Cross-business financial collaboration processing method and device, and storage medium

Abstract

The present application relates to the technical field of data collaborative processing, in particular to a cross-service financial collaborative processing method and device and storage medium. It comprises the following steps: collecting multi-source transaction and behavior event stream, and constructing global customer-event graph; implanting probe in event bus and each business processing node, and constructing influence surface blood chain; calculating customer association network characteristics and risk transmission strength characteristics; inputting two types of characteristics into collaborative rule model, outputting risk grading signal and accurate containment instruction set when characteristics match; selecting hierarchical response process template through process arrangement model, and generating workflow with minimum business interference. The present application realizes multi-source event semantic normalization through financial transaction ontology, combines probe and distributed tracking technology to connect risk information, and solves the problem that existing financial collaborative mode cannot identify and trace complex fraud transactions involving payment, credit and financial multi-business lines in real time.

Description

Technical Field

[0001] This invention relates to the field of data collaborative processing technology, and more specifically, to a cross-business financial collaborative processing method, apparatus, and storage medium. Background Technology

[0002] Cross-business financial collaborative processing is a financial service system that integrates data technology and business integration logic. It is mainly used in multiple business scenarios such as fintech, green finance, and inclusive finance. It achieves optimized resource allocation and joint risk prevention and control by breaking down business barriers.

[0003] Existing financial collaboration models relying on traditional business architectures suffer from significant "data silos." This makes it difficult to identify and collaboratively combat complex fraudulent transactions involving multiple business lines (such as payments, credit, and wealth management) in real time due to isolated data and rules. Furthermore, data security regulations restrict cross-institutional data sharing efficiency, leaving risk control largely in a "passive response" state. Therefore, this invention provides a cross-business financial collaboration processing method, apparatus, and storage medium. Summary of the Invention

[0004] The purpose of this invention is to provide a cross-business financial collaborative processing method, apparatus and storage medium to solve the problem mentioned in the background art that the existing financial collaborative model relying on traditional business architecture has a prominent "data silo" phenomenon, and cannot identify and collaboratively combat complex fraud transactions involving multiple business lines (such as payment, credit and wealth management) in real time due to isolated data and rules.

[0005] To achieve the above objectives, the present invention aims to provide a cross-business financial collaborative processing method, comprising the following steps: S1. Real-time collection of multi-source transaction and behavioral event streams from payment systems, credit systems, and wealth management systems; semantic normalization of events through financial transaction ontology; construction of a global customer-event graph through customer entity parsing and association; and output of standardized real-time behavioral event streams. S2. Based on real-time behavioral event streams, probes are implanted into the event bus and various business processing nodes. Taking risk events as the core, the triggering source, the system nodes through which they flow, and the derived risk assessment data are captured and connected in real time to construct an impact lineage chain for a single risk case. S3. Based on the customer-event graph and the influence lineage chain, the characteristics of the customer association network are calculated by the community discovery algorithm and the node centrality algorithm, and the characteristics of risk transmission intensity are calculated by the time series analysis and the graph traversal algorithm. S4. The collaborative rule model integrates customer-related network characteristics and risk transmission intensity characteristics with risk transmission pattern rules. When the characteristics match the transmission pattern, it outputs risk rating signals and precise containment instruction sets. S5. Based on risk grading signals and precise containment instruction sets, select graded response process templates through process orchestration models, and dynamically generate workflows that are only for affected nodes and minimize business interference.

[0006] As a further improvement to this technical solution, in step S1, the specific steps involved in semantically normalizing events through the financial transaction ontology and constructing a global customer-event graph through customer entity parsing and association are as follows: Receive multi-source transaction and behavioral event streams from payment systems, credit systems, and wealth management systems; For any original event in a multi-source transaction and behavioral event stream, a financial transaction ontology is introduced, comprising a standard concept set, attribute set, axiom set, and instance mapping function quadruple. The original events are semantically normalized using an instance mapping function, transforming them into standardized events. For each standardized event, extract a structured feature vector, including time-series features, monetary features, behavioral features, and correlation features; Each standardized event corresponds to an event node, and the customer node set is empty. Construct the initial customer-event heterogeneous graph. Based on the initial customer-event heterogeneous graph, combined with structured feature vectors, the association confidence between events in three dimensions—semantics, time, and features—is calculated by weighted summation. When the correlation confidence of two events exceeds the set merging threshold When two events belong to the same customer, their corresponding event nodes are merged, and a new customer node is created. Trigger-type edges are established between the merged event node and the new customer node. If there is a business relationship between the events, relationship-type edges are added between the corresponding event nodes to form a global customer-event graph. ; Each processing cycle Then, the node embeddings are updated using an incremental graph learning algorithm to dynamically maintain the client-event graph; Based on customer-event graph By extracting the standardized attributes of event nodes and their associated client nodes, and encapsulating them in chronological order, a standardized real-time behavioral event stream is generated. The standardized attributes include event ID, timestamp, business type, amount, channel, and numerical representation of structured feature vectors.

[0007] As a further improvement to this technical solution, the specific steps involved in constructing the influence kinship chain for a single risk case in S2 are as follows: Based on real-time behavioral event streams, probes are embedded in the event bus and business processing nodes of payment, credit, and wealth management. When the risk score is detected to exceed the preset risk threshold When an event occurs, the probe automatically captures the event as the source of the risk event. It also records the complete contextual attributes, including event ID, timestamp, business type, associated customer ID, triggering system node, and initial risk score; Probes at the source of risk events Starting from the time window, Internally, it continuously monitors and connects subsequent business events and risk assessment operations triggered by the event; using event causal association rules and distributed tracing technology, it records the sequence number, occurrence time, business node, event type, risk score change, and preceding event ID of each subsequent business event and risk assessment operation in chronological order, forming an orderly event propagation path. ; Based on event propagation path Nodes correspond to various events and system evaluation nodes, and edges represent the triggering and derivative relationships between events. By calculating the weighted influence strength between adjacent events based on the increase in risk score and time interval, an influence weight is assigned to each edge, thus constructing a directed acyclic graph representing the lineage chain. ; Bloodline Prune the branches and remove those whose influence weight is below the set pruning threshold. By analyzing the edges and nodes, a graph traversal algorithm is used to extract the path with the highest cumulative impact weight from the remaining structure, which serves as the core transmission path of the risk event. ; The source of the risk event, the core transmission path, a list of all affected business nodes, the total intensity of risk transmission, the tracking time window and timestamp are encapsulated into a structured impact lineage chain and output.

