Cross-account transaction monitoring and risk early warning method and system for a dual-account system

Abstract

This invention provides a method and system for cross-account transaction monitoring and risk warning in a dual-account system, relating to the field of financial transaction monitoring technology. First, it acquires a set of historical cross-account transaction records from a set of dedicated welfare fund accounts and a set of general welfare consumption accounts for a target labor union organization, extracting the transaction purpose intent flow to generate a historical purpose intent flow distribution network. The current cross-account transaction record flow, collected in real-time, is injected into the network for intent flow channel occupancy analysis, generating purpose intent flow occupancy traces. These traces are then overlaid and aggregated to construct a real-time purpose intent flow aggregation graph, identifying abnormal aggregation clusters and generating purpose intent flow source tracing blocking instructions and exit flow restriction instructions. This invention can monitor cross-account transactions in a dual-account system in real time, promptly detect anomalies and issue warnings, ensuring fund security.

Description

Technical Field

[0001] This invention relates to the field of financial transaction monitoring technology, and more specifically, to a method and system for cross-account transaction monitoring and risk warning in a dual-account system. Background Technology

[0002] In the management system of trade union organizations, two different types of accounts are usually set up: a special account for welfare funds and a general account for welfare consumption, in order to achieve special management and reasonable consumption of welfare funds. With the development of trade union business and the expansion of transaction scale, cross-account transactions under the dual-account system are becoming more frequent, and the transaction scenarios are becoming more complex and diverse.

[0003] Currently, cross-account transaction monitoring in dual-account systems primarily relies on traditional rule matching and simple statistical analysis methods. These methods often only provide a superficial and static review of transactions, such as checking whether the transaction amount exceeds a preset threshold or whether both parties are on a whitelist. However, these monitoring methods have significant limitations. On the one hand, they struggle to delve into the underlying intentions of transactions and cannot accurately determine whether transactions align with the intended use and consumption scenarios of welfare funds. On the other hand, traditional methods are insufficient for timely detection and warning of abnormal transaction patterns and potential risks, such as unreasonable fund flows or illegal misappropriation of welfare funds. Furthermore, existing monitoring methods lack the ability to track and analyze dynamic changes in transactions in real time, failing to adjust monitoring strategies promptly based on real-time transaction conditions, thus posing potential risks to the financial security and normal operation of trade union organizations. Summary of the Invention

[0004] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a method for cross-account transaction monitoring and risk warning in a dual-account system, the method comprising: Obtain the set of historical cross-account transaction records generated by the set of special welfare fund accounts and general welfare consumption accounts of the target trade union organization within the historical monitoring period. The set of historical cross-account transaction records includes the historical transaction initiation time, historical transaction amount, historical transaction initiating account identifier, historical transaction receiving account identifier, and historical transaction occurrence scenario identifier for each historical transaction. The historical cross-account transaction record set is processed by extracting the transaction purpose intent flow to generate a historical purpose intent flow distribution network between the welfare fund special account set and the welfare consumption general account set. The historical purpose intent flow distribution network takes each welfare fund special account as the intent flow starting node, each welfare consumption general account as the intent flow ending node, and the purpose migration path of each historical transaction in the historical cross-account transaction record set as the intent flow transmission channel. Each intent flow transmission channel has a purpose intent transmission direction attribute and a purpose intent transmission strength attribute. Each current cross-account transaction in the current cross-account transaction record stream within the current monitoring time window is injected into the historical purpose intent flow distribution network. Intent flow channel occupancy analysis is performed on each current cross-account transaction to generate a purpose intent flow occupancy trace for each current cross-account transaction. The purpose intent flow occupancy trace includes the intent flow starting node identifier, the intent flow transmission channel identifier, and the intent flow arrival node identifier that the current cross-account transaction occupies in the historical purpose intent flow distribution network. All usage intent flow occupancy traces generated within the current monitoring time window are overlaid and aggregated to construct a real-time usage intent flow aggregation map corresponding to the current monitoring time window. The real-time usage intent flow aggregation map includes multiple intent flow aggregation nodes and multiple intent flow aggregation channels. Based on the intent flow aggregation nodes in the real-time intent flow aggregation graph, identify the abnormal intent flow aggregation clusters in the set of welfare fund special accounts and the set of welfare consumption general accounts, and generate intent flow tracing and blocking instructions for the set of welfare fund special accounts and intent flow exit flow restriction instructions for the set of welfare consumption general accounts based on the abnormal intent flow aggregation clusters.

[0005] Furthermore, embodiments of the present invention also provide a cross-account transaction monitoring and risk warning system for a dual-account system, comprising: A processor; a machine-readable storage medium for storing machine-executable instructions of the processor; wherein the processor is configured to execute the aforementioned cross-account transaction monitoring and risk warning method for a dual-account system by executing the machine-executable instructions.

[0006] In another aspect, embodiments of the present invention also provide a computer program product, the computer program product including machine-executable instructions stored in a computer-readable storage medium, wherein a processor of a cross-account transaction monitoring and risk warning system for a dual-account system reads the machine-executable instructions from the computer-readable storage medium, and the processor executes the machine-executable instructions, causing the cross-account transaction monitoring and risk warning system for a dual-account system to execute the aforementioned cross-account transaction monitoring and risk warning method for a dual-account system.

[0007] Based on the above, by acquiring the historical cross-account transaction record set of the target trade union organization's dual-account system, the transaction purpose intent flow is extracted from the historical transaction records, generating a historical purpose intent flow distribution network. This network intuitively presents the purpose migration relationship between the welfare fund special account and the welfare consumption general account, clarifying the direction and intensity of the purpose intent transmission in transactions. The current cross-account transaction record stream, collected in real time, is injected into the historical purpose intent flow distribution network for intent flow channel occupancy analysis, generating purpose intent flow occupancy traces. This allows for real-time tracking of the purpose intent flow of each transaction. By overlaying and aggregating all purpose intent flow occupancy traces, a real-time purpose intent flow aggregation graph is constructed, achieving a comprehensive summary and visualization of the transaction purpose intent within the current monitoring time window. Based on the real-time purpose intent flow aggregation graph, abnormal aggregation clusters of purpose intent flows are identified, and targeted purpose intent flow tracing and blocking instructions and exit flow restriction instructions are generated. This enables timely detection and prevention of abnormal transaction behavior, effectively controlling financial risks, ensuring the safe and stable operation of the trade union organization's dual-account system, improving the accuracy and timeliness of monitoring, and enhancing risk warning capabilities. Attached Figure Description

[0008] Figure 1 This is a schematic diagram of the execution flow of the cross-account transaction monitoring and risk warning method for a dual-account system provided in an embodiment of the present invention.

[0009] Figure 2 This is a schematic diagram of exemplary hardware and software components of a cross-account transaction monitoring and risk warning system for a dual-account system provided in an embodiment of the present invention. Detailed Implementation

[0010] Figure 1 This is a flowchart illustrating a cross-account transaction monitoring and risk warning method for a dual-account system provided by an embodiment of the present invention, which will be described in detail below.

[0011] Step S110: Obtain the set of historical cross-account transaction records generated by the set of special welfare fund accounts and the set of general welfare consumption accounts of the target trade union organization within the historical monitoring period. The set of historical cross-account transaction records includes the historical transaction initiation time, historical transaction amount, historical transaction initiating account identifier, historical transaction receiving account identifier, and historical transaction occurrence scenario identifier for each historical transaction.

[0012] In this embodiment, a labor union is used as an example. This union manages a set of dedicated welfare fund accounts for distributing employee benefits, and a set of general welfare consumption accounts linked to these dedicated accounts for employee spending at various contracted merchants. First, all cross-account transaction records occurring within a complete past fiscal year (i.e., the historical monitoring period) are extracted from the historical database of the union's welfare payment and settlement system, thus forming a historical cross-account transaction record set. This historical database is a relational database, where each transaction record is stored in the form of structured data rows. During extraction, for each historical transaction, several data fields are read: the historical transaction initiation time, a timestamp accurate to milliseconds, recorded in the format "YYYY-MM-DDHH:MM:SS.sss"; the historical transaction amount, an integer value measured in the smallest unit of legal tender in the location of the trade union (e.g., "fen"); the historical transaction initiating account identifier, a unique number for a welfare fund special account, such as "FUND_ACCT_0001"; the historical transaction receiving account identifier, a unique number for a welfare consumption general account, such as "CONS_ACCT_A001"; and the historical transaction occurrence scenario identifier, which is a multi-dimensional code, such as "SCENE_MERCHANT_001_GROCERY", which encodes information such as merchant category, geographical location, and consumption type.

[0013] Step S120: Perform transaction purpose intent flow extraction processing on the historical cross-account transaction record set to generate a historical purpose intent flow distribution network between the welfare fund special account set and the welfare consumption general account set. The historical purpose intent flow distribution network takes each welfare fund special account as the intent flow starting node, each welfare consumption general account as the intent flow ending node, and the purpose migration path of each historical transaction in the historical cross-account transaction record set as the intent flow transmission channel. Each intent flow transmission channel has a purpose intent transmission direction attribute and a purpose intent transmission strength attribute.

[0014] Next, a deep analysis is performed on the historical cross-account transaction record set obtained in step S110 above to construct a historical purpose intention flow distribution network that can reflect the flow pattern of funds. This historical purpose intention flow distribution network aims to abstractly describe the purpose conversion and path selection patterns that welfare funds undergo as they flow from dedicated accounts to general accounts.

[0015] Step S121: Traverse each historical cross-account transaction record in the historical cross-account transaction record set, extract the historical transaction initiating account identifier and the historical transaction receiving account identifier of each historical cross-account transaction record, mark each historical transaction initiating account identifier as the intent flow originating node identifier, and mark each historical transaction receiving account identifier as the intent flow arriving node identifier.

[0016] A data traversal process is initiated, scanning the historical cross-account transaction record set line by line. For each record, a field extraction function is used to parse out the two key fields: "Historical Transaction Initiating Account Identifier" and "Historical Transaction Receiving Account Identifier." The parsed initiating account identifier, such as "FUND_ACCT_0001," is marked as an intent flow originating node in a node mapping table built in memory. Similarly, the parsed receiving account identifier, such as "CONS_ACCT_A001," is marked as an intent flow arriving node. A new node object is created for each first occurrence of the account identifier, and the frequency count of transactions that the existing node has served as an originating or arriving node is incremented. After traversing the entire set, a complete list of identifiers for all welfare fund-specific accounts (as originating nodes) and welfare consumption general accounts (as arriving nodes) involved in historical transactions is obtained.

[0017] Step S122: Parse the historical transaction scenario identifier of each historical cross-account transaction record, traverse the preset welfare fund usage and consumption scenario mapping relationship library according to the historical transaction scenario identifier, and determine the intermediate node identifier sequence of the usage migration path corresponding to the historical cross-account transaction record. The intermediate node identifier sequence of the usage migration path includes multiple intermediate usage semantic node identifiers from the welfare fund distribution usage tag corresponding to the historical transaction initiating account identifier to the historical transaction scenario identifier.

[0018] Step S1221: Parse the historical transaction initiating account identifier of each historical cross-account transaction record, query the preset welfare fund special account usage authorization registration master table according to the historical transaction initiating account identifier, obtain the welfare fund distribution usage tag uniquely bound to the historical transaction initiating account identifier, and determine the welfare fund distribution usage tag as the starting intermediate usage semantic node identifier of the usage migration path.

[0019] For each historical cross-account transaction record encountered during the current iteration, its "historical transaction initiating account identifier," such as "FUND_ACCT_0001," is first parsed. Then, using this identifier as the query key, a lookup is performed in a pre-built and cached table of authorized registration records for welfare fund special accounts. This table is a set of key-value pairs, where the key is the special account identifier and the value is the authorized welfare payment usage label for that account, such as "FUND_PURPOSE_EDUCATION" (education subsidy) or "FUND_PURPOSE_MEDICAL" (medical subsidy). The query result, such as "FUND_PURPOSE_EDUCATION," is extracted and used as the starting intermediate usage semantic node identifier for the transaction's usage migration path.

[0020] Step S1222: Parse the historical transaction scenario identifier of the same historical cross-account transaction record, and determine the historical transaction scenario identifier as the termination intermediate use semantic node identifier of the use migration path.

[0021] Next, the "historical transaction scenario identifier" in the same transaction record is parsed, such as "SCENE_MERCHANT_001_BOOKSTORE". This historical transaction scenario identifier itself contains the final consumption scenario information. This historical transaction scenario identifier is directly identified as the semantic node identifier for the termination of the intermediate purpose in the migration path of this transaction.

[0022] Step S1223: Input the starting intermediate use semantic node identifier and the ending intermediate use semantic node identifier into the welfare fund use and consumption scenario mapping relationship library. The welfare fund use and consumption scenario mapping relationship library pre-stores multiple optional use migration paths from each welfare fund disbursement use tag to each consumption scenario identifier. Each optional use migration path is composed of multiple intermediate use semantic node identifiers connected in sequence.

