An ai-based payment risk real-time early warning method and system

Abstract

This invention relates to the field of AI-based risk control technology in financial payments, specifically to an AI-based real-time payment risk early warning method and system. The method includes: acquiring transaction behavior feature records containing standardized transaction amount ranges, transaction time slice distributions, and a relational graph of transaction participants; deconstructing the relational graph using a graph structure analyzer to extract potential indirect correlation paths between the transaction initiator and historical risk accounts, generating a risk correlation feature vector, and combining this with multi-dimensional behavioral analysis to obtain a behavioral deviation index; inputting the two types of features into a risk decision fusion model to obtain a comprehensive risk score; generating a dynamic risk threshold based on the risk level; triggering an early warning signal when the score exceeds the threshold, and generating an early warning instruction containing a risk cause code and interception suggestions. This method can uncover multi-level hidden risk correlations, dynamically adapt to the threshold settings for transaction risk levels, improve the completeness of risk feature extraction, and optimize the adaptation effect of risk early warning judgment.

Description

Technical Field

[0001] This invention relates to the field of AI risk control technology in financial payments, and in particular to an AI-based real-time early warning method and system for payment risks. Background Technology

[0002] Current conventional technologies in the field of real-time payment risk early warning mostly rely on superficial behavioral characteristics such as transaction amount and transaction time as detection basis. At the participant correlation analysis level, they can only identify the direct relationship between the transaction initiator and the risky account, and risk determination largely depends on preset fixed thresholds to trigger early warning operations. This type of technology is widely used in real-time risk control scenarios for financial payment transactions. It mainly achieves risk screening through single-dimensional feature comparison and static rule matching, and is a relatively common risk prevention and control method in the industry.

[0003] Conventional payment risk warning technologies focus only on direct links at the relationship mining level, failing to deconstruct multi-level relationships among transaction participants and struggling to capture hidden indirect connections between transaction initiators and historically risky accounts, resulting in blind spots in the extraction of risk correlation features. At the risk threshold setting level, fixed thresholds cannot be adapted to the risk level of transactions, and using a uniform judgment standard for transactions with different risk attributes leads to insufficient adaptability in warning judgments. This invention aims to overcome the technical limitations of being unable to mine indirect relationship paths and simultaneously solve the technical problem of risk thresholds not being able to dynamically adjust with transaction risk levels. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an AI-based real-time payment risk warning method and system.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: an AI-based real-time payment risk early warning method, comprising: Obtain transaction behavior feature records, which include standardized transaction amount ranges, transaction time slice distributions, and transaction participant association graphs; The transaction participant association graph in the transaction behavior feature record is input into the graph structure analyzer for relationship chain deconstruction, extracting the potential indirect association path between the transaction initiator and the historical risk account, and generating a risk association feature vector; Multidimensional behavioral pattern analysis is performed on the transaction time slice distribution and the standardized transaction amount range to identify abnormal behavioral patterns that deviate from the normal behavioral baseline and obtain a behavioral deviation index. The risk-related feature vector and the behavioral deviation index are input into the risk decision fusion model to perform cross-validation and weight allocation of the features, and generate a comprehensive risk score. Based on the comprehensive risk score, the corresponding risk level is matched from the preset risk management strategy library, and the feature parameters under the risk level are called to generate a dynamic risk threshold for the current transaction. The overall risk score of the current transaction is compared with the dynamic risk threshold. When the overall risk score exceeds the dynamic risk threshold, a risk warning signal is triggered, and a warning instruction containing a risk reason code and a transaction interception suggestion is generated.

[0006] As a further aspect of the present invention, the acquisition of transaction behavior feature records includes: The raw transaction flow data containing the transaction serial number, transaction amount, transaction time, transaction initiator device identifier and transaction recipient account information is obtained from the payment transaction gateway and formed into a queue of transaction data to be processed. The transaction data queue is cleaned and standardized. After removing outliers, the remaining data is converted into unified transaction behavior feature records, specifically including: For each transaction record in the transaction data queue, check whether its transaction amount is outside the preset legal business scope and whether the transaction time falls within the system's allowed operating hours; Transaction records that do not meet the validity check are marked as invalid records and removed from the transaction data queue. The remaining valid records enter the formatting and conversion stage. In the formatting and conversion process, the transaction amount is mapped to discrete amount level labels, the transaction occurrence time is mapped to a fixed time window index, and a unique hash value of the transaction initiator's device identifier is recorded. The amount level label, time window index, unique hash value, and transaction recipient account information are structured and encapsulated to generate a complete record of the transaction behavior characteristics.