[0008] As a further improvement to this technical solution, the specific steps involved in calculating the customer association network characteristics through the community detection algorithm and the node centrality algorithm in step S3 are as follows: Obtain a list of all affected business nodes in the impact lineage chain, obtain a set of risky customer IDs, and then analyze the customer-event graph. Extracting customer relationship subgraphs ; Customer Relationship Subgraph The Louvain community detection algorithm is used for community segmentation, based on modularity. Maximize iterative optimization by assigning a community tag to each customer node in the customer association subgraph. Filter out all customer nodes that share the same community tag as any customer in the risk customer ID set, and obtain the unique identifier for that community. and community size ; For each risk customer node in the risk customer ID set Based on customer relationship subgraph The weighted degree centrality is obtained by accumulating the edge weights between the node and all its neighboring nodes, and the betweenness centrality is obtained by counting the proportion of the node that lies on the shortest path between the other nodes in the subgraph. For each risk customer node in the risk customer ID set The weighted degree centrality, betweenness centrality, community label, and community size are combined to form the customer association network characteristics. .

[0009] As a further improvement to this technical solution, the specific steps involved in calculating the risk transmission intensity characteristics through time series analysis and graph traversal algorithm in step S3 are as follows: Extracting the core transmission pathway from the bloodline of influence. Arrange all events in chronological order to form a risk transmission event sequence. ; During the tracking time window Internally, statistical risk transmission event sequences The number of different business node types involved determines the number of affected businesses. ; Risk scores are extracted from the risk propagation event sequence. The increase in risk scores between adjacent events is calculated, and a weighted average increase is obtained by calculating the weighted average increase for all positive increases. Furthermore, a linear regression was performed on the risk score over time to obtain the slope of the risk score trend over time. ; In the customer-event graph In the process, starting from the risky customer node, a directed traversal is performed along the edges to count the events within the tracking time window. The total number of client nodes that can be reached within the range is used as the propagation depth. ; Based on the core transmission path The influence weights of each edge are calculated, and their sum is used as the critical path propagation strength. ; The calculated number of affected businesses, weighted average growth rate, trend slope, transmission depth, and critical path transmission strength are combined to form the risk transmission strength characteristic. .

[0010] As a further improvement to this technical solution, the specific steps involved in constructing the collaborative rule model integrating risk transmission mode rules in step S4 are as follows: Based on customer association network characteristics and risk transmission intensity characteristics A series of risk transmission pattern rules are predefined, each rule including triggering conditions, feature constraints, risk rating logic and containment instruction template; Customer-related network characteristics and risk transmission intensity characteristics Mapped to factual assertions that the rule engine can recognize; The Rete algorithm is used to perform pattern matching between the above factual assertions and the feature constraints in all risk transmission pattern rules to find a set of rules that meet the conditions. To improve matching efficiency, a rule priority mechanism is introduced. The priority score of each rule is calculated based on the severity of the rule definition and the business impact. During matching, the rule with the highest priority score is activated first. A rule is activated when a factual assertion simultaneously satisfies both the triggering condition and the characteristic constraint of a certain risk transmission pattern rule.

[0011] As a further improvement to this technical solution, in step S4, when the feature matching transmission mode is used, the specific steps involved in outputting the risk rating signal and the precise containment instruction set are as follows: Based on the risk rating logic in the activation rules, and combined with the weighted average increase and trend slope in the current risk transmission strength characteristics, the risk rating signal is determined. This includes monitoring, observation, and interception; Based on the containment instruction template in the activation rules and the list of affected business nodes recorded in the current impact lineage chain, a precise containment instruction set is generated that targets only the actual affected nodes. ; Before outputting, the precise containment instruction set is validated for business logic and conflict resolution to avoid instruction duplication and non-executability. The final output includes the risk case ID and risk rating signal. Precision containment command set A structured risk response package with timestamps.

[0012] As a further improvement to this technical solution, in step S5, the specific steps involved in selecting a hierarchical response process template through the process orchestration model and dynamically generating a workflow that targets only the affected nodes and minimizes business interference are as follows: Based on risk rating signals The system selects a corresponding response flow template from a predefined template library; the template library includes monitoring-level templates, observation-level templates, and interception-level templates. From the precision containment instruction set Extract all instruction nodes and their corresponding core transmission paths in the influence lineage. The nodes are compared, and only those that appear in both are retained to form a list of actual execution nodes. ; Based on the execution order and dependencies defined in the response flow template, the list of actual execution nodes will be... The nodes and their corresponding actions are arranged into an executable workflow. ; During workflow execution, the intensity characteristics of risk transmission are monitored in real time. trend slope If the trend slope The risk continues to rise and exceeds the risk escalation threshold. If the trend slope is... Decreased and below the risk mitigation threshold If so, the workflow will end early to reduce interference with normal business operations; After the workflow is completed, record the execution result of each node and update the customer-event graph. This incident will be added to the graph as a new event node for subsequent risk analysis.

[0013] On the other hand, the present invention provides a cross-business financial collaborative processing apparatus, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the cross-business financial collaborative processing method described above.

[0014] On the other hand, the present invention provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any of the above claims.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. In this cross-business financial collaborative processing method, device and storage medium, the semantic normalization of multi-source transaction and behavioral event streams is performed through financial transaction ontology to construct a global customer-event graph. Based on probe technology and distributed tracking technology, the influence lineage chain of a single risk case is constructed. Compared with the traditional model that relies on isolated business data and cannot connect risk information across systems, it fully breaks the limitation of "data silos" and solves the problem that the existing financial collaborative model cannot identify and trace complex fraud transactions involving multiple business lines such as payment, credit and wealth management in real time.

