An abnormal transaction real-time risk control system based on deep learning

Abstract

The application discloses an abnormal transaction real-time risk control system based on deep learning, and the system comprises a topology analysis and risk prediction unit, which is used for processing real-time transaction flow data and constructing a transaction behavior topology evolution graph, learning a topology evolution mode in combination with a graph neural network and a time sequence attention mechanism, identifying abnormal propagation characteristics and predicting potential risk transaction paths, and an intention decoupling and abnormal identification unit, which is used for constructing a transaction behavior multidimensional feature vector, and the application relates to the technical field of financial risk control. The abnormal transaction real-time risk control system based on deep learning can identify abnormal propagation characteristics and potential risk transaction paths by constructing a transaction behavior topology evolution graph through a graph neural network and a time sequence attention mechanism, effectively improves the abnormal detection accuracy, maps multidimensional transaction characteristics into a low-dimensional intention vector by using a self-supervised representation learning and an intention decomposition network, and realizes accurate differentiation of behaviors such as normal transactions, abnormal arbitrage and fraud attacks.

Description

Technical Field

[0001] This invention relates to the field of financial risk control, and more specifically, to a real-time risk control system for abnormal transactions based on deep learning. Background Technology

[0002] With the rapid development of digital and internet technologies, financial transaction methods have become increasingly diversified. The rise of emerging industries such as online payments, cross-border e-commerce, and fintech services has led to a dramatic increase in the volume of financial transaction data. Traditional financial risk control systems mostly rely on static rules and statistical methods to identify potential fraudulent activities. However, these traditional methods often prove inadequate when faced with complex transaction patterns and multi-dimensional correlations. Specifically, traditional risk control systems typically suffer from insufficient real-time performance, inability to effectively capture complex correlations, and inaccurate intent analysis, making them unable to effectively cope with increasingly sophisticated fraud methods and transaction patterns, seriously impacting financial security.

[0003] Furthermore, existing risk control systems lack dynamic adaptive capabilities, making it difficult to respond in real time to new risks and attacks. With the diversification and increasing sophistication of fraudulent activities, traditional risk control strategies are struggling to quickly identify and accurately predict potential risks, especially when dealing with large-scale transaction data, where the processing efficiency and detection accuracy of existing systems face significant challenges. Therefore, there is an urgent need for a new risk control system based on deep learning and intelligent algorithms, capable of mining deep-seated transaction behavior characteristics from big data, accurately identifying abnormal behavior, and achieving adaptive real-time risk control through intelligent optimization strategies to effectively prevent various risks in financial transactions. Summary of the Invention

[0004] The purpose of this invention is to provide a real-time risk control system for abnormal transactions based on deep learning. This system solves the problems that existing risk control systems usually have, such as insufficient real-time performance, inability to effectively capture complex correlations, and inaccurate intent analysis. These problems make it difficult to effectively deal with increasingly changing fraud methods and trading patterns, seriously affecting financial security. Furthermore, these systems lack dynamic adaptive capabilities and are unable to respond to new risks and attacks in real time.

[0005] This invention achieves the above objective through the following technical solution: a real-time risk control system for abnormal transactions based on deep learning, the system comprising: Topology analysis and risk prediction unit, intent decoupling and anomaly identification unit, risk modeling and strategy optimization unit, risk scoring and risk control execution unit; The topology analysis and risk prediction unit is used to process real-time transaction stream data and construct a transaction behavior topology evolution graph. It combines graph neural networks and temporal attention mechanisms to learn topology evolution patterns, identify abnormal propagation characteristics, and predict potential risky transaction paths. The intent decoupling and anomaly recognition unit is used to construct a multi-dimensional feature vector of transaction behavior, which is mapped into a low-dimensional intent vector through self-supervised deep representation learning, and then decoupled into a latent intent factor through an intent decomposition network to identify abnormal behavior. The risk modeling and strategy optimization unit is used to build a real-time risk decision-making environment model, taking transactions as reinforcement learning decision states, combining deep reinforcement learning to optimize risk control strategies and achieve adaptive real-time updates of strategies. The risk scoring and risk control execution unit is used to integrate the results of multiple modules to obtain a comprehensive transaction risk score, and to match and execute corresponding risk control operations based on the score.

[0006] Furthermore, the topology analysis and risk prediction unit includes: The system includes a data acquisition module, a data preprocessing module, a topology evolution graph construction module, and a risk path prediction module. The data acquisition module is used to collect real-time raw data of the transaction flow in the financial transaction system. The raw data includes core information such as account, device, IP, merchant, transaction amount, transaction time, fund flow, and transaction channel. The data preprocessing module is used to clean, deduplicatize, complete, correct, and standardize the raw data, and extract effective features from the graph. The topology evolution graph construction module is used to construct an undirected dynamic transaction graph that includes multiple types of nodes and edges, and dynamically updates the node attributes, edge relationships and edge weights of the graph through a sliding time window to form a transaction behavior topology evolution graph. The risk path prediction module is used to extract the temporal evolution features of the transaction topology through a trained graph neural network and a temporal attention mechanism, identify abnormal propagation features, and predict potential risk transaction paths and related nodes.

[0007] Furthermore, the node set of the undirected dynamic transaction graph includes: Account nodes, device nodes, IP nodes, and merchant nodes are each assigned a corresponding attribute feature vector; The edge set includes transaction relationship edges, equipment sharing edges, IP sharing edges, and fund circulation edges. Each edge is assigned a weight value that is determined and normalized based on the frequency of association, time relevance, and historical risk relevance. The length of the sliding time window is dynamically set according to the frequency of transaction business, with a value range of 5s-30min. Based on this window, the time-series modeling of the transaction behavior topology network is realized.

[0008] Furthermore, the risk path prediction module includes the following steps: The graph neural network, with the Graph Attention Network as its core, achieves anomaly propagation feature recognition after training and optimization. The temporal attention mechanism calculates the temporal attention weights through a multilayer perceptron and a softmax function, and obtains the transaction topology temporal evolution features that integrate spatiotemporal information by weighted summation of the spatial topological features of multiple time windows. Extract the abnormal transaction diffusion speed, closed-loop fund return, and high connection density of newly registered accounts from this feature. Figure 3 Core anomaly propagation characteristics, with preset characteristic thresholds; When a feature is detected to exceed a threshold, a graph attention mechanism and a path search algorithm are used to predict potential risky transaction paths.

