nodes, and is modeled in the form of graph nodes in the graph neural network structure. Each entity corresponds to a node in the graph, and its interaction with other entities is expressed through the edge connections between nodes. Understandably, in step S2, the entity dimension constructs an entity network graph. The current entity network graph is generated based on entity interaction relationships extracted from specified time slices; while the entity relationships accumulated within a sliding time window across historical time slices constitute a historical network graph, used to enhance the modeling capability of long-term relationships between entities. The current graph and the historical network graph can each serve as input to a graph neural network model, supporting the extraction of multi-scale structural information.

[0044] After the tensor construction is completed, the deep learning encoding stage begins, i.e., step S3. This step aims to extract the spatiotemporal correlation and high-order feature representations from the tensor. First, a Convolutional Neural Network (CNN) is used for local extraction in the transaction behavior dimension. The convolutional kernel scans the time-feature matrix in a sliding window manner, which can be used to identify abnormal behavior patterns such as sudden increases in transactions and continuous small transactions. Those skilled in the art will understand that the output of the CNN is a tensor or a high-dimensional feature matrix, i.e., the first feature matrix. In this embodiment, the CNN operates in the transaction behavior dimension, mainly extracting local patterns from time series and multi-dimensional transaction features (such as amount, frequency, location, device, etc.). Then, based on the entity-dimensional graph structure, a Graph Neural Network (GNN) is used to embed and encode the nodes in the graph to capture potential risk contagion paths and structural centrality. Graph Neural Networks (GNNs) utilize message passing mechanisms to enable each node's representation vector to integrate the state features of its neighbors, achieving multi-hop propagation modeling of relational information. Those skilled in the art will understand that the output of a GNN is a matrix composed of the embedded representation vectors of each node in the graph, which is also a tensor form, i.e., the second feature matrix. Based on the outputs of CNNs and GNNs respectively, this embodiment also uses a gating mechanism for feature fusion. The gating mechanism learns a fusion coefficient based on the weights of the input features to fuse the first and second feature matrices. The fused feature sequence is then input into an attention-based Long Short-Term Memory (LSTM) network for time-series modeling. LSTM is a recurrent neural network capable of effectively modeling time-series dependencies, suitable for capturing long-term patterns in financial behavior. With the introduction of an attention mechanism, the model can dynamically focus on the most critical historical segments at each time point, improving its ability to model the causes and consequences of abnormal events. The result generated by the above time-series modeling is the current risk feature vector.

[0045] The next stage of this embodiment involves dynamic pattern matching and spatiotemporal similarity evaluation of the current risk feature vector and historical risk feature vectors, i.e., step S4. It can be understood that the historical risk feature vector is used to characterize the risk state evolution of the target entity within a continuous historical time window. It is a comprehensive representation obtained by encoding a time series composed of current risk feature vectors from multiple time slices. In the time domain, the Dynamic Time Warping (DTW) algorithm is used to measure the alignment distance between the current vector and the historical risk feature vector. DTW is a distance metric that allows non-linear alignment, tolerating small offsets on the time axis, thereby improving the robustness of risk pattern recognition. The formula for calculating the DTW distance is:

[0046] ;

[0047] Where, x i With y j These are the i-th and j-th elements of the current risk feature vector and the historical risk feature vector, respectively. π represents the set of all possible alignment paths, and p is a parameter that adjusts the order of the Euclidean distance. A smaller value indicates that the two risk patterns are more similar.

[0048] Meanwhile, within the structural domain, this invention performs structural matching between the current entity network graph and historical network graphs, calculating graph similarity using the following formula:

[0049] ;

[0050] Where E G1 E G2 Let be the set of edges of two graphs. The intersection-union ratio (IU) measures the degree of structural overlap, while the node overlap rate measures whether the two graphs involve similar financial entities. Graph similarity can reveal whether similar risk diffusion structures exist, such as anomalous account clusters or money laundering networks. It should be noted that in this embodiment and several other embodiments, the gating mechanism fuses the behavioral dynamic feature vectors of the CNN with the structural embedding vectors output by the GNN to generate a unified risk behavior representation; while the graph structure input to the GNN can still be used independently for spatiotemporal similarity analysis or structural evolution modeling of the graph.