[0023] The starting node identifier "FUND_PURPOSE_EDUCATION" obtained in step S1221 and the ending node identifier "SCENE_MERCHANT_001_BOOKSTORE" obtained in step S1222 are combined into a query input pair and sent to the welfare fund usage and consumption scenario mapping relationship database. This mapping relationship database is a graph database that stores various usage conversion paths predefined by business experts or obtained through historical data mining. The nodes in the graph are semantic labels for various uses (such as "education", "book purchase", "knowledge enhancement"), and the directed edges represent the conversion relationship between uses. Multiple consecutive directed edges constitute a complete usage migration path. For example, there may be two paths from "education subsidy" to "book purchase": one is a direct path "education subsidy" -> "book purchase"; the other is an indirect path "education subsidy" -> "cultural consumption" -> "book purchase".

[0024] Step S1224: Search the welfare fund usage and consumption scenario mapping relationship library for all optional usage migration paths that start from the initial intermediate usage semantic node identifier and end at the termination intermediate usage semantic node identifier, and generate a candidate usage migration path list.

[0025] In a graph database, a graph path query algorithm, such as depth-first search or breadth-first search, is executed to find all directed paths between the starting node identifier "FUND_PURPOSE_EDUCATION" and the ending node identifier "SCENE_MERCHANT_001_BOOKSTORE" with a length not exceeding a preset maximum length (e.g., containing no more than 5 intermediate nodes). The query results return a list containing all paths that meet the criteria, with each path represented by an ordered sequence of node identifiers. For example, a list of candidate migration paths might contain two paths: Path A: ["FUND_PURPOSE_EDUCATION", "SCENE_MERCHANT_001_BOOKSTORE"] (length 1, i.e., a direct path); Path B: ["FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", "SCENE_MERCHANT_001_BOOKSTORE"] (length 2, i.e., an indirect path).

[0026] Step S1225: If there are multiple optional migration paths in the candidate migration path list, then based on the historical transaction initiation time and the historical transaction amount of the historical cross-account transaction record, select the optional migration path with the highest matching degree with the historical transaction initiation time and the historical transaction amount as the target migration path.

[0027] Suppose there are two paths, Path A and Path B, in the candidate migration path list. In this case, the best path needs to be selected based on the attributes of the transaction itself. First, extract the "historical transaction initiation time," for example, "2023-09-01 10:30:25," and the "historical transaction amount," for example, "5000" (points). Then, calculate the matching degree between each path and these two attributes. For the initiation time, consider the frequency of use of the path in the same historical period (e.g., September of each of the past three years); the higher the frequency, the higher the matching degree. For the amount, consider the average amount of historical transactions corresponding to the path; the smaller the difference between the average amount and the current amount, the higher the matching degree. Calculate the comprehensive matching degree score for each path by weighted summing (e.g., time weighted at 0.3, amount weighted at 0.7). Compare the comprehensive scores of Path A and Path B, and select the path with the higher score as the target migration path. If Path A has a high historical usage frequency and an average amount close to 5000 points, its score is higher than Path B, then Path A is selected as the target migration path.

[0028] Step S1226: If there is only one optional use migration path in the candidate use migration path list, then directly determine that optional use migration path as the target use migration path.

[0029] If, after the query, there is only one path in the candidate migration path list, such as path A, then there is no need to perform the best selection calculation; path A can be directly determined as the target migration path.

[0030] Step S1227: Extract all intermediate use semantic node identifiers, except for the starting intermediate use semantic node identifier and the ending intermediate use semantic node identifier, contained in the target use migration path, and arrange them according to the original order in the target use migration path to generate the intermediate node identifier sequence of the use migration path.

[0031] For a defined migration path targeting a specific purpose, such as path B: ["FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", "SCENE_MERCHANT_001_BOOKSTORE"], remove the start and end points "FUND_PURPOSE_EDUCATION" and "SCENE_MERCHANT_001_BOOKSTORE", and extract the identifiers of the intermediate nodes. In this example, there is only one extracted intermediate node identifier: "PURPOSE_CULTURE_CONSUME". Arrange these intermediate nodes in the order they appear in the original path to form a sequence. Since there is only one node, this sequence is ["PURPOSE_CULTURE_CONSUME"].

[0032] Step S1228: Append the starting intermediate use semantic node identifier to the beginning of the sequence of intermediate node identifiers of the use migration path, and append the ending intermediate use semantic node identifier to the end of the sequence of intermediate node identifiers of the use migration path, to generate a final use migration path intermediate node identifier sequence containing complete path nodes.

[0033] To obtain a sequence containing complete path information, the start node identifier "FUND_PURPOSE_EDUCATION" is added to the beginning of the sequence ["PURPOSE_CULTURE_CONSUME"] generated in step S1227, and the end node identifier "SCENE_MERCHANT_001_BOOKSTORE" is added to the end, thereby generating a complete end-use migration path intermediate node identifier sequence: ["FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", "SCENE_MERCHANT_001_BOOKSTORE"].

[0034] Step S1229: Perform sequence length verification on the intermediate node identifier sequence of the final use migration path. If the sequence length is lower than the preset minimum path node number threshold, trigger the path node completion process. Search in the welfare fund use and consumption scenario mapping relationship library for a supplementary intermediate use semantic node identifier that can connect the starting intermediate use semantic node identifier and the ending intermediate use semantic node identifier, and insert it into the corresponding position in the sequence.

[0035] To prevent the loss of important intermediate conversion information due to overly simple paths, the final sequence is length-validated. A minimum path node count threshold is preset, for example, 3. The current sequence contains 3 nodes (start, middle, and end), and its length equals the threshold, so the validation passes and no completion is needed. If the generated sequence length is only 2 (i.e., only start and end nodes, such as path A), which is below the threshold of 3, the completion process is triggered. The completion process will again query the welfare fund usage and consumption scenario mapping database to see if there exists a path that connects the start and end nodes with a total of 3 nodes. If such a path exists, for example, a start->middle->end path is found, the found middle node is inserted between the start and end nodes of the original sequence. If no path of length 3 exists, a path of length 4 is searched, and so on, until a path that meets the threshold requirement is found, and the found nodes are inserted sequentially. If no path of length can be found after traversing all lengths, a default "general conversion node" defined by expert rules is used for insertion, such as inserting "PURPOSE_GENERAL_CONSUME".

[0036] Step S12210: Determine the intermediate node identifier sequence of the final purpose migration path after the verification and completion processing as the intermediate node identifier sequence of the purpose migration path corresponding to the historical cross-account transaction record; associate and store the intermediate node identifier sequence of the purpose migration path with the historical cross-account transaction record for subsequent use in the intent stream transmission channel construction step.

[0037] After processing in step S1229, a qualified end-use migration path intermediate node identifier sequence is obtained, such as [“FUND_PURPOSE_EDUCATION”, “PURPOSE_CULTURE_CONSUME”, “SCENE_MERCHANT_001_BOOKSTORE”]. This sequence is used as a new attribute of the transaction (identified by a unique transaction serial number) and stored back into the historical database or written to an intermediate data table specifically for intent flow analysis, along with the original record of the transaction. Simultaneously, an index from the transaction serial number to this sequence is created for rapid retrieval in subsequent channel construction steps.

[0038] Step S123: Concatenate the historical transaction initiating account identifier, the intermediate node identifier sequence of the purpose migration path, and the historical transaction receiving account identifier in chronological order of the historical transaction initiation time to generate the initial purpose migration path identifier string corresponding to the historical cross-account transaction record. The initial purpose migration path identifier string uses the intent flow starting node identifier as the string head identifier, the intent flow arriving node identifier as the string tail identifier, and each intermediate purpose semantic node identifier in the purpose migration path intermediate node identifier sequence as the string middle identifier.

[0039] For each processed transaction, its three core components are concatenated into a complete path identifier string. The concatenation order strictly follows the temporal logic of fund flow and purpose conversion: First, the intention flow originating node identifier determined in step S121 (i.e., the historical transaction initiating account identifier, such as "FUND_ACCT_0001") is placed at the beginning; second, the identifiers from the intermediate node identifier sequence of the purpose migration path obtained in step S12210 (such as ["FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", "SCENE_MERCHANT_001_BOOKSTORE"]) are arranged sequentially in the middle; finally, the intention flow arriving node identifier determined in step S121 (i.e., the historical transaction receiving account identifier, such as "CONS_ACCT_A001") is placed at the end. In this way, an initial purpose migration path identifier string containing a complete chain of "fund source -> purpose initiation -> purpose conversion -> consumption scenario -> fund destination" is generated. For example, the initial purpose migration path identifier string could be represented as: ["FUND_ACCT_0001", "FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", "SCENE_MERCHANT_001_BOOKSTORE", "CONS_ACCT_A001"]. This identifier string is not a string, but a list or array of identifiers arranged sequentially in memory.

[0040] Step S124: Add a purpose intention transmission direction attribute to the initial purpose migration path identifier string corresponding to each historical cross-account transaction record. The purpose intention transmission direction attribute is pointed from the intention flow origin node identifier to the intention flow destination node identifier. The time freshness weight coefficient of the purpose intention transmission direction attribute is determined according to the relative time position of the historical transaction initiation time within the historical monitoring period.

[0041] A vector attribute, namely the direction of purpose intent transmission, is attached to the initial purpose migration path identifier string generated in step S123. This direction of purpose intent transmission is defined as a vector from the beginning identifier (the starting node of the intent flow) to the end identifier (the destination node of the intent flow). This vector itself is a concept, and its physical meaning is determined by the sequence of intermediate nodes it passes through. Simultaneously, to reflect the stronger indicative role of recent transactions in the current capital flow pattern, a time freshness weight coefficient is calculated. The calculation method for this time freshness weight coefficient is as follows: obtain the historical transaction initiation time of the transaction, such as "2023-09-01 10:30:25", and the start time of the historical monitoring period "2023-01-01 00:00:00" and the end time "2023-12-31 23:59:59". First, convert the initiation time into a relative time position within the period. For example, calculate the difference in seconds from the start of the period to the initiation time, and then divide it by the total number of seconds in the entire period to obtain a ratio value between 0 and 1. Then, this proportion is mapped to a weighting coefficient using a decay function (such as an exponential decay function). Transactions closer to the end of the cycle have proportions closer to 1, and their weighting coefficients after decay are higher (e.g., close to 1.0); while transactions closer to the beginning of the cycle have lower weighting coefficients (e.g., close to 0.3). The calculated weighting coefficient, for example 0.85, is stored as a "time freshness weighting coefficient" bound to the initial migration path identifier string and direction attribute.

[0042] Step S125: Analyze the historical transaction amount of each historical cross-account transaction record, and based on the historical transaction amount, calculate the initial purpose intent transmission strength value corresponding to the historical cross-account transaction record according to the preset mapping rules, and use the initial purpose intent transmission strength value as the initial purpose intent transmission strength attribute of the historical cross-account transaction record.

[0043] The system analyzes the historical transaction amount for each transaction, for example, "5000" (points). Then, it converts this amount into a standardized initial purpose intent strength value according to a pre-defined mapping rule. This mapping rule aims to eliminate the influence of different amount magnitudes, making the strength attribute comparable. A simple mapping rule uses Min-Max standardization: iterates through the transaction amounts of all transactions within the historical monitoring period, finding the maximum (e.g., MAX_AMOUNT = 1,000,000 points) and minimum (e.g., MIN_AMOUNT = 1 point). Then, for the current transaction amount "X = 5000", its initial purpose intent strength value I_strength is calculated as: I_strength = (X - MIN_AMOUNT) / (MAX_AMOUNT - MIN_AMOUNT). This calculation process ensures that I_strength is a decimal between 0 and 1. The larger the amount, the greater the "strength" of the fund flow, and the closer the standardized value is to 1. The calculated value, such as 0.004999, is used as the initial purpose of the transaction to convey the strength attribute, and is stored together with the aforementioned path identifier string and direction attribute.

[0044] Step S126: Perform path identifier string aggregation processing on multiple initial purpose migration path identifier strings that have the same intention flow origin node identifier and the same intention flow destination node identifier. Perform vector synthesis of the purpose intention transmission direction attributes of multiple initial purpose migration path identifier strings to generate an aggregated composite purpose intention transmission direction. And accumulate the initial purpose intention transmission strength attributes of multiple initial purpose migration path identifier strings to generate an aggregated composite purpose intention transmission strength.

[0045] After generating initial information for all historical transactions, the aggregation phase begins, which aims to merge scattered transactions into a structured intent stream transmission channel. Aggregation is performed by grouping transactions based on their shared origin and destination nodes.

[0046] Step S1261: Filter out all historical cross-account transaction records with the same intention flow start node identifier and the same intention flow destination node identifier from the historical cross-account transaction record set, and extract the initial purpose migration path identifier string corresponding to the historical cross-account transaction record and its additional purpose intention transmission direction attribute and initial purpose intention transmission strength attribute.

[0047] Perform a grouping and aggregation operation. First, for all historical transactions, use the combination of the originating node identifier and the destination node identifier of the intent flow as the grouping key, for example, the grouping key is (originating node: "FUND_ACCT_0001", destination node: "CONS_ACCT_A001"). Filter out all transaction records with this grouping key to form a transaction group. Then, iterate through each transaction record in the transaction group and extract the initial purpose migration path identifier string, purpose intent transmission direction attribute (including its direction vector and time freshness weight coefficient), and initial purpose intent transmission strength value generated for the transaction in steps S123, S124, and S125.

[0048] Step S1262: Perform a weighted average of all extracted purpose intent transmission direction attributes according to their corresponding time freshness weight coefficients to generate a weighted average synthetic purpose intent transmission direction angle value.