[0009] Furthermore, the intent decoupling and anomaly identification unit includes: The module includes a feature vector construction module, a self-supervised representation learning module, an intent decomposition module, and an abnormal behavior recognition module. The feature vector construction module is used to extract five core features from preprocessed real-time transaction data: transaction amount distribution, time interval pattern, merchant type preference, device switching frequency, and geographical location change, and to construct and normalize the original transaction behavior feature vector. The self-supervised representation learning module adopts a Transformer-based encoder-decoder structure. After self-supervised training, it maps the normalized feature vectors to the transaction intent space, generating a low-dimensional intent vector that can represent the core features of transaction behavior. The intent decomposition module decouples the low-dimensional intent vector into multiple latent intent factors through the trained intent decomposition network and calculates the normalized weight ratio of each factor. The abnormal behavior identification module identifies and issues warnings about abnormal transaction behaviors by comparing the real-time weight ratio with a preset intent factor threshold.

[0010] Furthermore, the self-supervised training of the self-supervised representation learning module adopts a feature mask reconstruction task, using the mean squared error of the reconstructed mask features as the loss function. After training, principal component analysis is used to verify the variance explanation rate of the low-dimensional intent vector, ensuring that the variance explanation rate is ≥90%. The dimension of the low-dimensional intent vector is determined based on the variance explained rate, and the smallest integer that meets the requirements is selected, with the dimension being less than 5.

[0011] Furthermore, the intent decomposition network is a fully connected network structure. After training with labeled samples, it achieves decoupling of the low-dimensional intent vector. The output implicit intent factors include at least three categories: normal consumption, abnormal arbitrage, and fraudulent attack. The weight ratio of each factor is normalized by the softmax function to ensure that the sum of the weights is 1. The threshold of the abnormal behavior identification module is determined based on the statistical characteristics of historical fraudulent transaction samples and is dynamically updated based on new samples. When the weight ratio of the fraudulent attack intent factor exceeds the threshold, an abnormal behavior warning is triggered.

[0012] Furthermore, the risk modeling and strategy optimization unit includes: The module includes a risk decision-making environment construction module, a deep reinforcement learning training module, a policy stability constraint module, and a policy update module. The risk decision-making environment construction module is used to build a real-time risk decision-making environment model of the Markov decision process, defining a state space including multi-dimensional characteristics of transactions, an action space of gradient risk control actions, a piecewise reward function based on risk control effect, and a discount factor. The deep reinforcement learning training module uses a proximal policy optimization algorithm to construct and train a policy network, with the goal of maximizing cumulative rewards, to achieve initial optimization of the risk control strategy. The strategy stability constraint module uses two layers of constraints—parameter update magnitude limitation and parameter moving average filtering—to prevent excessive updates and sudden changes in the risk control strategy. The strategy update module achieves adaptive real-time updates of risk control strategies through incremental training, simulation verification, and canary release.

[0013] Furthermore, the action space includes: The risk control measures are implemented through four tiered approaches: direct transaction, triggering secondary verification, executing transaction limits, and temporarily freezing accounts. The reward function sets positive rewards, negative penalties, and zero rewards based on whether the risk control action successfully blocks fraudulent transactions, incorrectly intercepts normal transactions, or handles risk-free transactions. The negative penalty is 2-5 times the positive reward. The policy stability constraint module sets a threshold for the update magnitude of policy network parameters, prunes parameter update values ​​that exceed the threshold, and performs moving average filtering on continuously updated parameters. The smoothing coefficient is dynamically set according to policy stability or adaptive requirements. The strategy update module collects incremental training samples daily and performs incremental training regularly. After the trained strategy is verified to meet the standards in the simulation environment, it is gradually launched online in a gray-scale release manner.

[0014] Furthermore, the risk scoring and risk control execution unit includes: The module includes a quantitative scoring module, a comprehensive scoring fusion module, a risk control operation matching module, and a model iteration feedback module. The quantitative scoring module provides quantitative scores for the risk transaction path prediction results and the abnormal behavior identification results, with a score range of 0-100. The comprehensive scoring fusion module dynamically sets weighting coefficients based on the risk control accuracy of the two quantitative scoring modules, and obtains the comprehensive transaction risk score by weighted summation. The risk control operation matching module presets multiple comprehensive risk score ranges, matches the score ranges with the graded risk control actions in the risk control strategy, and triggers and executes the corresponding risk control operations based on the real-time comprehensive risk score. The model iteration feedback module records the final risk results of transactions after risk control operations, and uses the feedback data regularly for iterative training of various neural network models in the system to adjust model parameters and various thresholds, and continuously optimize the risk control effect. The weighting coefficients of the comprehensive risk score are recalculated and updated monthly based on the risk control effect, and the threshold of the score range is determined based on the historical risk control transaction sample distribution and the false interception rate requirements.

[0015] The beneficial effects of this invention are as follows: 1. By constructing a topological evolution graph of trading behavior through graph neural networks and temporal attention mechanisms, it is possible to identify abnormal propagation characteristics and potential risky trading paths, effectively improving the accuracy of anomaly detection.

[0016] 2. By utilizing self-supervised representation learning and intent decomposition networks, multi-dimensional transaction features are mapped into low-dimensional intent vectors and decoupled into latent intent factors, enabling accurate differentiation of behaviors such as normal transactions, abnormal arbitrage, and fraudulent attacks.

[0017] 3. Deep reinforcement learning is used to construct a risk decision-making environment and optimize risk control strategies. Combined with strategy stability constraints and incremental training mechanisms, the strategies are adaptively updated in real time to quickly respond to new fraud patterns. 4. By integrating risk information from multiple modules through quantitative scoring, weighted fusion, and risk control operation matching, it automatically triggers tiered risk control actions, such as secondary verification, transaction limits, and account freezing, thereby reducing false interception rates and improving risk control efficiency.

[0018] 5. Through the model iteration feedback module, the results of risk control operations are collected in real time for model training and threshold adjustment, so as to achieve continuous system optimization and enhance the security of financial transactions. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 This is a system overall block diagram of the present invention; Figure 2 This is a flowchart of the topology analysis and risk prediction unit of the present invention; Figure 3This is a flowchart of the intent decoupling and anomaly identification unit of the present invention. Detailed Implementation

[0020] The present application will now be described in further detail with reference to the accompanying drawings. It should be noted that the following specific embodiments are only used to further illustrate the present application and should not be construed as limiting the scope of protection of the present application. Those skilled in the art can make some non-essential improvements and adjustments to the present application based on the above application content.