[0051] Finally, by combining DTW distance and graph similarity to calculate the spatiotemporal similarity score, this embodiment proposes the following weighted formula:

[0052] ;

[0053] Where w1 + w2 = 1, it is used to adjust the contribution of both time and structure to the overall similarity. By applying a time decay function to the historical vectors, this embodiment further strengthens the focus on recent risk events. The specific decay function form is as follows:

[0054] ;

[0055] Where λ is the time sensitivity coefficient, and Δt is the interval between the historical event and the current time. This mechanism ensures that the model pays more attention to the latest risk evolution trends and prevents over-reliance on outdated historical patterns.

[0056] After calculating the spatiotemporal similarity score, the process proceeds to the dynamic threshold determination and early warning triggering stage, i.e., step S5. In this stage, to avoid false alarms or missed alarms caused by a fixed threshold under different market conditions, this invention employs an adaptive threshold adjustment strategy based on market volatility. Specifically, the risk determination threshold is no longer set as a static constant, but is dynamically adjusted based on recent market volatility. Volatility, as a measure of instability in financial markets, is commonly calculated using statistical methods such as standard deviation and mean absolute deviation. This embodiment selects the standard deviation of historical risk scores as a proxy variable for volatility and introduces a Sigmoid function for normalization, ensuring a smooth transition of the adjustment range between 0 and 1. The threshold adjustment formula is as follows:

[0057] ;

[0058] The basic threshold is the initial risk assessment baseline set by the model, σ is the standard deviation of historical risk scores, α is the coefficient for adjusting sensitivity, and the sigmoid function is in the form of 11+e−α⋅σ. This design ensures that the system becomes more sensitive during periods of sharp market fluctuations, enhancing risk identification capabilities; while during stable periods, it reduces the possibility of false alarms, improving the overall accuracy and stability of the system. When the spatiotemporal similarity score exceeds the dynamically adjusted threshold, this embodiment will trigger a corresponding early warning response mechanism. The early warning mechanism adopts a multi-level response design, implementing differentiated operations corresponding to different risk levels. For example, when the system determines a level 1 risk, it only marks suspicious transactions and records detailed logs for subsequent review; for level 2 risks, it enables biometric verification mechanisms (such as fingerprints, facial recognition, etc.) to verify user identity and automatically generates a structured risk report. This report performs attribution analysis on transaction behavior, account chains, and external influencing factors to assist risk control personnel in their judgment; in the most severe level 3 risk scenario, the system will immediately execute mandatory transaction interception, freeze the involved accounts, and synchronize risk notification information to the higher-level regulatory system to prevent the risk from spreading.

[0059] To further enhance the interpretability and transparency of the system, this embodiment incorporates an explanation and visualization process for the risk feature vector. Specifically, the SHAP (SHapley Additive exPlanations) algorithm is used to quantitatively analyze the contribution of each feature in the current risk feature vector. SHAP is a feature attribution method based on game theory, which assigns a specific "risk contribution value" to each input variable, reflecting its positive or negative impact on the final risk score. By plotting SHAP values, the system can clearly indicate whether the current risk primarily stems from "a surge in trading frequency," "concentrated activity of highly correlated accounts," or "a sharp decline in market indices," providing regulatory auditors with intuitive and decision-making-based risk explanations.

[0060] In another specific embodiment, a deep learning-based financial risk early warning system is provided, comprising:

[0061] The data acquisition module is configured to acquire multi-source data of the target financial entity within a preset time window, including real-time transaction data streams, entity-related network data, and market data.

[0062] The tensor construction module is configured to construct a three-dimensional risk feature tensor based on the multi-source data. The tensor includes time dimension slices, transaction feature dimensions, and entity association dimensions.

[0063] The feature encoding module is configured to extract a first feature matrix of the feature dimension using a convolutional neural network; generate a second feature matrix and a current entity network graph based on the graph structure of the entity dimension using a graph neural network; fuse the first feature matrix and the second feature matrix through a gating mechanism to generate a fused feature matrix; and perform temporal modeling on the fused feature matrix using a long short-term memory network with an attention mechanism to generate a current risk feature vector.