[0007] As a further aspect of the present invention, the transaction participant association graph in the transaction behavior feature record is input into a graph structure analyzer for relationship chain deconstruction, extracting potential indirect association paths between the transaction initiator and historical risk accounts, and generating a risk association feature vector, including: Import the transaction participant association graph into the graph database, and use the current transaction initiator node as the starting point and the preset set of historical risk account nodes as the ending point set. The breadth-first traversal algorithm is executed in the graph database to search for the shortest path and the second shortest path between the starting point and the ending point set, while limiting the search depth to no more than the set upper limit of the number of hops; Risk assessment is performed on all searched associated paths, and the risk transmission coefficient of each associated path is calculated based on the risk attributes of the nodes in the path and the connection frequency of the edges. The risk transmission coefficients of the shortest path, the second shortest path, and the total number of associated paths are normalized and concatenated into a multidimensional numerical sequence, which is the risk association feature vector.

[0008] As a further aspect of the present invention, multidimensional behavioral pattern analysis is performed on the transaction time slice distribution and the standardized transaction amount range to identify abnormal behavioral patterns that deviate from the normal behavioral baseline, thereby obtaining a behavioral deviation index, including: Retrieve recent historical transaction data associated with the device identifier of the transaction initiator to construct a normal behavior baseline model of the subject. The normal behavior baseline model records the average transaction frequency and regular transaction amount range of the subject in different time periods. The deviation factor in the time dimension is obtained by calculating the ratio of the transaction time slice distribution of the current transaction to the average transaction frequency of the corresponding time period in the normal behavior baseline model. Calculate the percentage of intersection between the standardized transaction amount range of the current transaction and the regular transaction amount range in the normal behavior baseline model to obtain the deviation factor in the amount dimension; The deviation factors in the time dimension and the deviation factors in the monetary dimension are input into the anomaly detection function. After weighted calculation, a scalar value is obtained, and the scalar value is used as the behavioral deviation index.

[0009] As a further aspect of the present invention, the risk-related feature vector and the behavioral deviation index are jointly input into the risk decision fusion model to perform cross-validation and weight allocation of the features, generating a comprehensive risk score, including: Initialize two parallel computing channels in the risk decision fusion model, which are used to receive the risk-related feature vector and the behavior deviation index, respectively. In the risk association calculation channel, the received risk association feature vector is matched with the pre-stored risk pattern template for similarity, and an association risk score is output. In the behavior analysis calculation channel, the received behavior deviation index is compared with the pre-stored behavior risk level table, and a behavior risk score is output. The associated risk score and behavioral risk score are sent to the decision fusion layer. The decision fusion layer dynamically adjusts the fusion weight of the two scores according to the threat level of the current business scenario, and linearly combines the two scores to output the final comprehensive risk score. The steps for constructing the risk decision fusion model include: Based on historical fraud and normal transaction samples, a model training dataset is constructed that includes risk-related feature vectors and behavioral deviation indicators as input features. The input features in the model training dataset are then standardized and preprocessed. A dual-channel parallel processing structure is constructed, which includes a risk correlation calculation channel and a behavior analysis calculation channel. A multilayer perceptron network is embedded in the risk correlation calculation channel, and an ensemble learner based on gradient boosting tree is embedded in the behavior analysis calculation channel, which are used to process risk correlation feature vectors and behavior deviation indicators, respectively. In the decision fusion layer, a trainable weight allocation matrix is ​​configured, and the association risk score output by the multilayer perceptron network and the behavior risk score output by the gradient boosting tree-based ensemble learner are taken as inputs and weighted summed through the trainable weight allocation matrix to generate a comprehensive risk score. The multilayer perceptron network, the gradient boosting tree-based ensemble learner, and the trainable weight assignment matrix are jointly and iteratively trained using the model training dataset through backpropagation algorithm to minimize the loss function between the comprehensive risk score and the true risk label of historical transactions until the model converges, thus completing the construction of the risk decision fusion model.