[0021] Example 1: Please see Figure 1-3 This invention provides a technical solution: a real-time risk control system for abnormal transactions based on deep learning, the system comprising: Topology analysis and risk prediction unit, intent decoupling and anomaly identification unit, risk modeling and strategy optimization unit, risk scoring and risk control execution unit; The topology analysis and risk prediction unit is used to acquire real-time transaction flow data and perform structured processing to construct a transaction behavior topology evolution graph. It learns the evolution pattern of transaction topology through graph neural networks combined with temporal attention mechanisms, and identifies abnormal propagation characteristics to predict potential risky transaction paths. Real-time transaction stream data refers to the continuous transaction data generated during financial transactions. This data includes various transaction information, such as transaction time, transaction amount, and the accounts of both parties, and is characterized by its real-time and dynamic nature. Structured processing involves organizing and processing unstructured or semi-structured real-time transaction stream data according to certain rules and formats, transforming it into a data form with a clear structure and relationships, facilitating subsequent analysis and processing. Transaction behavior topology evolution graphs represent the relationships between transaction behaviors and their changes over time in a graph form. Nodes in the graph represent transaction entities, such as accounts and users, while edges represent transaction behaviors or relationships. The graph structure visually displays the network characteristics and evolutionary trends of transaction behaviors. Graph neural networks are a type of neural network model specifically designed for processing graph-structured data. They can automatically learn the feature representations of nodes and edges in the graph and transmit information between nodes through a message passing mechanism. Information propagation is used to capture complex relationships and patterns in the graph, making it suitable for analyzing transaction behavior topology evolution graphs. Temporal attention mechanisms, an extension of attention mechanisms, are used to process data with time-series characteristics. In transaction behavior analysis, it dynamically allocates different attention weights based on the importance of transaction information at different time points to the current prediction task, making the model focus more on transaction characteristics at key time points and improving its ability to learn transaction topology evolution patterns. Anomaly propagation features refer to the unique patterns and rules exhibited during this propagation process, such as the rapid spread of abnormal transactions between specific nodes or the specific direction of abnormal transaction paths. Potential risk transaction paths are predicted based on the learning of transaction topology evolution patterns and anomaly propagation features, indicating paths where abnormal transactions may occur in the future. Transactions on these paths have a high probability of risk and require early monitoring and prevention. The intent decoupling and anomaly identification unit is used to construct a multi-dimensional feature vector of transaction behavior. It maps the vector to the transaction intent space through self-supervised deep representation learning to obtain a low-dimensional intent vector. The intent decomposition network decouples the transaction behavior into multiple latent intent factors and calculates the weight ratio of each factor to identify abnormal behavior. Among them, multidimensional feature vectors quantify and combine various features of transaction behavior, such as transaction amount, transaction frequency, transaction time, and transaction location, into a single vector. This vector contains information from multiple aspects of the transaction behavior and can comprehensively describe its characteristics. Self-supervised deep representation learning, a deep learning technique, allows the model to automatically learn the inherent feature representation of data without manual labeling by designing specific self-supervised tasks. In transaction behavior analysis, it can utilize the structure and patterns of the transaction data itself to map the multidimensional feature vectors onto the transaction intent space, obtaining more representative and discriminative low-dimensional intent vectors. The transaction intent space is a high-dimensional space constructed by self-supervised deep representation learning, where each dimension represents a potential intent or feature of the transaction behavior. The position of the low-dimensional intent vector in this space reflects the main intent and features of the transaction behavior. The low-dimensional intent vector, after being mapped from the multidimensional feature vectors to the transaction intent space through self-supervised deep representation learning, is... The resulting vector is a concise representation of the trading intent, reducing data dimensionality while retaining key information about the trading behavior, facilitating subsequent analysis and processing. The intent decomposition network (IDN), a neural network model, further decomposes the low-dimensional intent vector into multiple latent intent factors. These latent intent factors represent different aspects of the trading intent, such as normal trading intent, fraudulent trading intent, and abnormal trading intent. Latent intent factors are latent variables representing different aspects of the trading intent, decomposed from the low-dimensional intent vector by the IDN. Each latent intent factor has a specific meaning and weight, reflecting the importance of that intent in the trading behavior. Factor weight ratios represent the relative importance of each latent intent factor in the trading behavior. By calculating these ratios, the influence of different intents on the trading behavior can be determined, thereby identifying abnormal behavior. For example, if the weight ratio of a certain latent intent factor is abnormally high, it may indicate that the trading behavior is abnormal. The risk modeling and strategy optimization unit is used to build a real-time risk decision-making environment model. Each transaction is used as a reinforcement learning decision state. The risk control strategy is optimized by combining deep reinforcement learning and introducing a strategy stability constraint mechanism to achieve adaptive real-time updates of the risk control strategy. Among them, the real-time risk decision-making environment model is a model used to simulate the real-time risk decision-making process of financial transactions. It considers various factors of transactions, such as transaction characteristics, market environment, user behavior, etc., as well as the interrelationships and dynamic changes between these factors, providing decision states and environmental feedback for reinforcement learning. Reinforcement learning, a machine learning method, learns the optimal strategy through the interaction between an agent and its environment. In financial transaction risk control, the agent, i.e., the risk control system, selects the corresponding risk control strategy and action based on the current transaction state and decision state, and receives rewards or penalties based on environmental feedback, such as whether the transaction was successful or whether there is risk, thereby continuously adjusting and optimizing the risk control strategy to achieve long-term risk control goals. The decision state, in reinforcement learning, is the environmental state in which the agent is at a certain moment. It contains all information related to the current decision. In financial transaction risk control, the decision state can include various characteristics of the transaction, the user's historical transaction behavior, market environment, and other information. Deep reinforcement learning is a method that combines deep learning and reinforcement learning. It uses deep neural networks to approximate reinforcement learning. The value function or policy function in reinforcement learning can handle high-dimensional state and action spaces, improving the learning and decision-making capabilities of reinforcement learning in complex environments. In financial transaction risk control, deep reinforcement learning can better learn the relationship between trading behavior and risk, optimizing risk control strategies. Risk control strategies are a series of rules and measures used in financial transaction risk control systems to control trading risks. They include regulations on transaction review standards, risk assessment methods, and risk control operations. Strategy stability constraint mechanisms are introduced to prevent excessive fluctuations or instability in risk control strategies during real-time updates. By setting certain restrictions or rules, they ensure that the updates of risk control strategies are smooth and gradual, avoiding system performance degradation or misjudgments due to sudden changes in strategies. Adaptive real-time updates enable risk control systems to automatically adjust and optimize risk control strategies based on real-time trading data and environmental changes, adapting to constantly changing trading scenarios and risk characteristics. Through deep reinforcement learning and strategy stability constraint mechanisms, adaptive real-time updates of risk control strategies are achieved, improving the system's risk control capabilities and flexibility. The risk scoring and risk control execution unit is used to integrate the risk transaction path prediction results, abnormal behavior identification results and adaptively updated risk control strategies to obtain a comprehensive transaction risk score, and to match and execute corresponding risk control operations based on the score. The overall transaction risk score is a numerical value calculated using specific algorithms and models, taking into account the predicted risk transaction path, the identification of abnormal behavior, and the adaptively updated risk control strategy. It quantifies the overall risk level of a transaction; a higher score indicates a greater risk. Risk control operations are a series of measures taken to control transaction risk based on the overall transaction risk score. Common risk control operations include rejecting transactions, limiting transaction amounts, requiring additional verification such as SMS verification codes and facial recognition, delaying transaction processing, and marking suspicious transactions for further investigation.