[0049] Suppose a transaction group contains N transactions, each transaction i has a direction vector. Although the direction vector is defined as pointing from the starting node to the destination node, due to the different intermediate nodes, its "direction" in semantic space actually represents different conversion paths for different uses. To quantify these directions, each path can be assigned a predefined angle value θ_i (e.g., a direct path corresponds to 0 degrees, a cultural consumption path to 30 degrees, a medical path to -20 degrees, etc., the angle value is determined by the semantic label of the path through a hash function or expert mapping table). Simultaneously, each transaction i corresponds to a time freshness weight coefficient w_i. Then, the combined direction angle value θ_combined is calculated using the following weighted average formula: θ_combined=(Σ(w_i*θ_i)) / (Σw_i). The calculated result, for example, 25 degrees, is a value representing the overall directional tendency of the transactions in this group.

[0050] Step S1263: Map the weighted average synthetic purpose intention transmission direction angle value to a preset direction angle level division interval, and determine the direction angle level label to which the synthetic purpose intention transmission direction belongs.

[0051] A pre-defined rule base for classifying directional angles is established, dividing the 360-degree space into several consecutive intervals, each assigned a level label. For example, [-15 degrees, 15 degrees] is classified as "direct use level," (15 degrees, 45 degrees) as "cultural and educational use level," (45 degrees, 75 degrees) as "health and medical use level," and so on. The θ_combined = 25 degrees calculated in step S1262 is compared with these intervals, and it is found to fall within the (15 degrees, 45 degrees) interval. Therefore, the directional angle level label for this group of transactions is determined to be "cultural and educational use level."

[0052] Step S1264: Accumulate the values ​​of all extracted initial purpose intent transmission strength attributes to obtain the total accumulated purpose intent transmission strength value.

[0053] For all N transactions within the same trading group, the initial intended use strength values ​​(i.e., I_strength_i) calculated in step S125 are summed. The summation formula is: I_total = ΣI_strength_i. This summation result I_total is no longer a number between 0 and 1, but a value reflecting the relative scale of the total capital flow of the trading group.

[0054] Step S1265: Compare the total intended use strength value with the preset intended use strength level classification threshold step by step to determine the strength level label to which the synthetic intended use strength belongs.

[0055] A set of incrementally increasing intensity level thresholds is preset, for example, thresholds T1=0.5, T2=1.5, and T3=3.0, corresponding to "low intensity level," "medium intensity level," "high intensity level," and "ultra-high intensity level," respectively. The I_total value calculated in step S1264 is compared sequentially with these thresholds. If I_total is less than or equal to T1, the intensity level label is "low intensity level"; if I_total is greater than T1 and less than or equal to T2, the label is "medium intensity level," and so on. Assuming the calculated I_total value is 2.0, which is greater than T2=1.5 and less than T3=3.0, then the intensity level label for the group's intended use intensity is determined to be "high intensity level."

[0056] Step S1266: Combine and encode the direction angle level label and the intensity level label to generate an aggregated encoding identifier corresponding to the historical cross-account transaction records with the same intention flow origin node identifier and the same intention flow destination node identifier.

[0057] The directional angle level label "Cultural and Educational Purpose Level" and the intensity level label "High Intensity Level" obtained in steps S1263 and S1265 are combined and encoded. The encoding method can be a simple string concatenation, for example, connecting the predefined codes of the two labels (such as "CULTURE_EDU" and "HIGH") with a separator to generate the aggregate encoding identifier "CULTURE_EDU#HIGH".

[0058] Step S1267: Temporarily store the aggregated code identifier and establish an association mapping relationship between the aggregated code identifier and the intent flow origin node identifier and intent flow destination node identifier corresponding to the group of historical cross-account transaction records.

[0059] The generated aggregation code identifier "CULTURE_EDU#HIGH" and its corresponding grouping key (originating node "FUND_ACCT_0001", destination node "CONS_ACCT_A001") are stored as a key-value pair (key is the grouping key, value is the aggregation code identifier) ​​in a temporary aggregation result mapping table. This mapping table resides in an in-memory database (such as Redis) and is used for quickly querying the qualitative results of the aggregation of any origin-destination node pair.

[0060] Step S1268: Query the preset aggregation result mapping table according to the aggregation code identifier to obtain the standardized synthetic purpose intent transmission direction and standardized synthetic purpose intent transmission strength corresponding to the aggregation code identifier.

[0061] There exists a pre-configured aggregation result mapping table that stores the mapping from aggregation code identifiers to specific normalized values. For example, the mapping table defines that for the aggregation code identifier "CULTURE_EDU#HIGH", its corresponding normalized synthetic purpose intent transmission direction is a unit vector with an angle that is the precise value of θ_combined = 25 degrees calculated in step S1262, or a predefined typical value within an interval (such as 30 degrees); the corresponding normalized synthetic purpose intent transmission strength is a normalized value, such as a value between 0 and 1 obtained by further global normalization of I_total, for example, 0.75. These two normalized values ​​can be obtained by querying this table using the aggregation code identifier "CULTURE_EDU#HIGH".

[0062] Step S1269: The obtained standardized synthetic purpose intent transmission direction and standardized synthetic purpose intent transmission strength are used as the final aggregation result corresponding to the group of historical cross-account transaction records; the final aggregation result is output to the intent flow transmission channel construction module for use when generating the intent flow transmission channel between the corresponding intent flow origin node identifier and intent flow destination node identifier.

[0063] The standardized values ​​obtained from the aggregation result mapping table—namely, the standardized synthetic purpose intent transmission direction (a vector) and the standardized synthetic purpose intent transmission strength (a scalar)—are used as the final aggregation result for this group of transactions. Then, the above results, along with their corresponding origin node identifier "FUND_ACCT_0001" and destination node identifier "CONS_ACCT_A001," are passed to the next processing module responsible for constructing the intent stream transmission channel.

[0064] Step S127: Use the aggregated composite purpose intention transmission direction and the aggregated composite purpose intention transmission strength as the final purpose intention transmission direction attribute and final purpose intention transmission strength attribute of the intention flow transmission channel between the corresponding intention flow starting node identifier and intention flow arriving node identifier, and generate multiple intention flow transmission channels.

[0065] The intent stream transmission channel construction module receives data from step S1269. For each pair (originating node, arriving node), such as ("FUND_ACCT_0001", "CONS_ACCT_A001"), this module creates a new channel object. The attributes of this channel object include: the source node is set to "FUND_ACCT_0001", the destination node is set to "CONS_ACCT_A001", the end-use intent transmission direction attribute is set to the normalized direction vector provided in step S1269, and the end-use intent transmission strength attribute is set to the normalized strength value provided in step S1269. This operation is performed on all (originating node, arriving node) pairs with historical transaction records, thus generating a large set of intent stream transmission channels with strength and direction attributes. For example, there might also be another channel from "FUND_ACCT_0002" to "CONS_ACCT_B005", whose direction attribute is the direction corresponding to "medical use level" and its strength attribute is the value corresponding to "medium strength level".

[0066] Step S128: Using the account identifiers of all the welfare fund special accounts as the intention flow origin node identifier set, the account identifiers of all the welfare consumption general accounts as the intention flow arrival node identifier set, and the generated multiple intention flow transmission channels as vector channels connecting the intention flow origin node identifier set and the intention flow arrival node identifier set, an initial historical purpose intention flow distribution network is constructed.

[0067] Construct a graph-structured data model. The nodes of the graph consist of two parts: one part represents the identifiers of all welfare fund-specific accounts, which constitute the set of intention flow outflow nodes; the other part represents the identifiers of all welfare consumption-general accounts, which constitute the set of intention flow arrival nodes. The edges of the graph represent all intention flow transmission channels generated in step S127. Each channel is a directed edge, pointing from its source node to its destination node, and carries two attributes: direction (vector) and strength (scalar). Combining all these nodes and edges forms an initial historical usage intention flow distribution network. This network can be stored in a graph database, for example, represented as an adjacency list, where each node records a list of outgoing and incoming edges connected to it.

[0068] Step S129: Perform channel smoothing processing on each intent stream transmission channel in the initial historical use intent stream distribution network, and perform interpolation fitting on the geometry of the intent stream transmission channel according to the intermediate node identifier sequence of the use migration path traversed by each intent stream transmission channel to generate a smoothed intent stream transmission channel trajectory.

[0069] The edges in the initial network described above are straight lines pointing directly from the starting node to the destination node, which cannot reflect the specific conversion path of funds in the semantic space of fund use. Therefore, it is necessary to refine and smooth each channel by utilizing the intermediate node information in the initial use migration path identifier string generated in step S123. For the channel connecting the starting node "FUND_ACCT_0001" and the destination node "CONS_ACCT_A001", retrieve the initial use migration path identifier strings of all historical transactions corresponding to this channel. For example, one path string is ["FUND_ACCT_0001", "FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", "SCENE_MERCHANT_001_BOOKSTORE", "CONS_ACCT_A001"]. Channel smoothing treats the aforementioned intermediate nodes (such as "FUND_PURPOSE_EDUCATION", "PURPOSE_CULTURE_CONSUME", and "SCENE_MERCHANT_001_BOOKSTORE") as key "waypoints" on the path. An interpolation fitting algorithm, such as Bézier curve fitting or spline interpolation, generates a smooth curve that sequentially passes through the starting node, these intermediate nodes (arranged in the order they appear in most transactions), and the final destination node. In this way, the original straight lines are replaced with a smooth trajectory that reflects the actual migration process. This smooth trajectory itself is a sequence of multiple interpolated point coordinates, and its geometry reflects the intended transformation process.

[0070] Step S1210: Integrate all smoothed intent stream transmission channel trajectories and their corresponding end-use intent transmission direction attributes and end-use intent transmission strength attributes to generate the historical use intent stream distribution network. Each node identifier in the historical use intent stream distribution network corresponds to an account identifier or an intermediate use semantic node identifier, and each channel trajectory corresponds to an intent stream transmission channel.

[0071] After the smoothing process in step S129, all nodes in the network and all smoothed channel trajectories are integrated. At this point, the network nodes are no longer just the account identifiers at both ends, but also include the identifiers of various intermediate purpose semantic nodes appearing in the smoothed trajectories (such as "FUND_PURPOSE_EDUCATION", "SCENE_MERCHANT_001_BOOKSTORE", etc.). These intermediate nodes also become part of the network, and they are interconnected through the channel trajectories. The channel trajectories explicitly connect the starting node, intermediate nodes, and the destination node. Thus, a complete and complex network structure—the Historical Purpose Intent Flow Distribution Network—containing the source of fund flow, purpose semantic conversion nodes, and the final consumption account, is constructed. This network is persistently stored as a benchmark reference for subsequent real-time monitoring.

[0072] Step S130: Inject each current cross-account transaction in the current cross-account transaction record stream within the current monitoring time window into the historical purpose intent flow distribution network. Perform intent flow channel occupancy analysis on each current cross-account transaction to generate a purpose intent flow occupancy trace for each current cross-account transaction. The purpose intent flow occupancy trace includes the intent flow starting node identifier, the intent flow transmission channel identifier, and the intent flow arrival node identifier that the current cross-account transaction occupies in the historical purpose intent flow distribution network.

[0073] After the historical network is built, the real-time monitoring phase begins. A current monitoring time window is set, such as "the past 5 minutes". The system continuously consumes the cross-account transaction record stream within the current time window from the transaction message queue pushed in real time by the welfare payment gateway, and performs real-time analysis on each new transaction.

[0074] Step S131: Receive the current cross-account transaction record stream within the current monitoring time window collected in real time. The current cross-account transaction record stream contains multiple current cross-account transaction records. Each current cross-account transaction record contains the current transaction initiation time, the current transaction amount, the current transaction initiating account identifier, the current transaction receiving account identifier, and the current transaction occurrence scenario identifier.

[0075] Subscribe to and consume the current cross-account transaction log stream from a topic in a high-throughput message queue (such as Apache Kafka). Each message body is a structured data object with fields similar to historical transaction records, including: the current transaction initiation time (e.g., "2024-03-15 14:35:22.123"), the current transaction amount (e.g., "3000" cents), the current transaction initiating account identifier (e.g., "FUND_ACCT_0001"), the current transaction receiving account identifier (e.g., "CONS_ACCT_A001"), and the current transaction occurrence scenario identifier (e.g., "SCENE_MERCHANT_003_PHARMACY"). These records are pushed to the queue in real time as transactions occur.

[0076] Step S132: For each current cross-account transaction record in the current cross-account transaction record stream, parse the current transaction initiating account identifier, and search the historical purpose intent flow distribution network according to the current transaction initiating account identifier to find the intent flow starting node identifier that completely matches the current transaction initiating account identifier, and determine the intent flow starting node identifier as the intent flow starting node identifier occupied by the current cross-account transaction.

[0077] For each consumed transaction, such as transaction T_now, its "current transaction initiating account identifier" is first parsed as "FUND_ACCT_0001". Then, using this identifier as a query condition, a search is performed in the node index of the historical purpose intent stream distribution network, which has been built and loaded into memory. Since the nodes in the historical network contain all welfare fund dedicated account identifiers, the search can quickly locate the node with an exact match. If found, the node (i.e., "FUND_ACCT_0001") is identified as the originating node of the intent stream used by this real-time transaction. If not found, an unknown source exception handling process is triggered.