[0010] As a further aspect of the present invention, based on the comprehensive risk score, a corresponding risk level is matched from a preset risk management strategy library, and feature parameters under the risk level are invoked to generate a dynamic risk threshold for the current transaction, including: In the pre-set risk management strategy library, establish a mapping relationship table between comprehensive risk scoring range and risk level, as well as the risk threshold adjustment coefficient corresponding to each risk level; The calculated comprehensive risk score is matched with the score range in the mapping table to determine the specific risk level of the current transaction; Read the risk threshold adjustment coefficient corresponding to the specific risk level, and obtain the baseline risk threshold configured by the system; The result of multiplying the baseline risk threshold by the risk threshold adjustment coefficient is used as the dynamic risk threshold for this judgment.

[0011] As a further aspect of the present invention, when the comprehensive risk score exceeds the dynamic risk threshold, a risk warning signal is triggered, and a warning instruction containing a risk reason code and a transaction interception suggestion is generated, including: In the risk assessment logic, the comprehensive risk score is compared with the dynamic risk threshold. When the comprehensive risk score is determined to be greater than the dynamic risk threshold, the early warning generation process is activated. From the internal state of the risk decision fusion model, trace back the main source of the characteristics that lead to high risk. If the main source is the risk-related feature vector, generate a cause code that represents the associated risk. If the main source is the behavioral deviation index, generate a cause code that represents the abnormal behavior. Based on the specific business type and risk level of the current transaction, the risk handling strategy library is searched to determine whether to execute strong interception or weak verification, which serves as a transaction interception suggestion. The risk cause code and transaction interception suggestion are packaged together and the current transaction serial number is attached to assemble them into a structured warning instruction.

[0012] As a further aspect of the present invention, the step of tracing back from the internal state of the risk decision fusion model to identify the main characteristic sources leading to high risk includes: An attention tracking mechanism is embedded in the risk decision fusion model, which records the contribution weight of each input feature in the process of generating a comprehensive risk score. When a high-risk determination result is received, the log records of the attention tracking mechanism are retrieved to identify the input feature group with the highest contribution weight; If the input feature group corresponds to a risk-related feature vector, then the risk attribution is directed to an external relationship; otherwise, it is directed to an internal behavioral pattern. The type of the risk cause code is determined based on this.

[0013] As a further aspect of the present invention, it also includes a step of providing feedback and closing the loop on the execution status of the warning command: After a preset time window, data on the follow-up processing results of transactions that have triggered warnings are collected. The follow-up processing results data include the final manual review results or the system's secondary release records. The subsequent processing results data are associated with the transaction behavior characteristics record and comprehensive risk score on which the warning was based, and stored in the feedback dataset; The weight parameters in the risk decision fusion model and the normal behavior baseline model are periodically updated using the feedback dataset, so that the next prediction is more in line with the latest fraud methods. The weight parameters in the risk decision fusion model and the normal behavior baseline model are periodically updated using the feedback dataset, specifically including: The samples in the feedback dataset are relabeled, and transactions that are manually verified as fraud are marked as real positive examples, while normal transactions that pass the second release verification are marked as real negative examples. Using the sample set composed of the real positive examples and real negative examples, the risk decision fusion model is retrained, and the fusion weight parameters of the risk correlation calculation channel and the behavior analysis calculation channel within it are adjusted. Simultaneously, samples marked as true negative examples are added to the historical transaction data of the corresponding transaction initiator, and the average transaction frequency and regular transaction amount range in the subject's normal behavior baseline model are recalculated and updated.

[0014] As a further aspect of the present invention, the present invention also includes an AI-based real-time payment risk warning system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the AI-based real-time payment risk warning method described above.