[0022] It should be noted that, during use, the topology analysis and risk prediction unit, utilizing graph neural networks and temporal attention mechanisms, can accurately capture transaction topology evolution patterns, effectively identify abnormal propagation characteristics, predict potential risk paths in advance, and enhance risk prediction capabilities. The intent decoupling and anomaly identification unit, by constructing multi-dimensional feature vectors and mapping them to the transaction intent space, can deeply analyze the various implicit intentions behind transaction behavior and accurately identify abnormal behavior. The risk modeling and strategy optimization unit constructs a real-time risk decision-making environment model, combines deep reinforcement learning to optimize risk control strategies, and introduces a stable constraint mechanism to achieve adaptive real-time updates, making the strategy more in line with actual trading scenarios. The risk scoring and risk control execution unit integrates multiple results to obtain a comprehensive risk score and executes corresponding operations, which can comprehensively and accurately control transaction risks and ensure the safety and stability of financial transactions.

[0023] In one embodiment, real-time transaction stream data is acquired and structured to construct a transaction behavior topology evolution graph, including: Collect raw transaction data generated in real time in the financial transaction system. The raw data includes at least the following core information: account identifier, device unique code, IP address, merchant code, transaction amount, transaction timestamp, fund transfer direction, and transaction channel. The raw data undergoes preprocessing operations such as data cleaning, duplicate data removal, missing value completion, and outlier correction. Unstructured text and address information are standardized and encoded to extract effective feature information that can be used for graph construction. Constructing an undirected dynamic transaction graph:

[0024] Among them, the node set It includes four types of core nodes, namely account nodes. Equipment Nodes IP Node Merchant Nodes The set of nodes is the union of all types of nodes, that is:

[0025] Each node is assigned a corresponding attribute feature vector; edge set It includes four core edge relationships, namely transaction relationship edges that represent the transaction behavior between accounts and merchants. , representing the shared edge of devices for multiple accounts sharing the same device IP sharing edge, representing multiple accounts sharing the same IP address. The fund circulation edge, representing the two-way flow of funds between multiple accounts. The edge set is the union of all edge relations, that is:

[0026] Each edge is assigned a corresponding weight value. The edge weight is determined based on the edge's association frequency, time relevance, and historical risk correlation. The higher the association frequency, the shorter the time interval, and the higher the historical risk correlation, the larger the edge weight value. The edge weight, after normalization, ranges from [value missing]. ; Set a continuous sliding time window ,in, The preset time window length. The value is determined based on the trading frequency of the business; for high-frequency trading, a smaller value is used. Low-frequency trading business takes a larger share The range of values ​​is , Given the current real-time trading time, within each time window, the node attribute characteristics, edge connectivity, and edge weights of the dynamic trading graph are dynamically updated based on changes in real-time trading data, forming a topological evolution graph of trading behavior that evolves over time.

[0027] in, The total number of consecutive time windows enables temporal modeling of the transaction behavior topology network.

[0028] This design collects raw financial transaction data, preprocesses and standardizes it to construct an undirected dynamic transaction graph, and sets a sliding time window to dynamically update the graph structure. This allows for real-time capture of changes in transaction behavior and presents the relationships between various elements in the transaction in a dynamic graph format. This provides a comprehensive and timely data foundation for subsequent analysis, helps to discover potential risk patterns and abnormal transaction chains, and improves the accuracy and timeliness of risk identification.

[0029] In one embodiment, the evolutionary pattern of transaction topology is learned by combining a graph neural network with a temporal attention mechanism to identify anomaly propagation characteristics and predict potential risky transaction paths, including: Training steps for a Graph Neural Network (GNN): Training data preparation: Collect historical transaction data from the past 6 months and divide it into training set, validation set, and test set in a ratio of 8:1:1. Construct a topological evolution diagram of historical transaction behavior on the training set data and label the risk tags corresponding to the abnormal propagation characteristics. For model initialization, Graph Attention Network is used as the core GNN model, with 3-5 graph convolutional layers, 128-256 dimensions in each hidden layer, 4-8 attention heads, an initial learning rate of 0.001, AdamW as the optimizer, and a weight decay coefficient of 0.0001. Iterative training is conducted using cross-entropy loss as the loss function. The batch size is set to 32-64, and the number of training epochs is 50-100. After each training epoch, the accuracy of the model in identifying anomaly propagation features is evaluated on the validation set. If the accuracy on the validation set does not improve for 5 consecutive epochs, training is stopped. Model tuning employed a grid search method to optimize hyperparameters, focusing on adjusting the number of graph convolutional layers, the number of attention heads, and the learning rate to improve the accuracy of anomaly propagation feature recognition on the test set. ; Temporal attention mechanism and anomaly detection steps: The node feature matrix of the transaction behavior topology evolution graph under each time window. and adjacency matrix Input the trained graph neural network GNN, where This represents the total number of nodes in the topological evolution graph. To extract the spatial topological features of the transaction graph within each time window, using the graph convolutional and pooling layers of a graph neural network, the spatial topological feature matrix is ​​obtained.