[0016] 2. In this cross-business financial collaborative processing method, device, and storage medium, customer-related network characteristics and risk transmission strength characteristics are calculated based on community discovery algorithms, node centrality algorithms, and time series analysis. Through a collaborative rule model that integrates risk transmission pattern rules, risk rating signals and precise containment instruction sets are output. Combined with a process orchestration model, a workflow that minimizes business interference is dynamically generated. Compared with the shortcomings of traditional risk prevention and control, which is "passive response" and has a broad scope of handling that can easily affect normal business, it does not require indiscriminate intervention on all business nodes. It can accurately locate risk nodes and transmission paths, realize collaborative risk control across heterogeneous business systems, and ensure the normal operation of unrelated businesses while blocking risks. Attached Figure Description

[0017] Figure 1 This is a flowchart of the overall method of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention. Example 1

[0019] Please see Figure 1 As shown, this embodiment provides a cross-business financial collaborative processing method, including the following steps: S1. Real-time collection of multi-source transaction and behavioral event streams from payment systems, credit systems, and wealth management systems. Semantic normalization of events is performed through financial transaction ontology. A global customer-event graph is constructed through customer entity parsing and association, and standardized real-time behavioral event streams are output. The customer-event graph provides topological evidence for identifying potential fraud groups, and the real-time behavioral event streams are used to ensure that subsequent risk control judgments are based on globally consistent and orderly business facts. Specifically, in this embodiment, multi-source transaction and behavioral event streams from the payment system, credit system, and wealth management system are received; For any original event in a multi-source transaction and behavioral event stream, a financial transaction ontology is introduced, comprising a standard concept set, attribute set, axiom set, and instance mapping function quadruple. The original events are semantically normalized using an instance mapping function, transforming them into standardized events. in, As the entity of financial transactions, A set of standard concepts (such as payment, credit, and wealth management); A collection of attributes (e.g., belonging to a type, having attributes); For axioms, define the constraints between concepts; Instance mapping functions map raw business terms to standard concepts; the financial transaction ontology maps fields with similar meanings but inconsistent expressions from different business systems to unified conceptual entities, for example: Map transfers, payments, and expenditures all to a single payment method; Map loan applications, credit requests, and credit line activation to credit; The purchase of wealth management products, subscription of shares, and transfer of assets will be mapped to wealth management products. For each standardized event, extract structured feature vectors, including time-series features (event occurrence time, frequency, interval), monetary features (transaction amount, cumulative amount, amount distribution), behavioral features (event type, business channel, operating terminal), and association features (counterparty ID, associated account, device fingerprint). Each standardized event corresponds to an event node, and the customer node set is empty. Construct the initial customer-event heterogeneous graph. Based on the initial customer-event heterogeneous graph and combined with structured feature vectors, the association confidence between events in three dimensions—semantic, temporal, and feature-based—is calculated through weighted summation. ; For each pair of event nodes Calculate its association confidence level The formula is as follows: ; in, For event nodes Corresponding standard concepts (such as payment, credit, subscription). For event nodes Corresponding standard concepts; Based on financial transaction ontology Calculated event semantic similarity ( Representing standard concepts exist The set of related attributes (in the middle) reflects the degree of semantic association between the two events in terms of business logic; For event nodes The corresponding event timestamp, For event nodes The corresponding event timestamp; It is a temporal proximity metric used to quantify how closely two events are close in the time dimension; To control the time decay rate, the time decay constant, The larger the value, the smaller the impact of the time interval on proximity, and vice versa; the third term is the cosine similarity of the feature vectors. For event nodes The structured feature vectors, For event nodes Structured feature vectors; The cosine similarity of structured feature vectors reflects the degree of matching between two events in the feature dimension; Pre-set weights for semantic similarity. Preset weights for time proximity. Pre-set weights for feature cosine similarity, and ; For the association confidence level; When the confidence level of the association between two events Exceeding the set merging threshold When the value is 0.8, it is determined that the two events belong to the same customer. The corresponding event nodes are merged, and a new customer node is created. Trigger-type edges are established between the merged event node. If there is a business relationship between the events (such as transfer or authorization), relationship-type edges are added between the corresponding event nodes to form a global customer-event graph. ; Among them, the node types of the customer-event graph Including customers, events, and edge types. Including triggering and association; ; in, For a set of nodes, For the customer node set, For event node set; This is a set of edges representing relationships such as "customer triggers event" or "event is associated with customer", reflecting the interactive relationship between customers and events; A node type mapping function used to identify which node belongs to (Client node) or (Event Node); This is an edge type mapping function used to identify the relationship type (such as trigger, association, etc.) corresponding to each edge. For clients - event mapping; Each processing cycle Then, the node embeddings are updated using an incremental graph learning algorithm to dynamically maintain the client-event graph; Among them, the incremental graph learning algorithm only applies to Incremental subgraphs that change within a period Local embedding recomputation is performed, and historical embeddings are used as initialization to achieve efficient and lightweight dynamic graph updates; Specifically, for incremental subgraphs Nodes in Its embedding vector Update as follows: ; in, Indicates the period The newly added or changed subgraph (including new nodes, new edges, and attribute updates). For newly added customer or event nodes (including the first occurrence of the node and its attributes). This is a set of newly added or changed edges (reflecting newly established "triggering" or "association" relationships between nodes); For nodes In the updated local neighborhood (including newly added edges and historical neighbors); Neighboring nodes The current embedding (from historical embeddings or the previous cycle computation); The weight matrix is ​​trainable. For non-linear activation functions (such as ReLU); unchanged nodes retain their original embeddings. constant; Based on customer-event graph By extracting the standardized attributes of event nodes and their associated client nodes, and encapsulating them in chronological order, a standardized real-time behavioral event stream is generated. The standardized attributes include event ID, timestamp, business type, amount, channel, and numerical representation of structured feature vectors (which can be stored separately or embedded). ; in, For standardized real-time behavioral event streams; Indicates the first A standardized event object, containing fields unified after mapping and feature extraction from the financial transaction ontology, for example: .