[0015] Compared with the prior art, the advantages and positive effects of the present invention are as follows: By inputting the graph of the relationship between trading participants into a graph structure analyzer for relationship chain deconstruction, the relationship levels between trading participants can be broken down layer by layer. This allows for the precise extraction of potential indirect relationship paths between the trading initiator and historical risk accounts. The risk relationship feature vector generated based on these indirect relationship paths can fully carry the feature information corresponding to multi-level relationships, expanding the scope of risk relationship feature extraction. This fills the gap in feature extraction formed by conventional technologies that can only identify direct relationships, enabling risk relationship features to comprehensively reflect the relationship status between trading participants and risk subjects. It allows the representation dimension of risk features to cover hidden relationship links, improves the matching degree between risk relationship features and actual relationship situations, refines the representation granularity of risk relationship features, and strengthens the correspondence between risk features and trading relationship attributes.

[0016] Based on the comprehensive risk score, the system matches the corresponding risk level from a pre-set risk management strategy library. It then calls upon the characteristic parameters under that risk level to generate a dynamic risk threshold for the current transaction. This allows the setting of the risk threshold to directly correspond to the risk level of the current transaction, abandoning the fixed threshold setting mode used in conventional technologies. This ensures that the parameter configuration of the risk threshold is adapted to the risk attributes of the current transaction. The comparison process between the comprehensive risk score and the dynamic risk threshold is aligned with the risk characteristics of the transaction itself. The triggering conditions for risk warning signals can be adaptively adjusted as the transaction risk level changes, mitigating the judgment bias caused by the mismatch between fixed thresholds and transactions with different risk levels. This keeps the triggering logic of risk warnings synchronized with the actual risk situation of the transaction, optimizes the adaptation effect of risk warning judgments, and refines the differentiated execution standards for warning judgments. Attached Figure Description

[0017] Figure 1 This is a flowchart of an AI-based real-time payment risk early warning method according to the present invention; Figure 2 A flowchart for generating risk-related feature vectors; Figure 3 The diagram shows the effect of early warning feedback closed loop and model optimization. Figure 4 A time evolution graph of risk score and dynamic threshold; Figure 5 This is a graph showing the iterative performance analysis of the payment risk early warning model. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] In the description of this invention, it should be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships, are based on the orientation or positional relationships shown in the accompanying drawings and are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, in the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0020] See Figure 1 The system acquires standardized transaction behavior characteristic records, including transaction amount ranges, transaction time slice distributions, and transaction participant relationship graphs. These graphs are then input into a graph structure analyzer for relationship chain deconstruction, extracting potential indirect connection paths between the transaction initiator and historical risk accounts, generating a risk association feature vector. Multidimensional behavioral pattern analysis is performed on the transaction time slice distributions and standardized transaction amount ranges to identify abnormal behavioral patterns that deviate from the normal behavioral baseline, yielding a behavioral deviation index. The risk association feature vector and behavioral deviation index are jointly input into a risk decision fusion model for feature cross-validation and weight allocation, generating a comprehensive risk score. Based on this comprehensive risk score, a corresponding risk level is matched from a pre-set risk management strategy library, and feature parameters under that risk level are invoked to generate a dynamic risk threshold for the current transaction. The comprehensive risk score of the current transaction is compared with the dynamic risk threshold. When the comprehensive risk score exceeds the dynamic risk threshold, a risk warning signal is triggered, generating a warning instruction containing a risk reason code and a transaction interception suggestion.

[0021] In one embodiment of the present invention, see [reference] Figure 2The system receives and acquires raw transaction flow data in real time from the payment transaction gateway, including transaction serial number, transaction amount, transaction time, initiator device identifier, and recipient account information. This raw data is sequentially stored in a queue of pending transaction data in memory or a database. The transaction data queue undergoes cleaning and standardization. The cleaning process includes performing a legality check on each transaction record in the queue, checking whether the transaction amount exceeds the preset upper and lower limits of the legal business amount range, and checking whether the transaction timestamp falls within the system-defined allowed operating period. Transaction records with amounts exceeding the legal business amount range or transactions occurring outside the allowed operating period are marked as invalid and permanently removed from the transaction data queue. After legality verification, the remaining valid records enter the formatting and conversion stage. In the formatting and conversion stage, the system maps the transaction amount to preset discrete amount level labels, for example, mapping 0-100 yuan to level L1 and 100-500 yuan to level L2. The transaction time is mapped to a fixed time window index, for example, dividing a day into 96 15-minute windows, and the timestamp is mapped to the corresponding window number. Simultaneously, a hash function is applied to the transaction initiator's device identifier to calculate and record its unique hash value. The four fields—formatted amount level label, time window index, unique hash value of the transaction initiator's device identifier, and transaction recipient's account information—are then structured and encapsulated to generate a complete and standardized transaction behavior characteristic record for use by subsequent analysis modules.