[0078] Step S133: Parse the current transaction receiving account identifier of the same current cross-account transaction record, and search the historical purpose intent flow distribution network for an intent flow arrival node identifier that completely matches the current transaction receiving account identifier, and determine the intent flow arrival node identifier as the intent flow arrival node identifier triggered by the current cross-account transaction.

[0079] Similarly, the "current transaction receiving account identifier" of transaction T_now is parsed as "CONS_ACCT_A001". This identifier is then searched for in the node index of the historical network. If found, the node is identified as the node from which the intent flow triggered by this transaction arrived. If not found, the unknown target exception handling process is triggered.

[0080] Step S134: Parse the current transaction occurrence scenario identifier of the same current cross-account transaction record, and search the historical use intent flow distribution network for an intermediate use semantic node identifier that completely matches the current transaction occurrence scenario identifier, and determine the intermediate use semantic node identifier as the use point identifier of the current cross-account transaction on the intent flow transmission channel.

[0081] Next, the "current transaction scenario identifier" of transaction T_now is parsed as "SCENE_MERCHANT_003_PHARMACY". In the historical purpose intent flow distribution network, there are not only account nodes but also a large number of intermediate purpose semantic nodes, such as nodes representing various consumption scenarios. The network is searched for the existence of a node identified as "SCENE_MERCHANT_003_PHARMACY". If found, this node is identified as the occupancy point of this transaction on the intent flow transmission channel; that is, the transaction must pass through this semantic node to reach the final account. If not found, the unknown scenario exception handling process is triggered.

[0082] Step S135: Based on the intent flow originating node identifier and the intent flow arriving node identifier, search for all candidate intent flow transmission channels that connect the intent flow originating node identifier and the intent flow arriving node identifier in the historical use intent flow distribution network, and generate a candidate intent flow transmission channel identifier list.

[0083] Given a starting node "FUND_ACCT_0001" and an ending node "CONS_ACCT_A001", the historical intent stream distribution network is queried to find all smooth channel trajectories starting from "FUND_ACCT_0001" and ending at "CONS_ACCT_A001". Each trajectory has a unique channel identifier. The network graph database executes a query, returning all channel identifiers that meet the criteria, generating a list, for example, ["CHANNEL_ID_001", "CHANNEL_ID_002", "CHANNEL_ID_003"]. These are the candidate intent stream transmission channel identifiers.

[0084] Step S136: The occupation point identifier is compared with the intermediate semantic node identifier sequence of each candidate intent flow transmission channel in the candidate intent flow transmission channel identifier list. If the intermediate semantic node identifier sequence of a candidate intent flow transmission channel contains the occupation point identifier, then the channel identifier of the candidate intent flow transmission channel is determined as the intent flow transmission channel identifier used in the current cross-account transaction.

[0085] Obtain the occupied trajectory identifier “SCENE_MERCHANT_003_PHARMACY” determined in step S134. Iterate through each channel in the candidate channel identifier list generated in step S135. For channel “CHANNEL_ID_001”, retrieve the intermediate purpose semantic node identifier sequence traversed by its corresponding smooth trajectory from the network database, for example, [“FUND_PURPOSE_EDUCATION”, “SCENE_MERCHANT_001_BOOKSTORE”]. Check if this sequence contains “SCENE_MERCHANT_003_PHARMACY”. It obviously does not, so it is excluded. Continue iterating through the next channel “CHANNEL_ID_002”, whose sequence is [“FUND_PURPOSE_MEDICAL”, “SCENE_MERCHANT_003_PHARMACY”]. The sequence contains “SCENE_MERCHANT_003_PHARMACY”, therefore, the channel “CHANNEL_ID_002” is preliminarily identified as the intent stream transmission channel identifier used in this transaction.

[0086] Step S137: If multiple candidate intent stream transmission channel identifier sequences in the candidate intent stream transmission channel identifier list all contain the usage semantic node identifier, then based on the final usage intent transmission strength attribute of each candidate intent stream transmission channel and the current transaction amount of the current cross-account transaction, select the only intent stream transmission channel identifier that best matches the current transaction amount from the multiple candidate intent stream transmission channels as the final intent stream transmission channel identifier.

[0087] If, after comparison in step S136, multiple channels (e.g., “CHANNEL_ID_002” and “CHANNEL_ID_004”) are found to contain “SCENE_MERCHANT_003_PHARMACY”, further filtering is required.

[0088] For example, step S1371: obtain the candidate intent stream transmission channel identifier list, each candidate intent stream transmission channel identifier in the candidate intent stream transmission channel identifier list corresponds to a candidate intent stream transmission channel, and each candidate intent stream transmission channel has its corresponding final purpose intent transmission strength attribute and its intermediate purpose semantic node identifier sequence.

[0089] At this point, the list of candidate channel identifiers to be processed has been updated to ["CHANNEL_ID_002", "CHANNEL_ID_004"]. The intended use of these two channels, which are to transmit intensity attributes, is retrieved from the database; for example, the intensity attribute of channel "CHANNEL_ID_002" is 0.65, and the intensity attribute of channel "CHANNEL_ID_004" is 0.90.

[0090] Step S1372: Remove candidate intent stream transmission channel identifiers from the candidate intent stream transmission channel identifier list that do not contain the usage point identifier in the intermediate purpose semantic node identifier sequence, and obtain an updated candidate intent stream transmission channel identifier list.

[0091] This step has been implicitly completed in step S136. The current list has removed channels that do not contain the occupying channel identifier, and the resulting list contains the identifier.

[0092] Step S1373: Analyze the current transaction amount of the current cross-account transaction, match the current transaction amount with multiple amount ranges in the preset amount range division rule base, and determine the amount range level label to which the current transaction amount belongs.

[0093] The current transaction amount of transaction T_now is "3000" (cents). The system queries a pre-defined rule base for classifying transaction amounts into several consecutive intervals. For example, (0, 1000] is classified as a "small amount interval," (1000, 5000] as a "medium amount interval," and (5000, +∞) as a "large amount interval." The current amount of 3000 falls within the (1000, 5000) interval; therefore, its transaction amount interval is classified as "medium amount interval."

[0094] Step S1374: Traverse each candidate intent stream transmission channel identifier in the updated candidate intent stream transmission channel identifier list, obtain the end-use intent transmission strength attribute corresponding to each candidate intent stream transmission channel identifier, map the end-use intent transmission strength attribute to multiple strength attribute intervals in the preset strength attribute interval division rule base, and determine the strength attribute interval level label corresponding to each candidate intent stream transmission channel identifier.

[0095] For channel "CHANNEL_ID_002", its intensity attribute is 0.65. The preset intensity attribute range division rule library is as follows: (0, 0.3] is the "low intensity range", (0.3, 0.7] is the "medium intensity range", and (0.7, 1.0] is the "high intensity range". 0.65 falls into the (0.3, 0.7] range, therefore its intensity attribute range level label is "medium intensity range". For channel "CHANNEL_ID_004", its intensity attribute is 0.90, falling into the (0.7, 1.0] range, therefore its intensity attribute range level label is "high intensity range".

[0096] Step S1375: Compare the intensity attribute interval level label corresponding to each candidate intent stream transmission channel identifier with the fund amount interval level label of the current transaction fund amount one by one, and calculate the absolute value of the level difference between the intensity attribute interval level label corresponding to each candidate intent stream transmission channel identifier and the fund amount interval level label.

[0097] The level labels are quantified; for example, "small amount range / low intensity range" is quantified as 1, "medium amount range / medium intensity range" as 2, and "large amount range / high intensity range" as 3. For channel "CHANNEL_ID_002", its intensity level is quantified as 2, its amount level is quantified as 2, and the absolute value of the level difference is |2-2|=0. For channel "CHANNEL_ID_004", its intensity level is quantified as 3, its amount level is quantified as 2, and the absolute value of the level difference is |3-2|=1.

[0098] Step S1376: Select the candidate intent stream transmission channel identifier with the smallest absolute value of the level difference as the candidate intent stream transmission channel identifier with the highest degree of matching with the current transaction amount.

[0099] Compare the absolute values ​​of the grade difference between the two channels: channel "CHANNEL_ID_002" is 0, which is less than channel "CHANNEL_ID_004" is 1. Therefore, channel "CHANNEL_ID_002" with the smallest absolute value of grade difference is selected as the candidate channel with the highest matching degree.

[0100] Step S1377: If multiple candidate intent stream transmission channel identifiers have the same absolute value of grade difference and are all minimum values, then further compare the degree of closeness between the specific value of the final purpose intent transmission strength attribute of the candidate intent stream transmission channel identifier and the specific value of the current transaction amount.

[0101] This step was not triggered in the current scenario because there is only one minimum value. However, if the absolute value of the difference between the levels of two channels is 0, for example, if they both correspond to the "medium intensity range", then further comparison is required. During the comparison, you can calculate the ratio between the intensity attribute value of each channel and the standardized value of the current trading capital amount, or calculate the absolute value of the difference between the two, and select the channel with the smallest difference or the ratio closest to 1.

[0102] Step S1378: Output the final intent stream transmission channel identifier and record the correlation between the corresponding selection result and the current transaction amount.

[0103] After screening, "CHANNEL_ID_002" was ultimately determined to be the intent stream transmission channel identifier used by transaction T_now. This selection result (transaction ID, channel ID) was recorded in a link log for subsequent auditing and analysis.

[0104] Step S1379: If, during the traversal, it is found that no candidate intent stream transmission channel identifier's intensity attribute interval level label can match the fund amount interval level label, then the channel matching anomaly handling process is triggered, and the interval boundaries of the fund amount interval division rule base or the intensity attribute interval division rule base are readjusted.

[0105] This step serves as a fallback for exception handling, ensuring the robustness of the algorithm. If, after traversing all candidate channels, the absolute value of the difference between the intensity range level and the funding amount range level for all channels is found to be very large (e.g., all exceeding a certain threshold), then the current classification rule is considered potentially unreasonable, triggering a background process to automatically or semi-automatically adjust the range boundaries in the rule base to adapt to the new data distribution.

[0106] Step S138: Combine the intent flow originating node identifier, the final retained intent flow transmission channel identifier, and the intent flow arrival node identifier according to the time sequence of the current transaction initiation time to generate the initial purpose intent flow occupancy trace triplet corresponding to the current cross-account transaction.

[0107] For transaction T_now, the intention flow originating node identifier "FUND_ACCT_0001" determined in step S132, the final retained intention flow transmission channel identifier "CHANNEL_ID_002" determined in step S137, and the intention flow arriving node identifier "CONS_ACCT_A001" determined in step S133 are combined into a triplet data object according to the logical order of "originating node -> retained channel -> arriving node": (originating node: "FUND_ACCT_0001", retained channel: "CHANNEL_ID_002", arriving node: "CONS_ACCT_A001"). This triplet is the core "occupancy trace" left by this transaction in the current intention flow network.

[0108] Step S139: Append the current transaction amount and the current transaction initiation time of the current cross-account transaction to the initial purpose intent flow occupancy trace triplet to generate a complete purpose intent flow occupancy trace data packet.

[0109] To enrich the information content of the trace, the current transaction amount of transaction T_now, "3000" points, and the current transaction initiation time, "2024-03-15 14:35:22.123", are added as additional attributes to the triple generated in step S138. This forms a complete purpose intent flow occupancy trace data packet containing time, amount, and path information. The data structure of this purpose intent flow occupancy trace data packet can be represented in JSON format: {"Trace ID": "TRACE_001", "Starting Node": "FUND_ACCT_0001", "Continued Channel": "CHANNEL_ID_002", "Arrival Node": "CONS_ACCT_A001", "Amount": 3000, "Timestamp": "2024-03-15 14:35:22.123"}.

[0110] Step S1310: The generated usage intent flow occupancy trace data packet is temporarily stored in the trace buffer corresponding to the current monitoring time window, and all usage intent flow occupancy trace data packets in the trace buffer are sorted according to the time order of the current transaction initiation time to generate a usage intent flow occupancy trace sequence.

[0111] The generated trace data packets (e.g., TRACE_001) are written to a memory-based circular buffer or ordered set associated with the current monitoring time window (e.g., "14:30-14:35"). Whenever a new trace data packet is generated, it is inserted into this buffer and sorted according to its "timestamp" field. At the end of a time window, a strictly chronological sequence of usage intent flow occupancy traces is formed within this buffer. This sequence represents how each welfare payment transaction "occupies" the historically formed intent flow network within that 5-minute window.

[0112] Step S140: Perform trace overlay and aggregation processing on all usage intent flow occupancy traces generated within the current monitoring time window to construct a real-time usage intent flow aggregation graph corresponding to the current monitoring time window. The real-time usage intent flow aggregation graph includes multiple intent flow aggregation nodes and multiple intent flow aggregation channels.

[0113] At the end of the current monitoring time window (e.g., 14:30-14:35), the usage intent flow occupancy trace sequence generated in step S1310 within this window is aggregated and analyzed to construct a real-time usage intent flow convergence map that can visualize the "heat" and "concentration" of fund flows within this time period.

[0114] Step S141: Extract the intent flow originating node identifier, the final used intent flow transmission channel identifier, and the intent flow arrival node identifier contained in each intent flow occupancy trace data packet in the intent flow occupancy trace sequence.

[0115] Traverse the trace sequence generated in step S1310. For each trace data packet in the sequence (e.g., TRACE_001), parse out three core elements: the starting node identifier "FUND_ACCT_0001", the channel identifier "CHANNEL_ID_002", and the destination node identifier "CONS_ACCT_A001".