[0064] The risk assessment module is configured to calculate a spatiotemporal similarity score using the current risk feature vector and the risk feature vector library within the window time, the current entity network graph, and the network graph within the window time; and to dynamically adjust the risk assessment threshold based on market volatility, wherein the market volatility is calculated based on the standard deviation of historical risk scores.

[0065] The early warning module is configured to trigger an early warning response operation corresponding to the risk level when the spatiotemporal similarity score exceeds the dynamic threshold.

[0066] In one specific embodiment, when the comprehensive spatiotemporal similarity score exceeds a dynamic threshold, the early warning module will immediately initiate corresponding operations. This module can not only link with the bank's risk control system to execute mandatory measures such as transaction restrictions and account freezes, but also push interpretable reports to risk control personnel, compliance departments, and external regulatory agencies. The reports include: SHAP value graphs, key feature rankings, risk source graphs, event evolution paths, etc., and support multiple output formats such as JSON and PDF. The system also has an embedded feedback interface; once a risk event is confirmed by manual reviewers, the labeled sample can be automatically added to the training set for periodic model fine-tuning, achieving closed-loop updates to model performance.

[0067] To facilitate understanding of the technical solution of the present invention, a specific embodiment is provided to demonstrate the actual application process and effect of this method in the cross-border capital flow monitoring of a large commercial bank.

[0068] In this embodiment, the bank needs to monitor large-scale fund flows of its corporate clients on cross-border payment platforms in real time to identify potential money laundering risks and abnormal arbitrage activities. The system first interfaces with the bank's internal data bus to collect three types of data in real time: transaction behavior data, including all cross-border transaction records of the client in the past 48 hours, with fields including transaction time, amount, currency, counterparty country or region, and transaction channel; entity association data, including historical association maps between the client company and its upstream and downstream partners, holding companies, and accounts controlled by the same legal entity; and market data, including fluctuations in major foreign exchange currencies in the past three days, policy change announcements, and summaries of news highlights in the relevant industry. The data acquisition module integrates data every 5 minutes and uses a timestamp alignment mechanism to handle potential event lags. For example, if client A initiates three cross-border remittances of similar amounts to the same offshore account at 9:01, 9:03, and 9:04, this behavior will be aggregated into the 9:00–9:05 time slice as a high-frequency, low-dispersion transaction sequence input tensor. The constructed three-dimensional risk feature tensor includes the following: Time dimension: 9:00–9:05, 9:05–9:10, 9:10–9:15, etc., continuously divided time slices; Feature dimension: such as "trading frequency per unit time", "node modularity", "client trading concentration", "USDCNH volatility", "counterparty regional risk level", etc.; Entity dimension: unique identifiers of client A and its core related accounts.

[0069] During the feature encoding stage, the system extracts features from the tensor using a pre-trained deep neural network. The CNN model extracts the three-hop remittance pattern (i.e., three consecutive rapid transactions of similar amounts) in the time-behavior sub-dimension, while the GAT model identifies recently added "short chain" association paths with accounts in high-risk areas within customer A's graph structure. These model outputs are then fused through a gating mechanism and further processed by an Attention-LSTM network to derive the current risk feature vector.

[0070] Upon entering the risk assessment module, the system retrieves historical risk case vectors confirmed as "fund transfers to evade regulation" from the past three months and performs dynamic time warping and graph structure similarity matching with the current vector. The DTW distance shows that Client A's trading rhythm highly overlaps with existing arbitrage cases, and the graph structure similarity exceeds 0.75, indicating that its funding path and network structure are very close to existing risk patterns.

[0071] At this point, based on a historical risk standard deviation of 2.1 and a real-time volatility of 1.7, the dynamic threshold is adjusted as follows:

[0072] ;

[0073] The current spatiotemporal similarity score is 0.81, which exceeds the dynamic threshold, therefore the system has triggered a level-two risk warning response. Specific response actions include: automatically labeling customer A's transaction as "medium-risk"; and calling the voiceprint recognition API to verify the operator's identity.