[0022] In some embodiments, the process of generating risk-related feature vectors is accomplished through a dedicated graph structure analyzer. The graph structure analyzer reads the transaction participant association graph information encapsulated in the transaction behavior feature record and imports this graph into a graph database for storage and computation. The corresponding node in the graph database of the transaction initiator for which risk assessment is currently required is used as the starting point of the breadth-first search algorithm, and a pre-marked set of historical risk account nodes in the graph database is used as the search endpoint set. The breadth-first search algorithm is executed in the graph database, starting from the starting point and searching for all paths from the starting point to any node in the historical risk account node set, but the search depth is limited to a preset hop count limit, such as 3 hops. The algorithm records and outputs detailed information about the shortest and second shortest paths found. Risk assessment is performed on all found association paths, and for each path, its risk transmission coefficient is calculated. The calculation of the risk transmission coefficient considers the risk attribute values ​​of all intermediate nodes traversed in the path and the historical interaction frequency on the connecting edges. A specific calculation formula can be expressed as: in: This represents the calculated risk transmission coefficient. This represents the total number of nodes in the path. This indicates the first [item] in the path. Each node has a preset risk weighting factor. Indicates the first The risk attribute value of each node, Indicates the length of the path (i.e., the number of hops). Indicates the attenuation coefficient. This represents the average historical connection frequency of each connecting edge on the path. After calculation, the risk transmission coefficient values ​​of the shortest path, the second shortest path, and the total number of all associated paths found in this search are normalized to ensure they fall within a certain range. Interval. These three normalized values ​​are concatenated in sequence to form a three-dimensional feature vector. This three-dimensional feature vector is defined as the risk association feature vector, which represents the degree of correlation between the current transaction initiator and the risk network.

[0023] In one embodiment of the present invention, the behavior analysis module in the risk control server retrieves recent historical transaction data associated with the device identifier of the current transaction initiator. The time range of the recent historical transaction data can be set to the most recent 30 days. Based on the recent historical transaction data, a baseline model of the subject's normal behavior is constructed. The construction process includes counting the total number of transactions of the subject in different time periods of a day and dividing by the number of days to obtain the average transaction frequency for the corresponding time period. Simultaneously, the amounts of all transaction records in the recent historical transaction data are analyzed. Through clustering or quantile statistics methods, the lower and upper limits of the subject's regular transaction amount range are determined. The regular transaction amount range characterizes the range of amount distribution for most of the subject's normal transaction behaviors.

[0024] In some embodiments, a deviation factor in the time dimension is calculated. When a current transaction is received, the transaction time slice distribution information is parsed from the transaction behavior feature record of the current transaction. The transaction time slice distribution information indicates the specific time window in which the current transaction occurred. The average transaction frequency value for the time period corresponding to the current transaction time window is queried from the normal behavior baseline model. The deviation factor in the time dimension is calculated, which is defined as the ratio of the instantaneous frequency reflected by the current transaction time slice distribution (considered as 1 within a short time window) to the average transaction frequency of the corresponding time period. For example, if an entity's average transaction frequency is 0.2 times / hour between 10:00 AM and 11:00 AM, this means that a transaction occurs on average once every 5 hours during this time period. If a transaction occurs during this time period, its deviation factor in the time dimension is calculated as 1 divided by 0.2, resulting in 5. A deviation factor in the amount dimension is calculated by parsing a standardized transaction amount range from the transaction behavior feature record of the current transaction. This range has been mapped to a discrete amount level during the data processing stage. The standardized transaction amount range of the current transaction is compared with the regular transaction amount range recorded in the normal behavior baseline model. The length of the intersection range is calculated as a percentage of the total length of the regular transaction amount range. This percentage is defined as the deviation factor in the amount dimension. If the current transaction amount falls entirely within the regular range, the deviation factor in the amount dimension is 1; if it falls entirely outside the regular range, the deviation factor in the amount dimension is 0.