[0020] S2. Based on real-time behavioral event streams, probes are implanted into the event bus and various business processing nodes (such as payment routing nodes, credit approval engines, and wealth management transaction channels). Taking risk events as the core, probes are captured and connected in real time to identify and link the triggering source, the system nodes through which the events flow, and the derived risk assessment data, thus constructing an impact lineage chain for a single risk case. The impact lineage chain is used to depict the dynamic diffusion path of a single risk event (such as a suspicious payment) within the current time window. Among them, a probe is a monitoring component used to listen to and record in real time the business operations triggered by risk events and their contextual attributes, and to connect the triggering source, propagation path and risk assessment data of risk events across multiple business nodes; Specifically, in this embodiment, probes are implanted in the event bus (such as Kafka or Pulsar) and the business processing nodes of payment, credit, and wealth management based on real-time behavioral event streams. When the risk score is detected to exceed the preset risk threshold When an event (e.g., 700 points) occurs, the probe automatically captures the event as the source of the risk event. It also records the complete contextual attributes, including event ID, timestamp, business type, associated customer ID, triggering system node, and initial risk score; Among them, the risk score is a numerical risk assessment indicator generated by extracting structured feature vectors (such as time sequence, amount, behavior, and related features) from the customer-event graph and performing real-time reasoning calculations on events through a graph neural network trained with business labeled samples. Its level reflects the probability of risk occurrence. Risk Score The calculation expression is as follows: ; in, For the event Structured feature vectors; For clients - event mapping; This is a graph neural network that aggregates neighborhood information based on graph structure; For trainable weight parameters, These are trainable bias parameters; The Sigmoid function normalizes the output to... ; Risk scoring is performed, and the final score is amplified to... The range of integers; Probes at the source of risk events Starting from the time window, Within 30 seconds (e.g.), continuously monitor and connect subsequent business events and risk assessment operations triggered by the event; using event causal association rules and distributed tracing technology, record the sequence number, occurrence time, business node, event type, risk score change, and preceding event ID of each subsequent business event and risk assessment operation in chronological order, forming an orderly event propagation path. ; ; in, To be the source of risk events The event propagation path originating from; For derivative events or risk assessment operations that occur along the propagation path, arranged in chronological order of occurrence, each All of them contain the six core attributes of the above records (serial number, occurrence time, business node, event type, risk score change and preceding event ID). For serial number; The total number of derivative events and risk assessment operations in the propagation path depends on the tracking time window. Event triggering frequency within; The event causal association rule defines the triggering relationship between events based on business logic and time proximity, while the distributed tracing technology transmits and records the complete propagation path between cross-system calls through a unique link ID. The combination of the two enables dynamic connection and source tracing of risk events among multiple business nodes. Based on event propagation path Nodes correspond to various events and system evaluation nodes, and edges represent the triggering and derivative relationships between events. By calculating the weighted influence strength between adjacent events based on the increase in risk score and time interval, an influence weight is assigned to each edge, thus constructing a directed acyclic graph representing the lineage chain. ; in, It is a set of nodes, each node corresponding to an event or system evaluation node (such as payment interception, credit limit freezing, risk model reassessment). This is a set of directed edges, representing the triggering and derivation relationships between events; It is a set of node attributes, including business type, timestamp, risk score, amount involved, channel, etc. For blood ties; edge weight Indicates an event Regarding the event The intensity of the influence can be calculated using the following formula: ; in, It is an event Compared to the preceding event The increase in risk score, i.e. ( For the event Risk score, For the event Risk score); The maximum risk score in the system (e.g., 1000) is used for normalization; It is an event and events The time interval between; It is a time decay parameter (e.g., 10 seconds), which controls the impact of the time interval on the weights; It is an adjustable weighting coefficient for the risk score increase. It is a time decay adjustable weighting coefficient that satisfies In financial risk control scenarios, it is usually set up It emphasizes that the severity of risk transmission is greater than the decay over time; For the event Regarding the event The influence weight, with a value range of [0,1], indicates that the larger the value, the more significant the influence, and is used to quantify the tightness and severity of risk transmission; To avoid an overly long bloodline, the bloodline chain... Prune the branches and remove those whose influence weight is below the set pruning threshold. For edges and nodes with a value of 0.1, a graph traversal algorithm (such as Depth-First Search) is used to extract the path with the highest cumulative impact weight from the remaining structure, which is then used as the core transmission path of the risk event. ; ; in, It means all that are included in the bloodline. Subpaths; This represents the total risk transmission intensity of the sub-path, which is the sum of the influence weights of all edges in the sub-path; This means selecting the sub-path with the highest total risk transmission intensity among all sub-paths, i.e., the core transmission path; This is the core transmission path and the core link in the spread of risk; The source of the risk event, the core transmission path, a list of all affected business nodes, the total intensity of risk transmission, the tracking time window and timestamp are encapsulated into a structured impact lineage chain and output. ; in, It is a list of all business nodes involved in the bloodline chain, including triggering nodes, intermediate nodes in the propagation process, etc., with no duplicates; It refers to the total intensity of risk transmission, i.e., the core transmission path. The sum of the influence weights of all edges in the equation is used to assess the degree of diffusion. It is a bloodline generation timestamp, which records the creation time of structured bloodline objects and is used for log tracing and time series analysis; The structured influence of bloodline chains.