[0116] Step S142: Using the originating node of the intent flow as the source node of the convergence graph, the destination node of the intent flow as the destination node of the convergence graph, and the final used intent flow transmission channel as the initial convergence channel connecting the source node and the destination node, construct the node connection relationship of the initial real-time purpose intent flow convergence graph.

[0117] Create a new empty graph data structure as the initial convergence graph for real-time intended use. For each (origin node, traversal channel, destination node) triple parsed from the trace sequence, perform the following operations in the graph: if the origin node identifier (e.g., "FUND_ACCT_0001") does not yet exist in the graph, add it as a source node; if the destination node identifier (e.g., "CONS_ACCT_A001") does not yet exist, add it as a destination node; then, add an edge from the source node to the destination node, using the traversal channel identifier (e.g., "CHANNEL_ID_002") as the initial identifier for this edge. In this way, after traversing all traces, a basic graph structure is constructed, containing all nodes active within the window and their original connections.

[0118] Step S143: Count the total number of times each intent flow originating node identifier appears in the intent flow occupancy trace sequence, use the total number of times as the outflow trace frequency attribute of the corresponding source node, and attach the outflow trace frequency attribute to the corresponding source node in the initial real-time intent flow aggregation graph.

[0119] While constructing the connections, the trace sequences are statistically counted. For example, a hash table is created where the key is the source node identifier and the value is the occurrence count. The trace sequence is traversed, and for each trace's originating node identifier, its corresponding count in the hash table is incremented by 1. After traversal, the total occurrence count of each source node is obtained. For example, if the node "FUND_ACCT_0001" appears 50 times within the window, its outflow trace frequency attribute is 50. This attribute value is then appended to the corresponding source node in the graph.

[0120] Step S144: Count the total number of times each intent flow arrival node identifier appears in the intent flow occupancy trace sequence, use the total number of times as the inflow trace frequency attribute of the corresponding destination node, and attach the inflow trace frequency attribute to the corresponding destination node in the initial real-time intent flow aggregation graph.

[0121] Similarly, another hash table is created, with the key being the destination node identifier and the value being the occurrence count. The trace sequence is traversed, and for each trace's destination node identifier, its count is incremented. For example, if node "CONS_ACCT_A001" appears 40 times within the window, its inflow trace frequency attribute is 40. This attribute value is then appended to the corresponding destination node in the graph.

[0122] Step S145: Count the total number of times each of the final used intent stream transmission channel identifiers is selected in the intent stream occupancy trace sequence, use the total number of times as the channel occupancy frequency attribute of the corresponding initial convergence channel, and attach the channel occupancy frequency attribute to the corresponding initial convergence channel in the initial real-time intent stream convergence graph.

[0123] Rebuild the hash table, with the key being the channel identifier (e.g., "CHANNEL_ID_002") and the value being the number of times it was selected. Traverse the trace sequence, and for each trace's used channel identifier, increment its count. For example, if channel "CHANNEL_ID_002" was selected 30 times within the window, its channel occupancy frequency attribute is 30. Append this attribute value to the corresponding edge in the graph.

[0124] Step S146: Perform channel merging processing on multiple initial convergence channels with the same source node and the same destination node in the initial real-time purpose intent flow convergence graph, and accumulate the channel occupancy frequency attributes of multiple initial convergence channels to generate a merged convergence channel and its merged channel occupancy frequency attribute.

[0125] In the initial graph, there may be multiple edges from the same source node to the same destination node, each representing a different historical path (for example, "CHANNEL_ID_002" and "CHANNEL_ID_004" both go from "FUND_ACCT_0001" to "CONS_ACCT_A001"). These edges need to be merged.

[0126] For example, step S1461: parse the initial real-time purpose intent flow convergence graph, extract the channel identifiers of all initial convergence channels in the initial real-time purpose intent flow convergence graph, and the channel identifier of each initial convergence channel is composed of the source node identifier and the destination node identifier of the initial convergence channel.

[0127] Traverse all edges in the initial graph. For each edge, resolve its source and destination nodes. For example, for edge E1, its source node is "FUND_ACCT_0001", its destination node is "CONS_ACCT_A001", and its channel identifier is "CHANNEL_ID_002". For edge E2, its source node is also "FUND_ACCT_0001", its destination node is also "CONS_ACCT_A001", and its channel identifier is "CHANNEL_ID_004". The (source, destination) node pairs of the two edges are the same.

[0128] Step S1462: Group the channel identifiers of all initial aggregation channels, and group the initial aggregation channels with the same source node identifier and the same destination node identifier into the same channel group to obtain multiple channel groups.

[0129] All edges are grouped using (source node, destination node) pairs as the grouping key. Edges E1 and E2 share the same grouping key ("FUND_ACCT_0001", "CONS_ACCT_A001"), and are therefore grouped into the same channel group. Other edges with different node pairs are grouped into their respective groups.

[0130] Step S1463: Traverse each channel group, count the total number of initial convergence channels contained in the channel group, and sum the channel occupancy frequency attributes of all initial convergence channels in the channel group to obtain the sum of the cumulative channel occupancy frequencies of the channel group.

[0131] For the group ("FUND_ACCT_0001", "CONS_ACCT_A001"), there are two edges: the channel occupancy frequency attribute of edge E1 is 30, and the channel occupancy frequency attribute of edge E2 is 15. Summing these two frequencies, the total cumulative channel occupancy frequency of this group is 30 + 15 = 45.

[0132] Step S1464: For each channel group, select one channel from the multiple initial convergence channels of the channel group as the representative channel of the channel group. The selection rule is to prioritize the initial convergence channel with the highest channel occupancy frequency attribute in the channel group as the representative channel.

[0133] Within the group, the frequency attributes of each edge are compared. Edge E1 has a frequency of 30, which is higher than that of edge E2 (15). Therefore, the channel represented by edge E1 is selected as the representative channel for this group. The representative channel retains its original channel identifier "CHANNEL_ID_002" and other metadata.

[0134] Step S1465: Determine the source node identifier and destination node identifier of the representative channel as the source node identifier and destination node identifier of the merged convergence channel.

[0135] The merged aggregation channel has source and destination nodes that are the grouped node pairs, namely "FUND_ACCT_0001" and "CONS_ACCT_A001".

[0136] Step S1466: The sum of the accumulated channel occupancy frequencies is used as the merged channel occupancy frequency attribute of the merged convergence channel and attached to the original attribute of the representative channel.

[0137] The cumulative sum of 45 calculated in step S1463 is used as the new "merged channel occupancy frequency attribute" and appended to the representative channel (i.e., the edge containing "CHANNEL_ID_002"). This edge now carries the original frequency of 30 and the merged frequency of 45, or you can directly replace the original frequency with 45.

[0138] Step S1467: Delete all other initial convergence channels in the channel group except for the representative channel, and retain only the representative channel as the unique convergence channel corresponding to the channel group.

[0139] From the initial real-time intended flow convergence graph, remove edge E2 (representing an edge other than the channel). Only retain edge E1 (representing the channel) as the sole convergence channel connecting the source node "FUND_ACCT_0001" and the destination node "CONS_ACCT_A001".

[0140] Step S1468: Integrate all the retained representative channels and their additional merged channel occupancy frequency attributes to generate a merged aggregation channel set.

[0141] After performing the above operations on all groups, the original multiple parallel edges in the graph are merged into one. All the remaining representative channels (i.e., the unique edge for each group) and their latest "merged channel occupancy frequency attribute" are integrated together to form a new, streamlined set of convergence channels.

[0142] Step S1469: Based on the frequency of occupancy of the merged channel, re-render the channel width of each convergence channel in the merged convergence channel set. The higher the frequency of occupancy of the merged channel, the larger the visual width of the corresponding convergence channel.

[0143] For visual visualization, a visual width value is calculated for each converged channel based on its "merged channel occupancy frequency attribute" value. For example, the minimum width is defined as 1 pixel, and the maximum width as 20 pixels. The largest frequency attribute value among all channels is found to be MAX_FREQ=100, and the smallest is MIN_FREQ=1. For the channel with a current frequency of 45, its visual width can be calculated as: Width = 1 + (45 - MIN_FREQ) * (20 - 1) / (MAX_FREQ - MIN_FREQ). After calculating the width, this value is appended to the channel as a rendering attribute.

[0144] Step S14610: Embed the merged channel set after re-rendering into the initial real-time use intent flow convergence graph, replacing the original initial convergence channel, to obtain the real-time use intent flow convergence graph after channel merging.

[0145] The merged convergence channel set and its rendering attributes obtained in step S1468 are used to replace all the original initial convergence channels in the initial graph. At this point, the number of nodes and edges in the graph is greatly reduced, but the core flow information is preserved and enhanced.

[0146] Step S147: Render the node size of each source node according to the outflow trace frequency attribute of each source node. The higher the outflow trace frequency attribute, the larger the visual node radius of the corresponding source node in the real-time intended flow convergence graph.

[0147] Similar to channel rendering, a visualization radius is calculated for each source node based on its "outflow trace frequency attribute" value. Using the same Min-Max mapping method, the frequency attribute is mapped to a preset radius range (e.g., 5 pixels to 50 pixels). The calculated radius value is then appended to the source node as a rendering attribute.

[0148] Step S148: Render the node color depth of each destination node according to the frequency attribute of the inflow trace of each destination node. The higher the frequency attribute of the inflow trace, the darker the visual node color of the corresponding destination node in the real-time purpose intent flow convergence graph.

[0149] For each destination node, a color depth value is calculated based on its "inflow trace frequency attribute" value. Color depth can be represented by a component of the RGB color model, for example, the depth of blue ranges from light blue (low frequency) to dark blue (high frequency). Similarly, a Min-Max mapping is used to map the frequency attribute to a preset range of color component values ​​(e.g., 0 to 255). The calculated color depth value is then appended to the destination node as a rendering attribute.

[0150] Step S149: The initial real-time purpose intent flow convergence graph after completing node size rendering, node color depth rendering, and channel width rendering is determined as the real-time purpose intent flow convergence graph. Each source node and each destination node in the real-time purpose intent flow convergence graph are intent flow convergence nodes, and each merged convergence channel is an intent flow convergence channel.

[0151] After all the rendering steps described above, the final graph structure data, along with the rendering attributes of all its nodes and edges, is determined as the real-time purpose intent flow convergence graph for the current monitoring time window. All nodes in the graph (whether source or destination nodes) are called intent flow convergence nodes, and all merged edges are called intent flow convergence channels. This graph visually shows which dedicated accounts (large nodes) saw the most fund outflows (larger nodes) in the past 5 minutes, which general accounts received the most funds (darker colors), and which historical paths were frequently used (wider channels).

[0152] Step S1410: Store the real-time usage intent flow aggregation graph to the real-time monitoring graph database, and associate the start and end times of the current monitoring time window corresponding to the generation of the real-time usage intent flow aggregation graph.

[0153] The constructed real-time usage intent flow aggregation graph is stored as a graph data object in a dedicated graph database for storing real-time monitoring results. Simultaneously, the start time "2024-03-15 14:30:00" and end time "2024-03-15 14:35:00" of the monitoring time window corresponding to this graph are stored as metadata associated with the graph object for subsequent querying and backtracking by time range.

[0154] Step S150: Identify the abnormal aggregation clusters of purpose intention flows in the set of welfare fund special accounts and the set of welfare consumption general accounts according to the intent flow aggregation nodes in the real-time purpose intention flow aggregation graph, and generate a purpose intention flow source tracing and blocking instruction for the set of welfare fund special accounts and a purpose intention flow exit flow restriction instruction for the set of welfare consumption general accounts based on the abnormal aggregation clusters of purpose intention flows.

[0155] After constructing the real-time convergence graph, it is analyzed to identify any abnormal fund convergence patterns and generate corresponding risk control instructions accordingly.

[0156] Step S151: Parse the real-time purpose intent flow convergence graph and extract the node identifiers of all intent flow convergence nodes in the real-time purpose intent flow convergence graph. The node identifiers include the welfare fund special account identifier as the source node and the welfare consumption general account identifier as the destination node.

[0157] From the real-time aggregation graph generated in step S149, extract the identifiers of all nodes. Based on the node type, they are divided into two categories: one category is the source node, which is the source of fund outflow, and its identifier is the welfare fund special account identifier, such as "FUND_ACCT_0001" and "FUND_ACCT_0002"; the other category is the destination node, which is the destination of fund inflow, and its identifier is the welfare consumption general account identifier, such as "CONS_ACCT_A001" and "CONS_ACCT_B005".

[0158] Step S152: Traverse all welfare fund special account identifiers that serve as source nodes, obtain the outflow trace frequency attribute of each source node, compare the outflow trace frequency attribute of each source node with the preset source node outflow trace frequency threshold, and mark the source nodes whose outflow trace frequency attribute exceeds the source node outflow trace frequency threshold as high-frequency outflow source nodes.

[0159] Iterate through all source nodes and read their "Outflow Trace Frequency Attribute" value from their attributes. For example, the frequency of node "FUND_ACCT_0001" is 50, and the frequency of node "FUND_ACCT_0002" is 5. Query the preset source node outflow trace frequency threshold. This threshold may be a dynamically adjusted value, calculated, for example, based on the average outflow frequency of historical windows plus three standard deviations; here, we assume it to be 30. Compare the frequency of each source node with the threshold 30. Node "FUND_ACCT_0001" has a value of 50, which is greater than 30, and is therefore marked as a high-frequency outflow source node. Node "FUND_ACCT_0002" has a value of 5, which is less than 30, and is not marked.