[0025] This can be understood as inputting deviation factors from both the time and monetary dimensions into the anomaly detection function. The anomaly detection function is a pre-defined mathematical calculation rule that performs a weighted fusion calculation on the two input factors, ultimately outputting a scalar value as a behavioral deviation index. A specific implementation of the anomaly detection function is as follows: in: This represents the calculated behavioral deviation index. The deviation factor representing the time dimension. This represents the deviation factor in terms of monetary value. and It is a preset weighting coefficient and Weighting coefficient and weighting coefficients These functions are used to adjust the contribution of time anomalies and amount anomalies, respectively. The exponential distribution characteristics that deviation factors in the time dimension may exhibit make the results more stable. Behavioral Deviation Index The larger the value, the greater the deviation of the current trading behavior from the baseline model of the subject's normal behavior, and the greater the potential risk.

[0026] In one embodiment of the present invention, after receiving the risk-related feature vector and the behavioral deviation index, the risk decision fusion model initializes two parallel computation channels within the model. The risk-related computation channel specifically receives and processes the risk-related feature vector, while the behavioral analysis computation channel specifically receives and processes the behavioral deviation index. Within the risk-related computation channel, the received risk-related feature vector is compared with a pre-stored risk pattern template library for similarity matching. The risk pattern template library stores typical association pattern feature vectors extracted from historical fraud cases. The matching process calculates the cosine similarity between the input vector and each template vector, and the highest similarity value is scaled and output as an association risk score. Within the behavioral analysis computation channel, the received behavioral deviation index is compared with a pre-stored behavioral risk level table. The behavioral risk level table defines the risk scores corresponding to behavioral deviation indices in different numerical ranges. A behavioral risk score is output through table lookup mapping. The associated risk score and behavioral risk score are fed into the decision fusion layer of the risk decision fusion model. The decision fusion layer dynamically adjusts the weighting coefficients of the associated risk score and behavioral risk score when fusion based on the preset threat level corresponding to the specific business scenario of the current exchange. Scenarios with high threat levels (such as large transfers) may assign higher weight to the associated risk score, while scenarios with low threat levels (such as small deposits) may assign higher weight to the behavioral risk score. The decision fusion layer calculates the final comprehensive risk score through a weighted linear combination, and the calculation process can be expressed as follows: in: This represents the overall risk score. Indicates the associated risk score. Indicates behavioral risk score, This represents the fusion weighting coefficient that is dynamically determined by the threat level of the current business scenario and assigns associated risk scores. .

[0027] The risk decision fusion model is constructed based on historical data. A training dataset is built using historical fraud and normal transaction samples. This dataset uses risk-related feature vectors and behavioral deviation indices generated from historical transaction records as input features, and manually labeled real risk tags as supervision signals. The input features are standardized and preprocessed to eliminate the influence of dimensionality. A dual-channel parallel processing structure is constructed, including a risk-related calculation channel and a behavioral analysis calculation channel. A multilayer perceptron network is embedded in the risk-related calculation channel to process high-dimensional, nonlinear risk-related feature vectors. A gradient boosting tree-based ensemble learner is embedded in the behavioral analysis calculation channel to process the scalar behavioral deviation index and learn its complex mapping relationship with risk. The decision fusion layer is configured with a trainable weight allocation matrix. The associated risk score output from the multilayer perceptron network and the behavioral risk score output from the gradient boosting tree-based ensemble learner are used as inputs, and weighted summation is performed using the trainable weight allocation matrix to generate a comprehensive risk score. Using the backpropagation algorithm, the trainable weight assignment matrix in the multilayer perceptron network, the gradient boosting tree-based ensemble learner, and the decision fusion layer is jointly and iteratively trained using the model training dataset. The training objective is to minimize the cross-entropy loss function between the model's predicted comprehensive risk score and the sample's true risk label. The risk decision fusion model is constructed by iteratively optimizing until the model converges.