[0021] S3. Based on the customer-event graph and influence lineage chain, calculate customer association network characteristics (such as centrality and community tags) using community discovery algorithms (such as the Louvain algorithm) and node centrality algorithms. Calculate risk transmission strength characteristics (such as the number of affected businesses and the increase in derivative risk scores) using time series analysis and graph traversal algorithms. Customer association network characteristics are used to identify abnormal nodes (potential fraud ringleaders) with high control or bridging functions and closely related communities (potential fraud gangs). Risk transmission strength characteristics are used to determine whether the risk is in an isolated state or is rapidly spreading to core businesses, thereby assessing the urgency of its handling. In this embodiment, the specific steps involved in calculating customer association network features (such as centrality and community tags) using community detection algorithms (such as the Louvain algorithm) and node centrality algorithms are as follows: Obtain the influence of the bloodline chain A list of all affected business nodes involved is used to obtain a set of risky customer IDs, from which a customer-event graph is generated. Extracting customer relationship subgraphs ; The extraction logic is: from the perspective of the bloodline of influence. Obtain the set of all relevant risky customer IDs, and use this as a basis for the customer-event graph. Find these customers' first-order neighbor customers (i.e., those at risk in the customer-event graph) Other customers directly connected through event nodes constitute a set of risk-related customer nodes. The set of edges in the risk-related customer association subgraph Edges and their weights in Inherited from Client-Event Graph The relationships established between customers through shared events (weighting method is the same as the association confidence level). (Logic); This step aims to focus on customer groups that may be relevant to the current risk case and reduce the computational overhead of irrelevant network structures; Customer Relationship Subgraph The Louvain community detection algorithm is used for community segmentation, based on modularity. Maximize iterative optimization by assigning a community tag to each customer node in the customer association subgraph. Filter out all customer nodes that share the same community tag as any customer in the risk customer ID set, and obtain the unique identifier for that community. (with social media tags) (One-to-one correspondence) and community size (i.e., the total number of customer nodes included); Modularity The calculation formula is: ; in, For customer nodes The weighted degree, i.e., the node The sum of edge weights between a node and all its neighboring nodes reflects the local connectivity strength of the node. This is the sum of the weights of all edges in the network; For customer nodes Community tags associated with For customer nodes The community tag is used to identify the community affiliation of a node; For indicator functions, when The value is 1 if the condition is met and 0 otherwise, and is used to filter node pairs within the same community from participating in the modularity calculation. Modularity is used to quantify the quality of community segmentation. Its value ranges from -1 to 1. The closer the value is to 1, the better the segmentation effect, that is, the community is tightly connected and the community is sparsely connected. In financial risk control scenarios, if a community contains multiple risky clients and is large in size with close internal connections, it is considered a potential fraud gang structure. For each risk customer node in the risk customer ID set Based on customer relationship subgraph The weighted degree centrality is obtained by accumulating the edge weights between the node and all its neighboring nodes, and the betweenness centrality is obtained by counting the proportion of the node that lies on the shortest path between the other nodes in the subgraph. Calculate risk client nodes In the customer relationship subgraph The following centrality metrics will serve as the direct basis for determining "potential fraud ringleaders" or "critical bridge nodes" in step S4: The formula for calculating weighted degree centrality is: ; in, For risky customer nodes exist The set of neighboring nodes in the middle, that is, with All directly connected client nodes; For risky customer nodes The weighted degree centrality, the larger the value, the more central the node. The higher the overall affinity strength with directly related customers; For nodes with neighboring nodes The influence weight between them; in the scenario of credit group fraud, a customer node that acts as the "core of collection" usually has an abnormally high weighted degree centrality value because it may have high-intensity financial transactions with multiple "application nodes"; The formula for calculating betweenness centrality is: ; in, express and It is a customer relationship subgraph The middle is different from the node Any two client nodes; For nodes arrive The number of shortest paths, For the nodes The number of shortest paths; For risky customer nodes The betweenness centrality, the larger the value, the more important the node's betweenness centrality. The more prominent the "bridge" role in the network, the stronger the control over the spread of information or funds; in money laundering or complex transaction networks, the key nodes responsible for integrating funds and distributing them often have a high betweenness centrality value, which controls the flow path of funds between multiple accounts. For each risk customer node in the risk customer ID set The weighted degree centrality, betweenness centrality, community label, and community size are combined to form the customer association network characteristics. ; ; in, For risky customer nodes The community tags to which they belong (i.e.) ), used to associate with potential fraud groups; For risky customer nodes The size of the community (total number of customer nodes) is used to assess the overall size of the group. For customer-related network characteristics; In this embodiment, the specific steps involved in calculating the risk transmission intensity characteristics (such as the number of affected businesses and the increase in derivative risk scores) through time series analysis and graph traversal algorithms are as follows: From the perspective of the impact of bloodline chains Extract the core transmission path Arrange all events in chronological order to form a risk transmission event sequence. ; ; in, is an ordered sequence of risk propagation events, reflecting the propagation process of risks starting from the source event; each event includes its occurrence timestamp, the type of business node it belongs to (such as "payment routing", "credit approval"), and the risk score is the serial number is the total number of derivative events in the core conduction path Within the tracking time window count the number of different types of business nodes involved in the risk propagation event sequence to obtain the number of affected businesses ; ; Among them, is the type of business node to which the event belongs, representing the specific business link involved in risk propagation; is the number of affected businesses, reflecting the diffusion breadth of risks at the business level. The larger the value, the wider the cross - business coverage of risks; Extract the risk scores of events from the risk propagation event sequence, calculate the increase in risk scores between adjacent events, and calculate the weighted average of all positive increases to obtain the weighted average increase ; and perform a linear regression on the change of risk scores over time to obtain the trend slope of the change of risk scores over time ; Increase in risk score: ; Among them, is the increase in risk score of the event relative to the previous event ; Calculate the weighted average increase for all positive increases (i.e., the part where the risk increases) to emphasize the "deterioration trend" in risk conduction: ; Among them, is the indicator function used to filter out events with deteriorating risks; is the weighted average increase, which only reflects the average increase level in the risk deterioration stage. The larger the value, the more significant the risk deterioration; Perform a linear regression fit on the risk score sequence to obtain the trend slope : ; Among them, is the predicted value of the risk score corresponding to the time ; is the occurrence timestamp of the event (for ease of calculation, it can be normalized relative to the risk event source (time difference) The intercept term of the linear regression model represents the baseline shift of the initial risk score; This is the random error term; This represents the average rate of change of risk scores per unit of time. Furthermore, the large value indicates that the risk is escalating rapidly and requires immediate attention. In the customer-event graph In the process, starting from the risky customer node, a directed traversal (such as BFS) is performed along the edge to count the number of customers within the tracking time window. The total number of client nodes that can be reached within the range is used as the propagation depth. ; in, The transmission depth, i.e., the total number of related customers affected by the risk, reflects the extent of the risk's spread within the customer group; Based on the core transmission path The influence weights of each edge are calculated, and their sum is used as the critical path propagation strength. ; ; in, The critical path transmission intensity quantifies the "energy" of risk transmission along the most important link; the larger the value, the higher the intensity of risk propagation along the critical path. As the core transmission path All directed edges in, where For the preceding event node, For subsequent event nodes; The calculated number of affected businesses, weighted average growth rate, trend slope, transmission depth, and critical path transmission strength are combined to form the risk transmission strength characteristic. : ; in, Given the already affected number of businesses, in a "chain fraud" scenario, if a suspicious payment triggers a credit limit freeze and further triggers risk control measures for wealth management product redemptions, then... ; The weighted average increase is used to determine whether the risk continues to worsen during transmission. For example, in the scenario of "multiple borrowing", each new loan application may lead to a jump in the risk score. For the time trend slope of the risk score, if (minutes / second) can be identified as "rapid spread", triggering emergency response; To determine the depth of transmission (number of associated customers), in "gang-related crimes," if This indicates that the risk has affected a large number of related accounts; For the critical path transmission strength, if This indicates that the risk is highly concentrated on a certain business link, making it suitable for precise interception; This represents the intensity characteristics of risk transmission.