[0074] An automatic SHAP explanation report is generated, showing that the main features affecting the current judgment are "transaction frequency (+0.17)", "sparseness of the association graph (+0.15)" and "node PageRank change (+0.13)".

[0075] Send a structured risk report to the risk control personnel's workbench and remind them of the next recommended freezing action.

[0076] Subsequent manual verification confirmed that the client was indeed a shell company established by an offshore intermediary, attempting to circumvent single-transaction reporting restrictions by frequently splitting remittances. The system successfully identified the risk in advance, preventing financial losses for the bank.

[0077] To implement the method described in this invention, the entire model training process is completed in a data engineering platform. First, at least 100,000 historical cross-border transaction samples are collected in an offline environment, of which approximately 20,000 are confirmed high-risk cases involving arbitrage, money laundering, or fraudulent trade. The remainder represent normal business transactions. Data collection covers the following dimensions: Time series data: including continuous fund inflows / outflows of customers within a certain time period, daily transaction peak and trough characteristics, clearing speed, and transaction interruption frequency; Graph structure data: constructing heterogeneous graphs based on transfers between multiple accounts, common legal entities, login IPs, and shared device information; Financial context features: including point-in-time exchange rates, Hong Kong Monetary Authority policy announcements, and embedded financial news keywords (processed by TextCNN); Background information: such as customer registration location, industry classification, account activity level, and account opening period.

[0078] Before building the model, label balancing and sample augmentation are performed. Since risky transactions constitute a relatively low proportion of the dataset (approximately 20%), direct training would bias the model towards normal samples, leading to a decrease in recall. Therefore, this invention employs the SMOTE (Synthetic Minority Oversampling Technique) algorithm to interpolate and augment high-risk samples in a high-dimensional transaction behavior space, ensuring a near 1:1 ratio of positive to negative samples in the training set while preserving the distance structure between real transactions, thereby enhancing the model's generalization ability.

[0079] In the modeling phase, a two-tower architecture is employed to extract time-series and graph structure features in parallel: The time-series tower uses a Transformer structure with multi-head attention to capture rhythmic and abrupt changes in trading behavior; the graph tower constructs a multi-layer GAT (Graph Attention Network) to weight the relationships between entities, giving greater weight to important high-risk paths when propagating features in the graph. The final output vectors of the paths are concatenated and fed into a 128-dimensional fully connected layer for fusion, followed by ReLU activation, and then fed into a Softmax classifier to output the risk probability. The overall network structure is as follows:

[0080] ;

[0081] Among them, h TS h is the output feature vector of the Transformer tower. GAT Let W1, W2, b1, and b2 be the output vectors of the graph tower, and let W1, W2, b1, and b2 be the learnable parameters. The Softmax output is the probability distribution of a transaction at the three levels of "high risk", "medium risk", and "low risk".

[0082] The training process uses the cross-entropy loss function, defined as follows:

[0083] ;

[0084] Where y i,j This represents the true label of the i-th sample (using One-Hot encoding). This represents the probability of the j-th class predicted by the model. The optimizer uses Adam, with an initial learning rate of 0.001, and 100 training epochs. An early stopping strategy is evaluated every 10 epochs to prevent overfitting.

[0085] In terms of deployment, this invention supports containerized deployment, building microservice interfaces based on TensorFlow Serving or ONNX Runtime, and connecting with the bank's main risk control system via GRPC or RESTful API, supporting millisecond-level real-time scoring. Simultaneously, a Sliding Window strategy is employed for state maintenance to ensure complete analysis of continuous behavior across time slices. Furthermore, to improve model interpretability, this invention introduces a SHAP value risk assessment module. For any risk score result, the system returns the top five features (both positive and negative) that have the greatest impact on the current result, assisting risk control personnel in understanding the model logic and enabling post-event compliance review.

[0086] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that, based on the technical solutions disclosed in the present invention, various modifications or variations that can be made by those skilled in the art without creative effort should be included within the scope of protection of the present invention.