[0160] Step S153: Traverse all welfare consumption general account identifiers that serve as destination nodes, obtain the inflow trace frequency attribute of each destination node, compare the inflow trace frequency attribute of each destination node with the preset destination node inflow trace frequency threshold, and mark the destination nodes whose inflow trace frequency attribute exceeds the destination node inflow trace frequency threshold as high-frequency inflow destination nodes.

[0161] Similarly, iterate through all destination nodes and read their "inflow trace frequency attribute" value. For example, the frequency of node "CONS_ACCT_A001" is 40, and the frequency of node "CONS_ACCT_B005" is 25. Query the preset threshold for the inflow trace frequency of destination nodes, assuming it is 20. Compare the frequency of each destination node with the threshold 20. Node "CONS_ACCT_A001" has a frequency of 40, which is greater than 20, and is marked as a high-frequency inflow destination node. Node "CONS_ACCT_B005" also has a frequency of 25, which is greater than 20, and is similarly marked as a high-frequency inflow destination node.

[0162] Step S154: Perform source node clustering analysis on all marked high-frequency outflow source nodes. Based on the channel occupancy frequency attribute of the convergence channel connecting the high-frequency outflow source nodes in the real-time purpose intent flow convergence graph, divide multiple high-frequency outflow source nodes whose channel occupancy frequency attribute exceeds the preset channel clustering frequency threshold and have direct convergence channel connection relationships into the same source node abnormal convergence cluster.

[0163] Cluster analysis is performed on the high-frequency outflow source nodes (e.g., “FUND_ACCT_0001”, “FUND_ACCT_0003”, “FUND_ACCT_0005”) marked in step S152. The clustering algorithm is based on the graph structure: First, it checks whether there are direct convergence channel connections between these nodes. In a real-time convergence graph, nodes are usually indirectly connected through destination nodes, and there are no direct edges between source nodes. Therefore, the “direct convergence channel connection relationship” here refers to their common connection to one or more of the same high-frequency inflow destination nodes. The algorithm traverses all marked source nodes. For each pair of source nodes, it checks whether they are all connected to the same high-frequency inflow destination node through a convergence channel (and the “merged channel occupancy frequency attribute” of this channel exceeds a preset channel clustering frequency threshold, such as 10). If so, the above source nodes are grouped into the same candidate cluster. After multiple iterations of merging, several abnormal convergence clusters of source nodes are finally formed. For example, it was found that both “FUND_ACCT_0001” and “FUND_ACCT_0003” were connected to the high-frequency destination node “CONS_ACCT_A001” through a high-frequency channel (frequency > 10), so they were assigned to the same source node abnormal aggregation cluster Cluster_S_01.

[0164] Step S155: Perform cluster analysis on all marked high-frequency inflow destination nodes. Based on the channel occupancy frequency attribute of the convergence channel connecting the high-frequency inflow destination nodes in the real-time purpose intent flow convergence graph, divide multiple high-frequency inflow destination nodes whose channel occupancy frequency attribute exceeds the preset channel clustering frequency threshold and have direct convergence channel connection relationships into the same destination node abnormal convergence cluster.

[0165] Similarly, the high-frequency inflow destination nodes marked in step S153 (e.g., “CONS_ACCT_A001”, “CONS_ACCT_A002”, “CONS_ACCT_B005”) are clustered. The existence of a “direct aggregation channel connection” between these destination nodes is analyzed, i.e., whether they have all received funds from the same high-frequency outflow source node, and whether the frequency of the related channel exceeds a threshold. For example, it was found that “CONS_ACCT_A001” and “CONS_ACCT_A002” both received a large amount of funds from the high-frequency outflow source node “FUND_ACCT_0001” (channel frequency > 10), therefore they were assigned to the same destination node abnormal aggregation cluster Cluster_D_01.

[0166] Step S156: Integrate all welfare fund special account identifiers contained in each abnormal aggregation cluster of the source node to generate a list of special accounts to be traced and blocked corresponding to each abnormal aggregation cluster of the source node, and attach the average outflow trace frequency attribute and the total occupancy frequency attribute of the aggregation channel in the abnormal aggregation cluster of the source node to each list of special accounts to be traced and blocked.

[0167] For the abnormal aggregation cluster Cluster_S_01, the dedicated account identifiers it contains are ["FUND_ACCT_0001", "FUND_ACCT_0003"]. These identifiers are integrated into a list to generate a dedicated account list List_S_01 to be traced and blocked. The average outflow trace frequency attribute of this cluster is calculated: the sum of the outflow frequencies of all source nodes in the cluster is divided by the number of nodes, assumed to be (50+45) / 2=47.5. The total occupancy frequency attribute of the aggregation channels within the cluster is calculated: all aggregation channels originating from source nodes within the cluster and connected to high-frequency destination nodes are identified, and their frequencies are summed, assumed to be 85. These two calculation results (47.5 and 85) are appended as metadata to the list List_S_01.

[0168] Step S157: Integrate all welfare consumption general account identifiers contained in each abnormal aggregation cluster of the divided destination node to generate a list of general accounts to be limited for each abnormal aggregation cluster of the destination node, and attach the average inflow trace frequency attribute and the total occupancy frequency attribute of the aggregation channel in the cluster to each list of general accounts to be limited.

[0169] For the abnormal aggregation cluster Cluster_D_01, the common account identifiers it contains are [“CONS_ACCT_A001”, “CONS_ACCT_A002”]. A list of common accounts to be rate-limited, List_D_01, is generated. The average inflow trace frequency attribute of this cluster is calculated, assumed to be (40+38) / 2=39. The total occupancy frequency attribute of the aggregation channels within the cluster (the sum of the frequencies of all channels flowing into this cluster) is calculated, assumed to be 78. These two calculation results are appended to the list List_D_01.

[0170] Step S158: Based on the average outflow trace frequency attribute and total occupancy frequency attribute corresponding to each list of dedicated accounts to be traced and blocked, generate a purpose intent flow tracing and blocking instruction for each source node abnormal aggregation cluster. The purpose intent flow tracing and blocking instruction includes a list of dedicated accounts to be blocked field and an instruction effective time window field.

[0171] Step S1581: parse each list of dedicated accounts to be traced and blocked, obtain the cluster identifier of the abnormal aggregation cluster of the source node corresponding to the list of dedicated accounts to be traced and blocked, and extract the average outflow trace frequency attribute and the total occupancy frequency attribute of the aggregation channel within the cluster corresponding to the cluster identifier from the real-time purpose intent flow aggregation graph.

[0172] Parse the list List_S_01 to obtain its corresponding cluster identifier Cluster_S_01, as well as the previously attached average outflow trace frequency attribute of 47.5 and total occupancy frequency attribute of 85.

[0173] Step S1582: Input the average outflow trace frequency attribute into the preset blocking time window calculation model, and output the corresponding initial blocking time window length according to the level of the average outflow trace frequency attribute. The higher the average outflow trace frequency attribute, the longer the initial blocking time window length.

[0174] A pre-defined blocking time window calculation model is used, such as a simple linear mapping function. Taking the average outflow trace frequency attribute of 47.5 as input, an initial blocking time window length, such as 480 minutes (8 hours), is calculated based on the model parameters. This model might be defined as: Initial window length = Base window + (Average frequency - Base frequency) * Time coefficient.

[0175] Step S1583: Use the total occupancy frequency attribute as a weighting coefficient to perform weighted correction on the initial blocking time window length, and generate the final blocking time window length corresponding to the abnormal aggregation cluster of the source node. The higher the total occupancy frequency attribute, the longer the final blocking time window length after weighted correction.

[0176] The total occupancy frequency attribute of 85 is used as a weighting coefficient to adjust the initial length of 480 minutes. The adjustment formula can be designed as: Final length = Initial length * (1 + Total occupancy frequency / Total frequency normalization factor). Assuming the total frequency normalization factor is 100, then the final length = 480 * (1 + 85 / 100) = 480 * 1.85 = 888 minutes. This results in a weighted, longer blocking time window.

[0177] Step S1584: Using the end time of the current monitoring time window as the blocking start time, and the time obtained by adding the final blocking time window length to the blocking start time as the blocking end time, generate the instruction effective time window corresponding to the abnormal aggregation cluster of the source node.

[0178] The current monitoring time window ends at "2024-03-15 14:35:00". This will be used as the start time of the blocking. The blocking end time = start time + 888 minutes = "2024-03-15 14:35:00" + 14 hours and 48 minutes = "2024-03-16 05:23:00". Therefore, the effective time window for the command is from "2024-03-15 14:35:00" to "2024-03-16 05:23:00".

[0179] Step S1585: Concatenate all welfare fund special account identifiers in the list of special accounts to be traced and blocked according to a preset list format to generate a string of special accounts to be blocked that conforms to the welfare fund payment gateway interface specification.

[0180] Concatenate the account identifiers ["FUND_ACCT_0001", "FUND_ACCT_0003"] in List_S_01 according to the format required by the payment gateway interface, for example, by separating them with commas, to generate the string "FUND_ACCT_0001, FUND_ACCT_0003".

[0181] Step S1586: Combine and encapsulate the string of the list of special accounts to be blocked with the start and end times of the instruction effective time window to generate an initial purpose intent stream source tracing blocking instruction data packet for the abnormal aggregation cluster of the source node.

[0182] The list string generated in step S1585 and the effective time window (start time and end time) generated in step S1584 are encapsulated into a data structure, such as a JSON object containing three fields: {"Account List": "FUND_ACCT_0001, FUND_ACCT_0003", "Effective Start": "2024-03-15 14:35:00", "Effective End": "2024-03-16 05:23:00"}. This is the initial instruction data packet.

[0183] Step S1587: Attach an instruction type label to the initial purpose intent flow source tracing blocking instruction data packet, wherein the instruction type label is fixed as the source tracing blocking type.

[0184] In the above data packet, add a field "Instruction Type", whose value is fixed as the string "Source Tracing Blocking".

[0185] Step S1588: Append an instruction generation timestamp to the initial purpose intent flow tracing blocking instruction data packet, wherein the instruction generation timestamp is the current system time.

[0186] Add another field, "Generation Timestamp", whose value is set to the current server's system time, for example, "2024-03-15 14:35:10".

[0187] Step S1589: Encrypt the initial purpose intent stream tracing blocking instruction data packet after the additional instruction type label and instruction generation timestamp to generate the final purpose intent stream tracing blocking instruction.

[0188] The complete data packet described above is encrypted using a pre-negotiated encryption algorithm (such as AES-256) and key with the welfare payment gateway, generating a ciphertext string. This ciphertext string is the final, transmittable intent-based source blocking instruction.

[0189] Step S15810: The generated intent flow tracing blocking instruction is temporarily stored in the instruction queue to be sent, and sorted with other instructions to be sent according to the order of instruction generation timestamp.

[0190] The generated final instructions are placed into a queue of instructions to be sent. This queue is sorted according to the "generation timestamp" of the instructions to ensure that the instructions are sent sequentially in chronological order.

[0191] Step S159: Based on the average inflow trace frequency attribute and total occupancy frequency attribute corresponding to each general account list to be limited, generate a usage intent flow exit limit instruction for each abnormal aggregation cluster of the destination node. The usage intent flow exit limit instruction includes a general account list field to be limited and a limit ratio field.

[0192] Similar to step S158, but generating an outbound flow restriction instruction. First, the list of general accounts to be restricted, List_D_01, is parsed to obtain its average inflow trace frequency attribute 39 and total occupancy frequency attribute 78. Then, these attributes are input into a preset flow restriction ratio calculation model, which outputs a flow restriction ratio based on the severity of the anomaly, such as 50% (meaning that in subsequent transactions, only 50% of requests will be allowed, and the rest will be rejected). Next, the list of general accounts to be restricted (such as "CONS_ACCT_A001, CONS_ACCT_A002") and the calculated flow restriction ratio (such as "50%)) are encapsulated into a data packet, and an instruction type label "outbound flow restriction" is attached, a timestamp is generated, and finally, the same encryption process is performed to generate the final purpose intent flow outbound flow restriction instruction, which is then placed in the queue to be sent.

[0193] Step S1510: Sort the generated intent flow source blocking command and intent flow exit flow limiting command according to the preset command priority rules. The command priority is determined from high to low based on the average trace frequency attribute corresponding to the list of special accounts to be blocked or the list of general accounts to be limited.

[0194] In the queue of instructions to be sent, all instructions are sorted by time. On top of this, a priority rule is applied: the average trace frequency attribute corresponding to each instruction is compared (average outflow frequency for blocking instructions, average inflow frequency for rate limiting instructions). Instructions with higher frequencies have higher processing priority. High-priority instructions are moved to the front of the queue and sent first.

[0195] Step S1511: Send the sorted purpose intent flow tracing blocking instruction and the purpose intent flow exit flow limiting instruction to the welfare payment gateway through the encrypted transmission channel, and receive the instruction execution status acknowledgment returned by the welfare payment gateway.

[0196] A command sending thread is initiated, which sequentially retrieves commands from the sorted command queue and sends them to the command receiving interface of the welfare payment gateway through a pre-established, TLS-encrypted transmission channel. After sending, the thread blocks and waits for the gateway's response. Once the gateway successfully parses and executes the command (e.g., adding a blocked account to a blacklist, or setting a rate limiter for a rate-limited account), it returns an execution status receipt containing the execution result (success / failure) and the reason.