[0022] S4. The collaborative rule model integrates customer-related network characteristics and risk transmission intensity characteristics with risk transmission pattern rules. When the characteristics match the transmission pattern, it outputs a risk rating signal and a precise containment instruction set. The risk rating signal is used to assign a global collaborative severity level to risk cases (e.g., monitoring, observation, interception), and the precise containment instruction set is used to identify the specific business nodes that need intervention (from the influence lineage chain). The collaborative rule model uses a meta-rule framework to define cross-business complex patterns (e.g., "serialized flash loan attack" and "parallel multiple lending") and uses a hybrid inference engine based on the Rete algorithm for efficient matching. In this embodiment, based on customer association network characteristics and risk transmission intensity characteristics A series of risk transmission pattern rules are predefined, each rule including triggering conditions, feature constraints, risk rating logic and containment instruction template; Each rule is formally represented as: ; in, The trigger condition indicates the type of risk event that triggers the rule, such as flash loan attacks, multiple borrowing, money laundering chains, etc., originating from the financial transaction ontology. Exception event labels defined in the documentation; The term "customer" refers to the customer entity associated with the risk event that triggers the rule, such as high-risk customers, newly registered customers, and cross-border transaction customers. The event refers to the specific risk event type that triggers the rule, such as a payment event (marked by the flash loan icon), a loan application event, or a wealth management redemption event. The feature constraint is composed of a combination of customer association network features and risk transmission strength features, and supports logical operations and threshold comparisons. For risk rating logic, output the risk level. ; This is a template for containment instructions, which includes a list of business nodes that need intervention and the types of actions required. The action to be executed is to generate specific business intervention operations based on the containment instruction template; Customer-related network characteristics and risk transmission intensity characteristics Mapped to factual assertions that the rule engine can recognize; for example: If weighted centrality (such as centrality threshold) =40) and community size (such as size threshold) If =8), then it can be asserted that "there are nodes with high control and large-scale groups"; If the number of businesses has already been affected And the trend slope Then it is asserted that "the risk is rapidly spreading across businesses"; If the critical path transmission strength And conduction depth Then it asserts that "the risk is highly concentrated on the critical path and has spread to multiple customers"; The Rete algorithm is used to perform pattern matching between the above factual assertions and the feature constraints in all risk transmission pattern rules to find a set of rules that meet the conditions. The Rete algorithm is implemented using a compiled rule network, and the specific network structure and matching process are as follows: Fact assertion input: Customer-related network characteristics and risk transmission intensity characteristics The eigenvalues ​​in the data (such as...) , , (etc.) as factual assertions Input rule network; Network node types include: α node: A node used to match a single feature condition, for example: ; ; β nodes: Used to connect multiple α node conditions to form composite conditions, for example: ; End node: For rules that meet the conditions, risk assessment and containment instructions are triggered. Matching process: After the fact assertion enters the network, it propagates along the compiled node path, activates the α and β nodes that meet the conditions, and finally reaches the terminal node; Feature parameter embedding: the threshold parameter (e.g.) , , (etc.) are all fixed during the network compilation stage and are used as part of the node judgment conditions; in, As a factual assertion, it represents a characteristic of a customer-related network. or risk transmission intensity characteristics Logical assertions derived from mapping, for example: ”; For the first Each α node represents a node in the Rete network used to match a single feature condition; For the first Each β node represents a composite condition node in the Rete network used to connect multiple α node conditions; This is a weighted degree centrality threshold used to determine whether a customer node has high control; its value ranges from [value range missing]. The preferred value is 40; This is the risk trend slope threshold, used to determine whether the risk is spreading rapidly; its value range is... The preferred value is 5 (minutes / second); This is the logical AND operator, indicating that multiple conditions must be met simultaneously. This is the event merging threshold, used to determine whether two events belong to the same customer; its value range is [value range missing]. The preferred value is 0.8; To improve matching efficiency, a rule priority mechanism is introduced. The priority score of each rule is calculated based on the severity of the rule definition and the business impact. During matching, the rule with the highest priority score is activated first. The formula is as follows: ; in, For the first The priority score for each rule ranges from [0, 10], with higher scores indicating higher priority. The preset severity score for the risk type corresponding to this rule is set based on the degree of loss caused by the risk and the probability of occurrence, with a range of [0,10]. For example, a flash loan attack is set to 10 points, and a minor abnormal transaction is set to 3 points. This is the severity weighting coefficient. The weighting coefficient for business impact must satisfy... Typical values ; Based on the current characteristics of risk transmission intensity The number of businesses affected by this and conduction depth The calculated dynamic impact coefficient reflects the actual scope of the risk's impact on business and customers. The formula is as follows: ; in, The maximum number of allowed business nodes, The maximum permissible conduction depth; A customer influence weighting coefficient is used to balance the impact of business breadth and customer depth. When matching rules, the highest priority rule is activated first to ensure a rapid response to the most urgent risks. Rule activation logic of the rule priority mechanism: Of all the matched rules, only the priority score is activated. The highest rule ; If multiple rules have the same priority score, the default severity score will be used. Descending order, dynamic influence coefficient Secondary sorting in descending order; When a factual assertion simultaneously satisfies the triggering condition and characteristic constraint of a certain risk transmission pattern rule, that rule is activated; For example, the rule for the "chain flash loan attack" pattern is defined as follows: ; ; ; ; If the current risk case has customer relationship network characteristics and risk transmission intensity characteristics If the mapped fact assertion matches this pattern, the rule is activated, and the instruction generation phase begins. Furthermore, when the feature matching transmission pattern is used, the specific steps involved in outputting the risk rating signal and the precise containment instruction set are as follows: Based on the risk rating logic in the activation rules, and combined with the weighted average increase and trend slope in the current risk transmission strength characteristics, the risk rating signal is determined. This includes monitoring, observation, and interception; The risk rating logic can be fine-tuned using the following formula: ; in, For example, the emergency slope threshold. (minutes / second); For example, risk mitigation threshold (Points / Events); This serves as a risk rating signal, used to drive subsequent handling procedures; Based on the containment instruction template in the activation rules and the list of affected business nodes recorded in the current impact lineage chain, a precise containment instruction set is generated that targets only the actual affected nodes. ; The instruction generation logic is as follows: ; in, To precisely block the instruction set, it consists of multiple (node-action-parameter) triples to ensure the instruction's targeting and executability; For originating from the core transmission path And it appears in the containment instruction template. Business nodes in; The actions to be performed at this node, such as suspending transactions, freezing funds, and restricting redemptions; Action parameters, such as freeze duration and limit value, are determined by the current risk score. and critical path transmission strength The dynamic calculation, taking the most commonly used freeze duration as an example, is calculated using the following formula: ; in, The freeze duration is dynamically calculated (in seconds). The higher the risk and the greater the transmission intensity, the longer the freeze duration. The base freeze duration (e.g., 300 seconds); This is an adjustment factor for the duration of risk scoring. This is the conduction intensity duration adjustment factor, typical value. The final generated instruction set is output in JSON format for use by the process orchestration model. Before outputting, the precise containment instruction set is validated for business logic and conflict resolution to avoid instruction duplication and non-executability. Among them, the business logic verification checks the status, permissions and parameter compliance of the target node of the instruction in real time to ensure that the instruction can be executed in the current business environment; Conflict resolution merges, prioritizes, and rearranges conflicting instructions that are duplicated, mutually exclusive, or have dependencies, ensuring the consistency and feasibility of the instruction set. For example, if the same customer is required to freeze their account at both the payment and credit nodes, the order will be merged into a single "Suspension of all business" order; if the order involves redemption of wealth management products but the customer does not hold any wealth management products, the order will be automatically removed; conflict resolution is based on real-time judgment of business dependency graphs and customer status snapshots to ensure that the order is executable and complies with compliance requirements. The final output includes the risk case ID (from the source of the risk event). Event ID), risk rating signal Precision containment command set A structured risk response package with timestamps.