Claims

1. A deep learning-based financial risk early warning method, characterized in that, Includes the following steps: Acquire multi-source data of the target financial entity within a preset time window, including real-time transaction data streams, entity-related network data, and market data; A three-dimensional risk feature tensor is constructed based on the multi-source data, and the tensor includes a time dimension, a feature dimension, and an entity dimension. The first feature matrix of the feature dimension is extracted using a convolutional neural network; the second feature matrix and the current entity network graph are generated using a graph neural network based on the graph structure of the entity dimension; the first feature matrix and the second feature matrix are fused through a gating mechanism to generate a fused feature matrix. The fused feature matrix is ​​temporally modeled using a long short-term memory network with an attention mechanism to generate the current risk feature vector; The spatiotemporal similarity score is calculated using the current risk feature vector, the risk feature vector library within the window, the current entity network graph, and the network graph within the window; the risk judgment threshold is dynamically adjusted based on market volatility, which is calculated based on the standard deviation of historical risk scores. When the spatiotemporal similarity score exceeds the dynamic threshold, an early warning response operation corresponding to the risk level is triggered.

2. The deep learning-based financial risk early warning method according to claim 1, characterized in that, The step of constructing a three-dimensional risk feature tensor based on the multi-source data includes the following steps: The acquired multi-source data is constructed into a three-dimensional tensor with time, feature, and entity dimensions, where: The time dimension is used to represent the dynamic evolution of financial activities within a predetermined time window; the feature dimension includes a multi-dimensional feature set consisting of transaction behavior features, financial graph structure features, and market indicator features; the entity dimension is used to identify entity nodes related to financial transactions and their representation in the graph.

3. The deep learning-based financial risk early warning method according to claim 1, characterized in that, The step of dynamically matching the current risk feature vector with the historical risk feature vector database and calculating the spatiotemporal similarity score includes the following steps: Calculate the dynamic time-normalized distance between the current risk feature vector and the historical risk feature vector; Calculate the structural similarity of entity network graphs; The spatiotemporal similarity score is calculated by combining the dynamic time warping distance and structural similarity.

4. The deep learning-based financial risk early warning method according to claim 3, characterized in that, In calculating the dynamic time warping distance between the current risk feature vector and the historical risk feature vector, elements in the vector sequence are allowed to shift to a certain extent in time position, and their time similarity is determined based on the total distance of the minimum alignment path between the vectors.

5. The deep learning-based financial risk early warning method according to claim 3 or 4, characterized in that, The dynamic time warping algorithm is used in calculating the dynamic time warping distance between the current risk feature vector and the historical risk feature vector.

6. The deep learning-based financial risk early warning method according to claim 1, characterized in that, The early warning response operation includes a tiered response mechanism: When the risk level is Level 1, execute the transaction monitoring flag and record the transaction log; When the risk level is level 2, biometric verification is triggered and a risk analysis report is generated, which includes risk source attribution. When the risk level is level three, real-time transaction interception will be implemented and the relevant accounts will be frozen.

7. The deep learning-based financial risk early warning method according to claim 1 or 2, characterized in that, The time interval for the time dimension is 5 minutes.

8. A deep learning-based financial risk early warning system, characterized in that, include: The data acquisition module is configured to acquire multi-source data of the target financial entity within a preset time window, including real-time transaction data streams, entity-related network data, and market data. The tensor construction module is configured to construct a three-dimensional risk feature tensor based on the multi-source data. The tensor includes time dimension slices, transaction feature dimensions, and entity association dimensions. The feature encoding module is configured to encode the three-dimensional risk feature tensor using a deep learning model to generate the current risk feature vector; The risk assessment module is configured to perform dynamic pattern matching between the current risk feature vector and the historical risk feature vector library, and calculate the spatiotemporal similarity score. The risk assessment threshold is dynamically adjusted based on market volatility, which is calculated based on the standard deviation of historical risk scores. The early warning module is configured to trigger an early warning response operation corresponding to the risk level when the spatiotemporal similarity score exceeds the dynamic threshold.

9. A computer device, characterized in that, include: processor; Memory, which stores computer programs; When the computer program is executed by the processor, it implements the deep learning-based financial risk early warning method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1 to 7.

Images