[0030] in, The extracted spatial feature dimensions, For time window identification; A temporal attention mechanism is introduced to perform temporal fusion of spatial topological features across multiple time windows. A multilayer perceptron is used to perform nonlinear mapping on the spatial topological features of each time window to obtain attention scores for each window. Then, the temporal attention weights are obtained by normalization using a softmax function. The calculation formula is:

[0031] in, It is a multilayer perceptron, consisting of two fully connected layers and a ReLU activation function, with a hidden layer dimension of 64, used to map high-dimensional spatial topological features into one-dimensional attention scores; Based on the calculated temporal attention weights, the spatial topological features of all time windows are weighted and summed to obtain the transaction topological temporal evolution features that integrate spatial and temporal information:

[0032] Achieve deep learning of transaction topology evolution patterns; Three core anomaly propagation features were extracted from the temporal evolution characteristics of the transaction topology, namely the diffusion speed of anomalous transactions in the graph. The closed-loop flow characteristics of funds among multiple accounts High-connection-density subgraph features rapidly formed by newly registered accounts ; The diffusion rate The value representing the change in the number of nodes associated with abnormal transactions per unit time is calculated as follows:

[0033] in, In the time window Changes in the number of nodes associated with internal abnormal transactions; new account connection density. The ratio of the number of edges in the subgraph containing the new account node to the maximum possible number of edges in that subgraph is calculated as follows:

[0034] in, This represents the actual number of edges existing between the new account nodes. This represents the total number of new account nodes that appear within the time window. Preset diffusion rate threshold New account connection density threshold Both thresholds are determined based on the statistical characteristics of historical abnormal transaction samples. The 90th percentile of the diffusion rate and new account connection density in the historical abnormal transaction samples is taken as the corresponding threshold, and the thresholds are iteratively updated based on the newly added abnormal transaction samples each month. When the diffusion rate is detected... The capital circulation forms a closed loop, that is... New account connection density When any one or more features are selected, the transaction topology features of that time window are input into the path prediction layer of the graph neural network. Through graph attention mechanism and path search algorithm, the potential risk transaction propagation path and associated accounts, devices, and IP nodes are predicted.

[0035] This design involves first preparing training data and initializing the graph neural network model. After iterative training and optimization, a temporal attention mechanism is introduced to integrate features from multiple time windows, extract anomaly propagation features, and predict risk paths. This allows for in-depth mining of the temporal evolution of transaction topologies, accurate identification of anomaly propagation features, and early prediction of potential risk transaction paths, providing strong support for risk control decisions and effectively preventing risky behaviors such as financial fraud.

[0036] In one embodiment, a multi-dimensional feature vector of transaction behavior is constructed, and a low-dimensional intent vector is obtained by mapping it to the transaction intent space through self-supervised deep representation learning, including: Training steps for a self-supervised deep representation learning model: Training data preparation: Collect user historical transaction behavior data for nearly 12 months, and select the effective sample size. The data were divided into training and validation sets in a 9:1 ratio, and the transaction behavior features were preprocessed using normalization. For model initialization, a Transformer-based encoder-decoder structure is adopted. The encoder contains 6-8 Transformer Block layers, each with 8 attention heads, a hidden layer dimension of 256, and a feedforward network dimension of 1024. The decoder structure is symmetrical to the encoder. The initial learning rate is 0.0005, and the optimizer is Adam. The weight decay coefficient is 0.0001; Self-supervised training is employed, using feature mask reconstruction as the self-supervised task, with random masks. The input feature dimension is set, and the mean squared error (MSE) of the reconstructed mask features is used as the loss function. The batch size is set to 128, and the number of training epochs is 80-100. The reconstruction error is evaluated on the validation set every 10 epochs. Training should be stopped immediately. Dimensionality reduction validation: Principal component analysis (PCA) is used to validate the variance explanation rate of the low-dimensional intent vector to ensure that the preset requirements are met. Feature vector construction and mapping steps: From the preprocessed real-time transaction data, five core multidimensional features are extracted for the continuous transaction behavior of a single account to construct the original transaction behavior feature vector:

[0037] in, The distribution characteristics of transaction amounts include statistical measures such as the mean, variance, extreme values, and quantiles of individual transaction amounts; The time interval pattern features include the mean, variance, and trading time period preference of adjacent transactions. Merchant type preference characteristics include industry classification, frequency ratio, consumption scenario, and other features of the transacting merchants; The device switching frequency characteristic includes features such as the number of times trading devices are switched per unit time and changes in device type. Geographic location change characteristics include the frequency of changes in the geographic location of the transaction IP and the distance of cross-regional transactions; Z-score normalization is applied to each dimension of the original transaction behavior feature vector to eliminate the dimensional differences between different feature dimensions, resulting in a normalized feature vector. The normalization formula for a single dimension is:

[0038] in, For the first The mean of the dimensional feature in the historical transaction sample set. For the first The standard deviation of the dimensional feature in the historical transaction sample set; Normalized feature vectors The encoder of the trained self-supervised deep representation learning model is input, and the high-dimensional transaction behavior features are nonlinearly reduced in dimensionality and fused through the encoder, mapping them to a low-dimensional transaction intent space to generate a low-dimensional intent vector. ,Right now:

[0039] in, Let be the dimension of the intent vector, and satisfy . Intent vector dimension The variance explanation rate is determined based on feature dimensionality reduction; a value that maximizes the variance explanation rate is selected. The smallest integer as The decoder uses the reconstruction loss to perform self-supervised training on the model, ensuring that the low-dimensional intent vector can fully represent the core features of the original transaction behavior.

[0040] This design involves initializing the model with training data, and after self-supervised training and dimensionality reduction verification, constructing and mapping multi-dimensional feature vectors. This transforms complex, high-dimensional transaction behavior features into low-dimensional intent vectors, reducing data dimensionality and computational complexity while retaining core features. This facilitates subsequent analysis and processing, helps to more accurately understand transaction intent, and provides a foundation for abnormal behavior identification and risk assessment.

[0041] In one embodiment, the intent decomposition network decouples transaction behavior into multiple types of latent intent factors, calculates the weight ratio of each factor to identify abnormal behavior, including: Intended to decompose network training steps: Training data annotation: For the transaction behavior corresponding to the low-dimensional intent vector output by the self-supervised model, risk control experts annotate the data with three types of intent labels: normal consumption, abnormal arbitrage, and fraud attack. The number of annotated samples is ≥500,000, and the training set, validation set, and test set are divided in an 8:1:1 ratio. Network initialization: The intention is to decompose the network into three fully connected layers, with the input layer having a dimension of [missing information]. Consistent with the intent vector dimension, the hidden layer dimensions are 64 and 32, and the output layer dimension is 3. The activation functions used are ReLU (hidden layer) and Softmax (output layer). The initial learning rate is 0.001, the optimizer is SGD, the momentum coefficient is 0.9, and the loss function is cross-entropy loss. Iterative training is performed with a batch size of 64 and 60-80 training rounds. After each training round, the accuracy of intent factor classification is evaluated on the validation set. If the accuracy does not improve for three consecutive rounds, the learning rate is decayed with a decay coefficient of 0.9, and training continues. Model validation, accuracy of intent factor classification on the test set. If training is not completed on time, the network structure should be readjusted. Intent factor decomposition and anomaly identification steps: Low-dimensional intent vectors generated by a self-supervised deep representation learning model The input layer of the trained intent decomposition network is input to the hidden layer, and through nonlinear transformation of the hidden layer, the original weight values ​​of the three hidden intent factors are decoupled and obtained. ,in, The original weights of the normal consumption intention factor, Original weights for abnormal arbitrage intent factors, The original weights of the fraudulent attack intent factor; The original weights of the three latent intent factors are normalized using the softmax activation function to obtain the normalized weight ratios of each intent factor in the trading behavior. The formula for calculating the weight ratio of a single factor is:

[0042] And after normalization, it satisfies The magnitude of the weight ratio represents the contribution of the corresponding intention factor to the transaction behavior; Statistical analysis based on historical fraudulent transaction samples, with preset weight thresholds for factors related to fraudulent attack intent. First, calculate the mean weighting of the fraud attack intent factor in the historical fraud transaction samples. and standard deviation ,Pick As a threshold, and the threshold is dynamically adjusted according to the characteristics of quarterly fraudulent transaction samples, the weight ratio of the fraudulent attack intent factor calculated in real time is used. With threshold Compare; when When the account's current transaction behavior is deemed to have abnormal fraudulent tendencies, an abnormal behavior identification warning is triggered, and the corresponding intent factor weight ratio data is output.

[0043] This design initializes the intent decomposition network with labeled training data. After iterative training and validation, it decomposes intent factors and identifies anomalies, decoupling the complex intent behind transaction behavior, clarifying the contribution of each intent factor, and accurately identifying abnormal fraudulent behavior by comparing it with preset thresholds. This improves the targeting and effectiveness of risk control and reduces misjudgments and omissions.

[0044] In one embodiment, a real-time risk decision-making environment model is constructed, treating each transaction as a reinforcement learning decision state, and combining deep reinforcement learning to optimize risk control strategies, including: Training steps for deep reinforcement learning strategy networks: Environment modeling: Based on historical risk control data, a simulated trading risk control environment is constructed, including 100,000+ labeled transaction samples (normal / abnormal), defining the mapping relationship between state, action, and reward function; The policy network was initialized using the PPO algorithm. The policy network consists of four fully connected layers: the input layer dimension is the state feature dimension (≥64), the hidden layer dimensions are 256, 128, and 64, and the output layer dimension is the action space dimension (4). The initial learning rate was 0.0003, and the discount factor was... =0.9, shear coefficient =0.2, batch size set to 64, update cycle is 2048 steps; Intensify training and employ an exploration-exploitation strategy. -greedy, The initial value is 0.9, decreasing by 0.01 every 1000 steps, eventually reaching 0.1, with a cumulative training step count. Every 50,000 steps, the risk control accuracy and false interception rate of the strategy are evaluated in a verification environment. Strategy validation, when validating risk control accuracy in the environment. And false interception rate At that time, the policy network training is completed; Risk decision-making environment and strategy optimization steps: Constructing a real-time risk decision-making environment model for Markov decision processes:

[0045] in, For the state space of risk control decisions, Provides the scope for risk control execution. Reward function for strategy optimization Discount factor for future rewards, discount factor Determined based on the long-term optimization needs of the risk control strategy, with an emphasis on short-term risk control effectiveness. Focusing on long-term risk control effectiveness And satisfy This is used to balance immediate rewards with long-term rewards; state space Each decision state in A combination of multi-dimensional features of a single transaction, i.e. ,in This refers to the real-time characteristics of the current transaction, including transaction amount, merchant, and transaction channel; This includes characteristics of a user's historical transaction behavior, such as transaction frequency, amount range, and risk control records. The network relationship characteristics of the transaction behavior topology evolution graph include the graph node degree, associated node type, edge weight, etc. of the transaction account; Action space It includes four types of tiered risk control execution actions, namely: ,in This allows for direct transactions without additional risk control intervention. To trigger secondary verification, users are required to complete verification operations such as SMS verification and facial recognition; To enforce transaction limits, the transaction amount or number of transactions for this account is restricted in the current and short term; The account is temporarily frozen, and all trading activities are prohibited. Define the reward function based on the actual effect of risk control decisions. The reward value is calculated based on the execution results of different risk control actions. The reward function is a piecewise function, and the calculation formula is as follows:

[0046] Among them, positive reward value and penalty value Determined based on the risk tolerance of risk control operations; the lower the risk tolerance, the lower the risk tolerance. The larger the value, The larger the value, the better, and it should be set according to business requirements. , All numbers are positive to prevent the strategy from excessively blocking normal transactions; The trained policy network Applied to real-time risk control, the optimization objective of the strategy network is to maximize cumulative rewards. The formula for calculating cumulative rewards is:

[0047] By continuously iterating and updating the strategy network parameters through the PPO algorithm optimized by the near-end strategy, dynamic optimization of the risk control strategy can be achieved.

[0048] This design first initializes the strategy network through environment modeling. After reinforcement training and verification, a decision environment model is built and the strategy is optimized. The risk control decision-making process is simulated through reinforcement learning. The risk control strategy is dynamically optimized based on real-time transaction status and historical experience, making the strategy more in line with actual business needs, improving the accuracy and efficiency of risk control, and effectively balancing risk prevention and normal transaction experience.

[0049] In one embodiment, a strategy stability constraint mechanism is introduced to achieve adaptive real-time updates of the risk control strategy, including: To avoid the risk control strategy from being over-updated or mutated due to fluctuations in real-time transaction data, a strategy stability constraint mechanism is introduced. This mechanism includes two layers of constraint logic: a limit on the update magnitude of strategy parameters and a moving average filter for strategy parameters. Set the threshold for the update magnitude of the policy network parameters. Update amplitude threshold The threshold is determined based on the historical update magnitude of the policy network parameters. The 95th percentile of the historical parameter update magnitude is taken as the threshold, and the threshold is gradually reduced with the training iteration of the policy network. Each time the policy network parameters are updated using the gradient descent method, the Euclidean distance between the parameters before and after the update is calculated. ,in, The policy network parameters before the parameter update. These are the updated policy network parameters calculated using the gradient descent method. like Then, the parameter update values ​​are pruned so that the pruned parameter update magnitude meets the following requirements. , The updated parameters after cropping; The policy network parameters are smoothed by performing a moving average filter on the continuously updated policy network parameters. The formula for calculating the moving average is:

[0050] Among them, smoothing coefficient Determined based on the smoothing requirements of the strategy, with an emphasis on strategy stability. Emphasis on policy adaptability And satisfy , For the first Smoothed parameters after secondary parameter updates For the first Smoothed parameters after secondary parameter updates For the first The original cropped parameters are updated using the next parameter; Policy network deployment and update steps: Incremental training involves collecting daily risk control transaction data, labeling it, and using it as incremental training samples. The strategy network is trained incrementally every 7 days, with 10-20 training rounds, and the learning rate is reduced to 1 / 10 of the initial value. Strategy validation: The incrementally trained strategy needs to be validated in a simulation environment to meet the risk control accuracy requirements. And false interception rate It can only be launched at that time; A canary release approach is used when updating and deploying the new strategy, applying it to the system first. The transaction volume gradually increased after 24 hours of operation without any abnormalities. ; Smoothed policy network parameters As a parameter that actually takes effect, the risk control decision-making strategy is updated based on this parameter, so that the strategy can be adaptively adjusted according to changes in real-time fraudulent transaction patterns. At the same time, the risk control strategy is gradually evolved through amplitude limits and moving averages to avoid excessive fluctuations affecting normal trading operations.

[0051] This design, by setting parameter update thresholds and using moving average filtering, and through incremental training, validation, and gray-scale update deployment strategies, avoids excessive updates to the strategy due to data fluctuations, ensuring a balance between strategy stability and adaptability. This allows the risk control strategy to adaptively adjust according to real-time changes in fraud patterns, while minimizing the impact on normal trading operations and ensuring stable system operation.

[0052] In one embodiment, a comprehensive transaction risk score is obtained by fusing risk transaction path prediction results, abnormal behavior identification results, and adaptively updated risk control strategies. The corresponding risk control operations are then matched and executed based on the score, including: The results of risk transaction path prediction and abnormal behavior identification are quantitatively scored, including the risk path prediction score. The scoring range is determined based on the probability that a trading account is predicted to be a core node in a risk path. The higher the probability, the better. The higher the score; Abnormal behavior identification scoring Based on the weighting of the fraudulent attack intent factor The calculation determines the scoring range as follows: The calculation formula is:

[0053] in, , These are the historical minimum and maximum values ​​of the weighting ratio of the fraudulent attack intent factor, respectively. The weighting coefficients for the two scores are set based on the actual needs of risk control operations. And satisfy The weighting coefficients are dynamically adjusted based on the risk control accuracy rates of risk path prediction and abnormal behavior identification. Let the risk control accuracy rates be respectively... , ,but:

[0054] Furthermore, the accuracy rate is recalculated and the weights are updated monthly based on the effectiveness of risk control, and a comprehensive risk score for each transaction is obtained by weighted summation. The calculation formula is:

[0055] Multiple comprehensive risk scoring ranges are preset. The thresholds for each scoring range are determined based on the sample distribution of historical risk control transactions and the false interception rate requirements of the risk control business. The lower the false interception rate requirement, the lower the threshold for the scoring range is set. The scoring range is divided into... Four risk levels, each matching the corresponding risk control action in the adaptively updated risk control strategy. The risk control actions, from low to high, are: direct rejection of the transaction, secondary verification, transaction limit, and account freezing, based on the comprehensive risk score calculated in real time. Within the specified timeframe, the corresponding risk control operations are triggered and executed in real time within the financial trading system to achieve real-time risk control for abnormal transactions. Risk control operation feedback and model iteration: After the risk control operation is executed, the final risk result of the transaction is recorded and divided into normal / abnormal. The feedback data is used monthly for iterative training of graph neural network, intent decomposition network and policy network to adjust model parameters and thresholds and continuously optimize the risk control effect.

[0056] This design quantifies and scores the results of risk path prediction and abnormal behavior identification, then weights and sums them to obtain a comprehensive risk score. This score is then matched with risk control actions and executed. The results are recorded for model iteration. By integrating multiple aspects of risk information, the transaction risk is comprehensively assessed. Based on the score, risk control operations are accurately matched to achieve real-time risk control. At the same time, the model is continuously optimized through feedback data to improve the performance and effectiveness of the risk control system.

[0057] Those skilled in the art will understand that all or part of the steps in the methods of the above embodiments can be implemented by a program instructing related hardware. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0058] The above embodiments provide a detailed description of the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A real-time risk control system for abnormal transactions based on deep learning, characterized in that, The system includes: Topology analysis and risk prediction unit, intent decoupling and anomaly identification unit, risk modeling and strategy optimization unit, risk scoring and risk control execution unit; The topology analysis and risk prediction unit is used to process real-time transaction stream data and construct a transaction behavior topology evolution graph. It combines graph neural networks and temporal attention mechanisms to learn topology evolution patterns, identify abnormal propagation characteristics, and predict potential risky transaction paths. The intent decoupling and anomaly recognition unit is used to construct a multi-dimensional feature vector of transaction behavior, which is mapped into a low-dimensional intent vector through self-supervised deep representation learning, and then decoupled into a latent intent factor through an intent decomposition network to identify abnormal behavior. The risk modeling and strategy optimization unit is used to build a real-time risk decision-making environment model, taking transactions as reinforcement learning decision states, combining deep reinforcement learning to optimize risk control strategies and achieve adaptive real-time updates of strategies. The risk scoring and risk control execution unit comprehensively considers the risk transaction path prediction results, abnormal behavior identification results, and adaptively updated risk control strategies to obtain a comprehensive transaction risk score. Based on the score, it matches and executes the corresponding risk control operations. The intent decoupling and anomaly detection unit includes: The module includes a feature vector construction module, a self-supervised representation learning module, an intent decomposition module, and an abnormal behavior recognition module. The feature vector construction module is used to extract five core features from preprocessed real-time transaction data: transaction amount distribution, time interval pattern, merchant type preference, device switching frequency, and geographical location change, and to construct and normalize the original transaction behavior feature vector. The self-supervised representation learning module adopts a Transformer-based encoder-decoder structure. After self-supervised training, it maps the normalized feature vectors to the transaction intent space, generating a low-dimensional intent vector that can represent the core features of transaction behavior. The intent decomposition module decouples the low-dimensional intent vector into multiple latent intent factors through the trained intent decomposition network and calculates the normalized weight ratio of each factor. The abnormal behavior identification module identifies and warns of abnormal transaction behavior by comparing the real-time weight ratio with the preset intent factor threshold and a preset intent factor threshold. The intent decomposition network is a fully connected network structure. After training with labeled samples, it decouples the low-dimensional intent vector. The output latent intent factors include at least three categories: normal consumption, abnormal arbitrage, and fraudulent attack. The weight ratio of each factor is normalized by the softmax function to ensure that the sum of the weights is 1. The threshold of the abnormal behavior identification module is determined based on the statistical characteristics of historical fraudulent transaction samples and is dynamically updated based on new samples. When the weight ratio of the fraudulent attack intent factor exceeds the threshold, an abnormal behavior warning is triggered.