[0023] S5. Based on risk grading signals and precise containment instruction sets, a tiered response process template is selected through a process orchestration model, and a workflow that minimizes business disruption and targets only the affected nodes is dynamically generated. This workflow is used to execute collaborative risk control actions across multiple heterogeneous business systems to block risks while ensuring the normal operation of unrelated businesses. In this embodiment, based on risk rating signals The system selects a corresponding response flow template from a predefined template library; the template library includes monitoring-level templates, observation-level templates, and interception-level templates. Among them, the monitoring-level template only records logs and triggers real-time alarms to notify risk control personnel; The observation-level template adds risk markers to relevant business nodes and initiates mild rate limiting; The intercept-level template executes cross-node service blocking and triggers customer status freezing.

[0024] The selection rules are as follows: ; in, For response process templates; From the precision containment instruction set Extract all instruction nodes and their influence lineage chains. The core transmission path in The nodes are compared, and only those that appear in both are retained to form a list of actual execution nodes. ; For example: ; but: ; At the same time, from the perspective of the bloodline chain of influence Obtain the core transmission path ,For example: ; This indicates that the risk actually propagated to the payment and credit nodes, but did not involve the wealth management nodes; The actual list of executed nodes is the intersection of the two: ; in, For precise containment instruction set The set of all instruction nodes extracted from it; This is a list of actual execution nodes; According to the response flow template The execution order and dependencies (such as sequential, parallel, and conditional branching) defined in the code will be used to determine the actual list of execution nodes. The nodes and their corresponding actions (from the precision containment instruction set) Arrange them into an executable workflow ; The workflow is presented as a directed acyclic graph, where nodes represent "performing a certain action in a certain business system," and edges represent the execution order; for example, if It is an intercept-level template, and The generated workflow might look like this: Start → [Payment Node: Suspend Transaction] → [Credit Node: Freeze Credit Limit] → End; During workflow execution, the intensity characteristics of risk transmission are monitored in real time. trend slope If the trend slope The risk continues to rise and exceeds the risk escalation threshold. (like If the trend slope is..., then the current workflow will be upgraded to a higher-level template (e.g., from observation level to interception level), and an interception action will be added; Decreased and below the risk mitigation threshold (For example If so, the workflow should be terminated or downgraded in advance to reduce interference with normal business operations; After the workflow is completed, record the execution result of each node and update the customer-event graph. This incident will be added to the graph as a new event node for subsequent risk analysis. Example 2

[0025] This embodiment provides a cross-business financial collaborative processing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the steps of the cross-business financial collaborative processing method described above.

[0026] This embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the method described in any of the above embodiments.

[0027] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A cross-business financial collaborative processing method, characterized in that, Includes the following steps: S1. Real-time collection of multi-source transaction and behavioral event streams from payment systems, credit systems, and wealth management systems; semantic normalization of events through financial transaction ontology; construction of a global customer-event graph through customer entity parsing and association; and output of standardized real-time behavioral event streams. S2. Based on real-time behavioral event streams, probes are implanted into the event bus and various business processing nodes. Taking risk events as the core, the triggering source, the system nodes through which they flow, and the derived risk assessment data are captured and connected in real time to construct an impact lineage chain for a single risk case. S3. Based on the customer-event graph and the influence lineage chain, the characteristics of the customer association network are calculated by the community discovery algorithm and the node centrality algorithm, and the characteristics of risk transmission intensity are calculated by the time series analysis and the graph traversal algorithm. S4. The collaborative rule model integrates customer-related network characteristics and risk transmission intensity characteristics with risk transmission pattern rules. When the characteristics match the transmission pattern, it outputs risk rating signals and precise containment instruction sets. S5. Based on risk grading signals and precise containment instruction sets, select graded response process templates through process orchestration models, and dynamically generate workflows that are only for affected nodes and minimize business interference.

2. The cross-business financial collaborative processing method according to claim 1, characterized in that: In step S1, the specific steps involved in semantically normalizing events through the financial transaction ontology and constructing a global customer-event graph through customer entity parsing and association are as follows: Receive multi-source transaction and behavioral event streams from payment systems, credit systems, and wealth management systems; For any original event in a multi-source transaction and behavioral event stream, a financial transaction ontology is introduced, comprising a standard concept set, attribute set, axiom set, and instance mapping function quadruple. The original events are semantically normalized using an instance mapping function, transforming them into standardized events. For each standardized event, extract a structured feature vector, including time-series features, monetary features, behavioral features, and correlation features; Each standardized event corresponds to an event node, and the customer node set is empty. Construct the initial customer-event heterogeneous graph. Based on the initial customer-event heterogeneous graph, combined with structured feature vectors, the association confidence between events in three dimensions—semantics, time, and features—is calculated by weighted summation. When the correlation confidence of two events exceeds the set merging threshold When two events belong to the same customer, their corresponding event nodes are merged, and a new customer node is created. Trigger-type edges are established between the merged event node and the new customer node. If there is a business relationship between the events, relationship-type edges are added between the corresponding event nodes to form a global customer-event graph. ; Each processing cycle Then, the node embeddings are updated using an incremental graph learning algorithm to dynamically maintain the client-event graph; Based on customer-event graph By extracting the standardized attributes of event nodes and their associated client nodes, and encapsulating them in chronological order, a standardized real-time behavioral event stream is generated. The standardized attributes include event ID, timestamp, business type, amount, channel, and numerical representation of structured feature vectors.