[0197] Step S1512: Update the instruction issuance status flags of the corresponding source node abnormal aggregation cluster and destination node abnormal aggregation cluster in the real-time purpose intent flow aggregation graph according to the instruction execution status receipt.

[0198] Upon receiving the execution status receipt from the gateway, the receipt content is parsed. If execution is successful, the corresponding source node anomaly cluster (Cluster_S_01) and destination node anomaly cluster (Cluster_D_01) are located in the stored real-time purpose intent flow aggregation graph. An "instruction status" label, such as "blocked" or "rate limited," is added to each node or related edge, along with the time window information of the instruction's effective date. This status identifier is used for subsequent monitoring dashboard display and historical auditing.

[0199] In one exemplary embodiment, a cross-account transaction monitoring and risk warning system for a dual-account system is provided. This system can be a terminal, server, etc., and its internal structure diagram can be as follows: Figure 2As shown, this cross-account transaction monitoring and risk warning system for a dual-account system includes a processor, memory, input / output interface, communication interface, display unit, and input device. The processor, memory, and input / output interface are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interface. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interface is used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, near-field communication, or other technologies. When the computer program is executed by the processor, it implements a cross-account transaction monitoring and risk warning method for a dual-account system. The display unit is used to form a visually visible image and can be a display screen, projection device, or virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, or a button, trackball, or touchpad set on the shell of a cross-account transaction monitoring and risk warning system for dual-account systems, or an external keyboard, touchpad, or mouse, etc.

[0200] It should be noted that, in order to simplify the description of the present invention and thus help to understand one or more embodiments of the invention, multiple features may sometimes be grouped into one embodiment, drawing or description thereof in the foregoing description of the embodiments of the present invention.

Claims

1. A method for cross-account transaction monitoring and risk warning in a dual-account system, characterized in that, The method includes: Obtain the set of historical cross-account transaction records generated by the set of special welfare fund accounts and general welfare consumption accounts of the target trade union organization within the historical monitoring period. The set of historical cross-account transaction records includes the historical transaction initiation time, historical transaction amount, historical transaction initiating account identifier, historical transaction receiving account identifier, and historical transaction occurrence scenario identifier for each historical transaction. The historical cross-account transaction record set is processed by extracting the transaction purpose intent flow to generate a historical purpose intent flow distribution network between the welfare fund special account set and the welfare consumption general account set. The historical purpose intent flow distribution network takes each welfare fund special account as the intent flow starting node, each welfare consumption general account as the intent flow ending node, and the purpose migration path of each historical transaction in the historical cross-account transaction record set as the intent flow transmission channel. Each intent flow transmission channel has a purpose intent transmission direction attribute and a purpose intent transmission strength attribute. Each current cross-account transaction in the current cross-account transaction record stream within the current monitoring time window is injected into the historical purpose intent flow distribution network. Intent flow channel occupancy analysis is performed on each current cross-account transaction to generate a purpose intent flow occupancy trace for each current cross-account transaction. The purpose intent flow occupancy trace includes the intent flow starting node identifier, the intent flow transmission channel identifier, and the intent flow arrival node identifier that the current cross-account transaction occupies in the historical purpose intent flow distribution network. All usage intent flow occupancy traces generated within the current monitoring time window are overlaid and aggregated to construct a real-time usage intent flow aggregation map corresponding to the current monitoring time window. The real-time usage intent flow aggregation map includes multiple intent flow aggregation nodes and multiple intent flow aggregation channels. Based on the intent flow aggregation nodes in the real-time intent flow aggregation graph, identify the abnormal intent flow aggregation clusters in the set of welfare fund special accounts and the set of welfare consumption general accounts, and generate intent flow tracing and blocking instructions for the set of welfare fund special accounts and intent flow exit flow restriction instructions for the set of welfare consumption general accounts based on the abnormal intent flow aggregation clusters.

2. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 1, characterized in that, The step of extracting the transaction purpose intent flow from the historical cross-account transaction record set to generate a historical purpose intent flow distribution network between the welfare fund special account set and the welfare consumption general account set includes: Traverse each historical cross-account transaction record in the historical cross-account transaction record set, extract the historical transaction initiating account identifier and the historical transaction receiving account identifier of each historical cross-account transaction record, mark each historical transaction initiating account identifier as the intent flow starting node identifier, and mark each historical transaction receiving account identifier as the intent flow arriving node identifier; Parse the historical transaction scenario identifier of each historical cross-account transaction record, and traverse the preset welfare fund purpose and consumption scenario mapping relationship library according to the historical transaction scenario identifier to determine the intermediate node identifier sequence of the purpose migration path corresponding to the historical cross-account transaction record. The intermediate node identifier sequence of the purpose migration path includes multiple intermediate purpose semantic node identifiers from the welfare fund distribution purpose tag corresponding to the historical transaction initiating account identifier to the historical transaction scenario identifier. The historical transaction initiating account identifier, the intermediate node identifier sequence of the purpose migration path, and the historical transaction receiving account identifier are concatenated in chronological order of the historical transaction initiation time to generate the initial purpose migration path identifier string corresponding to the historical cross-account transaction record. The initial purpose migration path identifier string uses the intent flow starting node identifier as the string head identifier, the intent flow arriving node identifier as the string tail identifier, and each intermediate purpose semantic node identifier in the intermediate node identifier sequence of the purpose migration path as the string middle identifier. For each historical cross-account transaction record, an initial purpose migration path identifier string is appended with a purpose intent transmission direction attribute. The purpose intent transmission direction attribute is pointed from the intention flow origin node identifier to the intention flow destination node identifier. The time freshness weight coefficient of the purpose intent transmission direction attribute is determined according to the relative time position of the historical transaction initiation time within the historical monitoring period. The historical transaction amount of each historical cross-account transaction record is analyzed. Based on the historical transaction amount, the initial purpose intent transmission strength value corresponding to the historical cross-account transaction record is calculated according to the preset mapping rules, and the initial purpose intent transmission strength value is used as the initial purpose intent transmission strength attribute of the historical cross-account transaction record. Multiple initial purpose migration path identifier strings with the same intention flow origin node identifier and the same intention flow destination node identifier are subjected to path identifier string aggregation processing. The purpose intention transmission direction attribute of multiple initial purpose migration path identifier strings is vectorized to generate the aggregated composite purpose intention transmission direction. The initial purpose intention transmission strength attribute of multiple initial purpose migration path identifier strings is accumulated to generate the aggregated composite purpose intention transmission strength. The aggregated composite purpose intent transmission direction and the aggregated composite purpose intent transmission strength are used as the final purpose intent transmission direction attribute and final purpose intent transmission strength attribute of the intent flow transmission channel between the corresponding intent flow starting node identifier and intent flow arriving node identifier, to generate multiple intent flow transmission channels. Using the account identifiers of all the aforementioned welfare fund special accounts as the intention flow origin node identifier set, and the account identifiers of all the aforementioned welfare consumption general accounts as the intention flow arrival node identifier set, and using the generated multiple intention flow transmission channels as vector channels connecting the intention flow origin node identifier set and the intention flow arrival node identifier set, an initial historical purpose intention flow distribution network is constructed. For each intent stream transmission channel in the initial historical use intent stream distribution network, channel smoothing is performed. Based on the intermediate node identifier sequence of the use migration path traversed by each intent stream transmission channel, the geometry of the intent stream transmission channel is interpolated and fitted to generate a smoothed intent stream transmission channel trajectory. The smoothed intent stream transmission channel trajectories and their corresponding end-use intent transmission direction attributes and end-use intent transmission strength attributes are integrated to generate the historical use intent stream distribution network. Each node identifier in the historical use intent stream distribution network corresponds to an account identifier or an intermediate use semantic node identifier, and each channel trajectory corresponds to an intent stream transmission channel.

3. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 1, characterized in that, The process involves injecting each current cross-account transaction in the current cross-account transaction record stream within the real-time monitoring time window into the historical purpose intent stream distribution network, performing purpose intent stream channel occupancy analysis on each current cross-account transaction, and generating a purpose intent stream occupancy trace corresponding to each current cross-account transaction, including: Receive the current cross-account transaction record stream within the current monitoring time window collected in real time. The current cross-account transaction record stream contains multiple current cross-account transaction records. Each current cross-account transaction record contains the current transaction initiation time, the current transaction amount, the current transaction initiating account identifier, the current transaction receiving account identifier, and the current transaction occurrence scenario identifier. For each current cross-account transaction record in the current cross-account transaction record stream, the current transaction initiating account identifier is parsed, and the intent flow starting node identifier that completely matches the current transaction initiating account identifier is traversed and searched in the historical purpose intent flow distribution network according to the current transaction initiating account identifier. The intent flow starting node identifier is determined as the intent flow starting node identifier occupied by the current cross-account transaction. The current transaction receiving account identifier of the same current cross-account transaction record is parsed. Based on the current transaction receiving account identifier, the intent flow arrival node identifier that completely matches the current transaction receiving account identifier is traversed and searched in the historical purpose intent flow distribution network. The intent flow arrival node identifier is determined as the intent flow arrival node identifier triggered by the current cross-account transaction. Parse the current transaction scenario identifier of the same current cross-account transaction record, and search the historical use intent flow distribution network for intermediate use semantic node identifiers that completely match the current transaction scenario identifier, and determine the intermediate use semantic node identifier as the use point identifier of the current cross-account transaction on the intent flow transmission channel. Based on the intent flow originating node identifier and the intent flow arriving node identifier, search all candidate intent flow transmission channels that connect the intent flow originating node identifier and the intent flow arriving node identifier in the historical use intent flow distribution network, and generate a candidate intent flow transmission channel identifier list. The occupation point identifier is compared with the sequence of intermediate semantic node identifiers passed by each candidate intent flow transmission channel in the candidate intent flow transmission channel identifier list. If the intermediate semantic node identifier sequence of a candidate intent flow transmission channel contains the occupation point identifier, then the channel identifier of the candidate intent flow transmission channel is determined as the intent flow transmission channel identifier used in the current cross-account transaction. If multiple candidate intent stream transmission channel identifiers in the candidate intent stream transmission channel identifier list contain the intermediate use semantic node identifier, then based on the final use intent transmission strength attribute of each candidate intent stream transmission channel and the current transaction amount of the current cross-account transaction, the only intent stream transmission channel identifier that best matches the current transaction amount is selected from the multiple candidate intent stream transmission channels as the final intent stream transmission channel identifier to be used. The intent flow originating node identifier, the final retained intent flow transmission channel identifier, and the intent flow arrival node identifier are combined in chronological order according to the current transaction initiation time to generate the initial purpose intent flow occupancy trace triplet corresponding to the current cross-account transaction. Append the current transaction amount and the current transaction initiation time of the current cross-account transaction to the initial purpose intent flow occupancy trace triple to generate a complete purpose intent flow occupancy trace data packet; The generated usage intent flow occupancy trace data packets are temporarily stored in the trace buffer corresponding to the current monitoring time window, and all usage intent flow occupancy trace data packets in the trace buffer are sorted according to the time order of the current transaction initiation time to generate a usage intent flow occupancy trace sequence.

4. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 1, characterized in that, The step of performing trace overlay and aggregation processing on all usage intent flow occupancy traces generated within the current monitoring time window to construct a real-time usage intent flow aggregation map corresponding to the current monitoring time window includes: Extract the intent flow originating node identifier, the final used intent flow transmission channel identifier, and the intent flow arrival node identifier contained in each intent flow occupancy trace data packet in the intent flow occupancy trace sequence; Using the originating node of the intent flow as the source node of the convergence graph, the destination node of the intent flow as the destination node of the convergence graph, and the final used intent flow transmission channel as the initial convergence channel connecting the source node and the destination node, the node connection relationship of the initial real-time purpose intent flow convergence graph is constructed. The total number of times each intent flow originating node identifier appears in the intent flow occupancy trace sequence is counted, and the total number of times is used as the outflow trace frequency attribute of the corresponding source node. The outflow trace frequency attribute is then appended to the corresponding source node in the initial real-time intent flow aggregation graph. The total number of times each intent flow arrival node identifier appears in the intent flow occupancy trace sequence is counted, and the total number of times is used as the inflow trace frequency attribute of the corresponding destination node. The inflow trace frequency attribute is then appended to the corresponding destination node in the initial real-time intent flow aggregation graph. The total number of times each of the final used intent stream transmission channel identifiers in the intent stream occupancy trace sequence is selected is counted, and the total number of times is used as the channel occupancy frequency attribute of the corresponding initial convergence channel. The channel occupancy frequency attribute is then appended to the corresponding initial convergence channel in the initial real-time intent stream convergence graph. Multiple initial convergence channels with the same source node and the same destination node in the initial real-time purpose intent flow convergence graph are merged. The channel occupancy frequency attributes of the multiple initial convergence channels are accumulated to generate the merged convergence channel and its merged channel occupancy frequency attribute. The channel width of each merged convergence channel is rendered based on the channel occupancy frequency attribute. The higher the channel occupancy frequency attribute, the larger the visual width of the corresponding convergence channel in the real-time application intent flow convergence graph. The node size of each source node is rendered based on the outflow trace frequency attribute of each source node. The higher the outflow trace frequency attribute, the larger the visual node radius of the corresponding source node in the real-time application intent flow convergence graph. Each destination node is rendered with node color depth based on the frequency attribute of the inflow traces. The higher the frequency attribute of the inflow traces, the darker the visual node color of the corresponding destination node in the real-time purpose intent flow convergence graph. The initial real-time purpose intent flow convergence graph after completing node size rendering, node color depth rendering, and channel width rendering is determined as the real-time purpose intent flow convergence graph. Each source node and each destination node in the real-time purpose intent flow convergence graph are intent flow convergence nodes, and each merged convergence channel is an intent flow convergence channel. The real-time usage intent flow aggregation graph is stored in the real-time monitoring graph database, and the start and end times of the current monitoring time window corresponding to the generation of the real-time usage intent flow aggregation graph are associated with it.

5. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 1, characterized in that, The step of identifying abnormal aggregation clusters of purpose intent flows in the set of welfare fund special accounts and the set of welfare consumption general accounts based on the intent flow aggregation nodes in the real-time purpose intent flow aggregation graph, and generating purpose intent flow source tracing and blocking instructions for the set of welfare fund special accounts and purpose intent flow outflow limiting instructions for the set of welfare consumption general accounts based on the abnormal aggregation clusters of purpose intent flows, includes: The real-time purpose intent flow convergence graph is parsed, and the node identifiers of all intent flow convergence nodes in the real-time purpose intent flow convergence graph are extracted. The node identifiers include the welfare fund special account identifier as the source node and the welfare consumption general account identifier as the destination node. Traverse all welfare fund special account identifiers that serve as source nodes, obtain the outflow trace frequency attribute of each source node, compare the outflow trace frequency attribute of each source node with the preset source node outflow trace frequency threshold, and mark the source nodes whose outflow trace frequency attribute exceeds the source node outflow trace frequency threshold as high-frequency outflow source nodes. Traverse all welfare consumption general account identifiers that serve as destination nodes, obtain the inflow trace frequency attribute of each destination node, compare the inflow trace frequency attribute of each destination node with the preset destination node inflow trace frequency threshold, and mark the destination nodes whose inflow trace frequency attribute exceeds the destination node inflow trace frequency threshold as high-frequency inflow destination nodes. Perform source node clustering analysis on all marked high-frequency outflow source nodes. Based on the channel occupancy frequency attribute of the convergence channel connecting the high-frequency outflow source nodes in the real-time purpose intent flow convergence graph, divide multiple high-frequency outflow source nodes whose channel occupancy frequency attribute exceeds the preset channel clustering frequency threshold and have direct convergence channel connection relationship with each other into the same source node abnormal convergence cluster. Perform cluster analysis on all marked high-frequency inflow destination nodes. Based on the channel occupancy frequency attribute of the convergence channel connecting the high-frequency inflow destination nodes in the real-time purpose intent flow convergence graph, divide multiple high-frequency inflow destination nodes whose channel occupancy frequency attribute exceeds the preset channel clustering frequency threshold and have direct convergence channel connection relationship with each other into the same destination node abnormal convergence cluster. The identifiers of all welfare fund special accounts included in each abnormal aggregation cluster of the source node are integrated to generate a list of special accounts to be traced and blocked for each abnormal aggregation cluster of the source node. The average outflow trace frequency attribute and the total occupancy frequency attribute of the aggregation channel within the abnormal aggregation cluster of the source node are added to each list of special accounts to be traced and blocked. The identifiers of all welfare consumption general accounts included in each abnormal aggregation cluster of the divided destination node are integrated to generate a list of general accounts to be limited for each abnormal aggregation cluster of the destination node. The average inflow trace frequency attribute and the total occupancy frequency attribute of the aggregation channel within the cluster are added to each list of general accounts to be limited. Based on the average outflow trace frequency attribute and total occupancy frequency attribute corresponding to each list of dedicated accounts to be traced and blocked, a purpose intent flow tracing and blocking instruction is generated for each abnormal aggregation cluster of source nodes. The purpose intent flow tracing and blocking instruction includes a dedicated account list field to be blocked and an instruction effective time window field. Based on the average inflow trace frequency attribute and total occupancy frequency attribute corresponding to each general account list to be limited, a usage intent flow exit limit instruction is generated for each abnormal aggregation cluster of the destination node. The usage intent flow exit limit instruction includes a general account list field to be limited and a limit ratio field. The generated intent flow source blocking instructions and intent flow exit flow limiting instructions are sorted according to a preset instruction priority rule. The instruction priority is determined from high to low based on the average trace frequency attribute corresponding to the list of special accounts to be blocked or the list of general accounts to be limited. The sorted intent flow source blocking command and intent flow exit flow limiting command are sent to the welfare payment gateway through an encrypted transmission channel, and the instruction execution status receipt returned by the welfare payment gateway is received. Update the instruction issuance status flags of the corresponding source node abnormal aggregation cluster and destination node abnormal aggregation cluster in the real-time purpose intent flow aggregation graph according to the instruction execution status receipt.

6. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 2, characterized in that, The process involves parsing the historical transaction scenario identifier of each historical cross-account transaction record, and then traversing a pre-defined mapping database of welfare fund usage and consumption scenarios based on the historical transaction scenario identifier to determine the intermediate node identifier sequence of the usage migration path corresponding to that historical cross-account transaction record, including: Parse the historical transaction initiating account identifier of each historical cross-account transaction record, query the preset welfare fund special account usage authorization registration master table based on the historical transaction initiating account identifier, obtain the welfare fund distribution usage tag uniquely bound to the historical transaction initiating account identifier, and determine the welfare fund distribution usage tag as the starting intermediate usage semantic node identifier of the usage migration path; The historical transaction scenario identifier of the same historical cross-account transaction record is parsed, and the historical transaction scenario identifier is determined as the termination intermediate use semantic node identifier of the use migration path. The starting intermediate use semantic node identifier and the ending intermediate use semantic node identifier are input into the welfare fund use and consumption scenario mapping relationship library. The welfare fund use and consumption scenario mapping relationship library pre-stores multiple optional use migration paths from each welfare fund disbursement use tag to each consumption scenario identifier. Each optional use migration path is composed of multiple intermediate use semantic node identifiers connected in sequence. Search the welfare fund usage and consumption scenario mapping relationship library for all possible usage migration paths that start from the initial intermediate usage semantic node identifier and end at the termination intermediate usage semantic node identifier, and generate a candidate usage migration path list. If there are multiple optional migration paths in the candidate migration path list, then based on the historical transaction initiation time and the historical transaction amount of the historical cross-account transaction record, the optional migration path with the highest matching degree with the historical transaction initiation time and the historical transaction amount is selected from the candidate migration path list as the target migration path. If there is only one optional use migration path in the candidate use migration path list, then that optional use migration path is directly determined as the target use migration path; Extract all intermediate use semantic node identifiers from the target use migration path, excluding the starting intermediate use semantic node identifier and the ending intermediate use semantic node identifier, and arrange them according to the original order in the target use migration path to generate the intermediate node identifier sequence of the use migration path. The starting intermediate use semantic node identifier is appended to the beginning of the sequence of intermediate node identifiers of the use migration path, and the ending intermediate use semantic node identifier is appended to the end of the sequence of intermediate node identifiers of the use migration path, to generate a final use migration path intermediate node identifier sequence containing complete path nodes. The sequence length of the intermediate node identifier sequence of the final use migration path is checked. If the sequence length is lower than the preset minimum number of path nodes threshold, the path node completion process is triggered. The supplementary intermediate use semantic node identifier that can connect the starting intermediate use semantic node identifier and the ending intermediate use semantic node identifier is searched in the welfare fund use and consumption scenario mapping relationship library and inserted into the corresponding position in the sequence. The intermediate node identifier sequence of the final purpose migration path after verification and completion is determined as the intermediate node identifier sequence of the purpose migration path corresponding to the historical cross-account transaction record. The intermediate node identifier sequence of the migration path is associated with and stored with the historical cross-account transaction record for future use in the subsequent intent stream transmission channel construction steps.

7. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 2, characterized in that, The process of aggregating multiple initial purpose migration path identifier strings that have the same intention flow origin node identifier and the same intention flow destination node identifier, performing vector synthesis of the purpose intention transmission direction attributes of the multiple initial purpose migration path identifier strings to generate an aggregated composite purpose intention transmission direction, and accumulating the initial purpose intention transmission strength attributes of the multiple initial purpose migration path identifier strings to generate an aggregated composite purpose intention transmission strength includes: From the set of historical cross-account transaction records, select all historical cross-account transaction records with the same intention flow start node identifier and the same intention flow destination node identifier, and extract the initial purpose migration path identifier string corresponding to the historical cross-account transaction records and its additional purpose intention transmission direction attribute and initial purpose intention transmission strength attribute. All extracted usage intent direction attributes are weighted and averaged according to their corresponding time freshness weight coefficients to generate a weighted average synthetic usage intent direction angle value. The weighted average synthetic purpose intention transmission direction angle value is mapped to a preset direction angle level division interval to determine the direction angle level label to which the synthetic purpose intention transmission direction belongs. The values ​​of all extracted initial purpose intent transmission strength attributes are summed to obtain the total purpose intent transmission strength value. The total intended use strength value is compared with the preset intended use strength level classification threshold to determine the strength level label to which the synthetic intended use strength belongs. The direction angle level label and the intensity level label are combined and encoded to generate an aggregated encoding identifier corresponding to the historical cross-account transaction records with the same intention flow start node identifier and the same intention flow arrival node identifier. The aggregated encoding identifier is temporarily stored, and an association mapping relationship is established between the aggregated encoding identifier and the intent flow origin node identifier and intent flow destination node identifier corresponding to the group of historical cross-account transaction records; The aggregation result mapping table is queried according to the aggregation code identifier to obtain the standardized synthetic purpose intent transmission direction and standardized synthetic purpose intent transmission strength corresponding to the aggregation code identifier; The obtained standardized synthetic purpose intent transmission direction and standardized synthetic purpose intent transmission strength are used as the final aggregation result corresponding to this group of historical cross-account transaction records; The final aggregation result is output to the intent stream transmission channel construction module for use in generating the intent stream transmission channel between the corresponding intent stream origin node identifier and intent stream destination node identifier.

8. The method for cross-account transaction monitoring and risk warning in a dual-account system according to claim 5, characterized in that, The process of generating a purpose intent flow tracing and blocking instruction for each source node's abnormal aggregation cluster based on the average outflow trace frequency attribute and total occupancy frequency attribute corresponding to each dedicated account list to be traced and blocked includes: Analyze each list of dedicated accounts to be traced and blocked, obtain the cluster identifier of the abnormal aggregation cluster of the source node corresponding to the list of dedicated accounts to be traced and blocked, and extract the average outflow trace frequency attribute and the total occupancy frequency attribute of the aggregation channel within the cluster corresponding to the cluster identifier from the real-time purpose intent flow aggregation graph. The average outflow trace frequency attribute is input into a preset blocking time window calculation model. The initial blocking time window length is output according to the level of the average outflow trace frequency attribute. The higher the average outflow trace frequency attribute, the longer the initial blocking time window length. The total occupancy frequency attribute is used as a weighting coefficient to adjust the initial blocking time window length, thereby generating the final blocking time window length corresponding to the abnormal aggregation cluster of the source node. The higher the total occupancy frequency attribute, the longer the final blocking time window length after weighting adjustment. The blocking start time is taken as the end time of the current monitoring time window, and the blocking end time is taken as the time obtained by adding the final blocking time window length to the blocking start time. The instruction effective time window corresponding to the abnormal aggregation cluster of the source node is generated. All welfare fund special account identifiers in the list of special accounts to be traced and blocked are concatenated according to a preset list format to generate a string of special accounts to be blocked that conforms to the welfare fund payment gateway interface specification; The string of the list of special accounts to be blocked is combined and encapsulated with the start and end times of the instruction effective time window to generate an initial purpose intent stream source tracing and blocking instruction data packet for the abnormal aggregation cluster of the source node; An instruction type label is attached to the source blocking instruction data packet of the initial purpose intent flow, and the instruction type label is fixed to the source blocking type; Add a command generation timestamp to the initial purpose intent stream source tracing and blocking command data packet, the command generation timestamp being the current system time; The initial purpose intent stream tracing and blocking instruction data packet with the attached instruction type label and instruction generation timestamp is encrypted to generate the final purpose intent stream tracing and blocking instruction. The generated intent-based flow tracing and blocking command is temporarily stored in the command queue to be sent, and sorted with other commands to be sent according to the order of command generation timestamps.

9. A cross-account transaction monitoring and risk warning system for a dual-account system, characterized in that, include: processor; A machine-readable storage medium for storing machine-executable instructions of the processor; The processor is configured to execute the cross-account transaction monitoring and risk warning method for a dual-account system as described in any one of claims 1 to 8 by executing the machine-executable instructions.

10. A computer program product, characterized in that, The computer program product includes machine-executable instructions stored in a computer-readable storage medium. The processor of the cross-account transaction monitoring and risk warning system for a dual-account system reads the machine-executable instructions from the computer-readable storage medium and executes the machine-executable instructions, causing the cross-account transaction monitoring and risk warning system for a dual-account system to perform the cross-account transaction monitoring and risk warning method for a dual-account system as described in any one of claims 1 to 8.

Images