2. The real-time risk control system for abnormal transactions based on deep learning according to claim 1, characterized in that, The topology analysis and risk prediction unit includes: The system includes a data acquisition module, a data preprocessing module, a topology evolution graph construction module, and a risk path prediction module. The data acquisition module is used to collect real-time raw data of the transaction flow in the financial transaction system. The raw data includes core information such as account, device, IP, merchant, transaction amount, transaction time, fund flow, and transaction channel. The data preprocessing module is used to clean, deduplicatize, complete, correct, and standardize the raw data, and extract effective features from the graph. The topology evolution graph construction module is used to construct an undirected dynamic transaction graph that includes multiple types of nodes and edges, and dynamically updates the node attributes, edge relationships and edge weights of the graph through a sliding time window to form a transaction behavior topology evolution graph. The risk path prediction module is used to extract the temporal evolution features of the transaction topology through a trained graph neural network and a temporal attention mechanism, identify abnormal propagation features, and predict potential risk transaction paths and related nodes.

3. The real-time risk control system for abnormal transactions based on deep learning according to claim 2, characterized in that, The node set of the undirected dynamic transaction graph includes: Account nodes, device nodes, IP nodes, and merchant nodes are each assigned a corresponding attribute feature vector; The edge set includes transaction relationship edges, equipment sharing edges, IP sharing edges, and fund circulation edges. Each edge is assigned a weight value that is determined and normalized based on the frequency of association, time relevance, and historical risk relevance. The length of the sliding time window is dynamically set according to the frequency of transaction business, with a value range of 5s-30min. Based on this window, the time-series modeling of the transaction behavior topology network is realized.

4. The real-time risk control system for abnormal transactions based on deep learning according to claim 2, characterized in that, The risk path prediction module includes the following steps: The graph neural network, with the Graph Attention Network as its core, achieves anomaly propagation feature recognition after training and optimization. The temporal attention mechanism calculates the temporal attention weights through a multilayer perceptron and a softmax function, and obtains the transaction topology temporal evolution features that integrate spatiotemporal information by weighted summation of the spatial topological features of multiple time windows. From this feature, three core abnormal propagation features are extracted: abnormal transaction spread speed, closed-loop fund return, and high connection density subgraph of newly registered accounts. Preset feature thresholds are used. When a feature is detected to exceed a threshold, a graph attention mechanism and a path search algorithm are used to predict potential risky transaction paths.

5. The real-time risk control system for abnormal transactions based on deep learning according to claim 1, characterized in that: The self-supervised training of the self-supervised representation learning module adopts a feature mask reconstruction task, with the mean squared error of the reconstructed mask features as the loss function. After training, principal component analysis is used to verify the variance explanation rate of the low-dimensional intent vector, ensuring that the variance explanation rate is ≥90%. The dimension of the low-dimensional intent vector is determined based on the variance explained rate, and the smallest integer that meets the requirements is selected, with the dimension being less than 5.

6. The real-time risk control system for abnormal transactions based on deep learning according to claim 1, characterized in that, The risk modeling and strategy optimization unit includes: The module includes a risk decision-making environment construction module, a deep reinforcement learning training module, a policy stability constraint module, and a policy update module. The risk decision-making environment construction module is used to build a real-time risk decision-making environment model of the Markov decision process, defining a state space including multi-dimensional characteristics of transactions, an action space of gradient risk control actions, a piecewise reward function based on risk control effect, and a discount factor. The deep reinforcement learning training module uses a proximal policy optimization algorithm to construct and train a policy network, with the goal of maximizing cumulative rewards, to achieve initial optimization of the risk control strategy. The strategy stability constraint module uses two layers of constraints—parameter update magnitude limitation and parameter moving average filtering—to prevent excessive updates and sudden changes in the risk control strategy. The strategy update module achieves adaptive real-time updates of risk control strategies through incremental training, simulation verification, and canary release.

7. The real-time risk control system for abnormal transactions based on deep learning according to claim 6, characterized in that, The action space includes: The risk control measures are implemented through four tiered approaches: direct transaction, triggering secondary verification, executing transaction limits, and temporarily freezing accounts. The reward function sets positive rewards, negative penalties, and zero rewards based on whether the risk control action successfully blocks fraudulent transactions, incorrectly intercepts normal transactions, or handles risk-free transactions. The negative penalty is 2-5 times the positive reward. The policy stability constraint module sets a threshold for the update magnitude of policy network parameters, prunes parameter update values ​​that exceed the threshold, and performs moving average filtering on continuously updated parameters. The smoothing coefficient is dynamically set according to policy stability or adaptive requirements. The strategy update module collects incremental training samples daily and performs incremental training regularly. After the trained strategy is verified to meet the standards in the simulation environment, it is gradually launched online in a gray-scale release manner.

8. The real-time risk control system for abnormal transactions based on deep learning according to claim 1, characterized in that, The risk scoring and risk control execution unit includes: The module includes a quantitative scoring module, a comprehensive scoring fusion module, a risk control operation matching module, and a model iteration feedback module. The quantitative scoring module provides quantitative scores for the risk transaction path prediction results and the abnormal behavior identification results, with a score range of 0-100. The comprehensive scoring fusion module dynamically sets weighting coefficients based on the risk control accuracy of the two quantitative scoring modules, and obtains the comprehensive transaction risk score by weighted summation. The risk control operation matching module presets multiple comprehensive risk score ranges, matches the score ranges with the graded risk control actions in the risk control strategy, and triggers and executes the corresponding risk control operations based on the real-time comprehensive risk score. The model iteration feedback module records the final risk results of transactions after risk control operations, and uses the feedback data regularly for iterative training of various neural network models in the system to adjust model parameters and various thresholds, and continuously optimize the risk control effect. The weighting coefficients of the comprehensive risk score are recalculated and updated monthly based on the risk control effect, and the threshold of the score range is determined based on the historical risk control transaction sample distribution and the false interception rate requirements.

Images