3. The cross-business financial collaborative processing method according to claim 1, characterized in that: In S2, the specific steps involved in constructing the impact kinship chain for a single risk case are as follows: Based on real-time behavioral event streams, probes are embedded in the event bus and business processing nodes of payment, credit, and wealth management. When the risk score is detected to exceed the preset risk threshold When an event occurs, the probe automatically captures the event as the source of the risk event. It also records the complete contextual attributes, including event ID, timestamp, business type, associated customer ID, triggering system node, and initial risk score; Probes at the source of risk events Starting from the time window, Internally, it continuously monitors and connects subsequent business events and risk assessment operations triggered by the event; using event causal association rules and distributed tracing technology, it records the sequence number, occurrence time, business node, event type, risk score change, and preceding event ID of each subsequent business event and risk assessment operation in chronological order, forming an orderly event propagation path. ; Based on event propagation path Nodes correspond to various events and system evaluation nodes, and edges represent the triggering and derivative relationships between events. By calculating the weighted influence strength between adjacent events based on the increase in risk score and time interval, an influence weight is assigned to each edge, thus constructing a directed acyclic graph representing the lineage chain. ; Bloodline Prune the branches and remove those whose influence weight is below the set pruning threshold. The edges and nodes are used to extract the path with the highest cumulative impact weight from the remaining structure through a graph traversal algorithm, which serves as the core transmission path of the risk event. The source of the risk event, the core transmission path, a list of all affected business nodes, the total intensity of risk transmission, the tracking time window and timestamp are encapsulated into a structured impact lineage chain and output.

4. The cross-business financial collaborative processing method according to claim 1, characterized in that: In step S3, the specific steps involved in calculating customer association network characteristics using the community detection algorithm and the node centrality algorithm are as follows: Obtain a list of all affected business nodes in the impact lineage chain, obtain a set of risky customer IDs, and then analyze the customer-event graph. Extracting customer relationship subgraphs ; Customer Relationship Subgraph The Louvain community detection algorithm is used for community segmentation, based on modularity. Maximize iterative optimization by assigning a community tag to each customer node in the customer association subgraph. Filter out all customer nodes that share the same community tag as any customer in the risk customer ID set, and obtain the unique identifier for that community. and community size ; For each risk customer node in the risk customer ID set Based on customer relationship subgraph The weighted degree centrality is obtained by accumulating the edge weights between the node and all its neighboring nodes, and the betweenness centrality is obtained by counting the proportion of the node that lies on the shortest path between the other nodes in the subgraph. For each risk customer node in the risk customer ID set The weighted degree centrality, betweenness centrality, community label, and community size are combined to form the customer association network characteristics. .

5. The cross-business financial collaborative processing method according to claim 1, characterized in that: In step S3, the specific steps involved in calculating the risk transmission intensity characteristics through time series analysis and graph traversal algorithm are as follows: Extracting the core transmission pathway from the bloodline of influence. Arrange all events in chronological order to form a risk transmission event sequence. ; During the tracking time window Internally, statistical risk transmission event sequences The number of different business node types involved determines the number of affected businesses. ; Risk scores are extracted from the risk propagation event sequence. The increase in risk scores between adjacent events is calculated, and a weighted average increase is obtained by calculating the weighted average increase for all positive increases. Furthermore, a linear regression was performed on the risk score over time to obtain the slope of the risk score trend over time. ; In the customer-event graph In the process, starting from the risky customer node, a directed traversal is performed along the edges to count the events within the tracking time window. The total number of client nodes that can be reached within the range is used as the propagation depth. ; Based on the core transmission path The influence weights of each edge are calculated, and their sum is used as the critical path propagation strength. ; The calculated number of affected businesses, weighted average growth rate, trend slope, transmission depth, and critical path transmission strength are combined to form the risk transmission strength characteristic. .

6. The cross-business financial collaborative processing method according to claim 1, characterized in that: In step S4, the specific steps involved in constructing a collaborative rule model that integrates risk transmission mode rules are as follows: Based on customer association network characteristics and risk transmission intensity characteristics A series of risk transmission pattern rules are predefined, each rule including triggering conditions, feature constraints, risk rating logic and containment instruction template; Customer-related network characteristics and risk transmission intensity characteristics Mapped to factual assertions that the rule engine can recognize; The Rete algorithm is used to perform pattern matching between the above factual assertions and the feature constraints in all risk transmission pattern rules to find a set of rules that meet the conditions. To improve matching efficiency, a rule priority mechanism is introduced. The priority score of each rule is calculated based on the severity of the rule definition and the business impact. During matching, the rule with the highest priority score is activated first. A rule is activated when a factual assertion simultaneously satisfies both the triggering condition and the characteristic constraint of a certain risk transmission pattern rule.

7. The cross-business financial collaborative processing method according to claim 6, characterized in that: In step S4, when the feature matching transmission mode is used, the specific steps involved in outputting the risk rating signal and the precise containment instruction set are as follows: Based on the risk rating logic in the activation rules, and combined with the weighted average increase and trend slope in the current risk transmission strength characteristics, the risk rating signal is determined. This includes monitoring, observation, and interception; Based on the containment instruction template in the activation rules and the list of affected business nodes recorded in the current impact lineage chain, a precise containment instruction set is generated that targets only the actual affected nodes. ; Before outputting, the precise containment instruction set was... Perform business logic verification and conflict resolution to avoid duplicate or unexecutable instructions; The final output includes the risk case ID and risk rating signal. Precision containment command set A structured risk response package with timestamps.

8. The cross-business financial collaborative processing method according to claim 1, characterized in that: In step S5, the specific steps involved in selecting a hierarchical response process template through the process orchestration model and dynamically generating a workflow that targets only affected nodes and minimizes business disruption are as follows: Based on risk rating signals The system selects a corresponding response flow template from a predefined template library; the template library includes monitoring-level templates, observation-level templates, and interception-level templates. From the precision containment instruction set Extract all instruction nodes and their corresponding core transmission paths in the influence lineage. The nodes are compared, and only those that appear in both are retained to form a list of actual execution nodes. ; Based on the execution order and dependencies defined in the response flow template, the list of actual execution nodes will be... The nodes and their corresponding actions are arranged into an executable workflow. ; During workflow execution, the intensity characteristics of risk transmission are monitored in real time. trend slope If the trend slope The risk continues to rise and exceeds the risk escalation threshold. If the trend slope is... Decreased and below the risk mitigation threshold If so, the workflow will end early to reduce disruption to normal business operations; After the workflow is completed, record the execution result of each node and update the customer-event graph. This action will be added to the graph as a new event node.

9. A cross-business financial collaborative processing device, comprising a sensor, a storage unit, a processor, and a computer program stored in the storage unit and executable on the processor, characterized in that: When the processor executes the computer program, it implements the steps of the cross-business financial collaborative processing method according to any one of claims 1 to 8.

10. A storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the cross-business financial collaborative processing method according to any one of claims 1 to 8.

Images