[0028] In some embodiments, determining the dynamic risk threshold involves querying a preset risk management strategy library. Within this library, a mapping table is established between comprehensive risk score ranges and risk levels. This mapping table can be defined, for example, as follows: a comprehensive risk score of 0-30 corresponds to a "low risk" level L1, a comprehensive risk score of 30-70 corresponds to a "medium risk" level L2, and a comprehensive risk score of 70-100 corresponds to a "high risk" level L3. Simultaneously, the risk management strategy library configures corresponding risk threshold adjustment coefficients for each risk level; for example, the adjustment coefficient for "low risk" level L1 is 1.2, for "medium risk" level L2 it is 1.0, and for "high risk" level L3 it is 0.8. The comprehensive risk score calculated by the risk decision fusion model is compared and matched with the score ranges in the mapping table to determine the specific risk level to which the current transaction belongs. The risk threshold adjustment coefficient corresponding to this specific risk level is read, and a baseline risk threshold is obtained from the system's global configuration parameters. This baseline risk threshold is a fixed value preset based on the system's overall risk tolerance. Multiplying the baseline risk threshold by the risk threshold adjustment factor yields the dynamic risk threshold used for risk assessment in this current transaction.

[0029] See Figure 3This chart illustrates the changes in core metrics of the payment risk warning model over six iterations, visually reflecting the performance improvement effect of the feedback loop. The fraud recall rate steadily increased from 0.72 in round 1 to 0.90 in round 6, demonstrating a continuously enhanced ability to detect fraud. The false positive rate decreased from 0.28 in round 1 to 0.12 in round 6, significantly improving the false positive problem. The model accuracy gradually increased from 0.80 in round 1 to 0.92 in round 6, indicating continuous improvement in overall prediction accuracy. With each iteration, the fraud recall rate and model accuracy rose in tandem, while the false positive rate continued to decline, demonstrating the effectiveness of the feedback loop mechanism and the model's ability to continuously learn from real transaction samples and adapt to the latest fraudulent methods. The range of metric changes narrowed in rounds 5-6, indicating that the model performance was approaching its upper limit, suggesting that adjustments to the training strategy or the introduction of new features could be considered in subsequent iterations.

[0030] In one embodiment of the present invention, in the risk determination logic, the system compares in real time the comprehensive risk score output by the risk decision fusion model with the dynamically generated dynamic risk threshold. When the system determines that the comprehensive risk score is greater than the dynamic risk threshold, it triggers an internal flag, thereby activating the early warning generation process. After the early warning generation process is initiated, the system traces back and locates the main feature sources that led to the high-risk comprehensive risk score from the internal operation state of the risk decision fusion model. The tracing mechanism relies on the attention tracking mechanism embedded in the model. The attention tracking mechanism runs synchronously when the risk decision fusion model processes each transaction. During the generation of the comprehensive risk score, the attention tracking mechanism records the contribution weights of the two input feature groups—the risk correlation feature vector processed by the risk correlation calculation channel and the behavioral deviation index processed by the behavioral analysis calculation channel—to the final score result. When a high-risk determination result is received, the early warning generation process retrieves the log records recorded by the attention tracking mechanism in this calculation. The log records clearly identify the input feature group with the highest contribution weight. If the input feature group with the highest contribution weight corresponds to a risk-related feature vector, the system will attribute the root cause of the risk in this transaction to the relationship between the transaction participants and the external risk network, and generate a preset reason code representing "related risk". If the input feature group with the highest contribution weight corresponds to a behavioral deviation index, the system will attribute the root cause of the risk to the abnormal behavioral patterns of the transaction initiator, and generate a preset reason code representing "abnormal behavior".

[0031] In some embodiments, the process of generating transaction interception suggestions requires querying a risk handling strategy library. Based on the specific business type parsed from the current transaction record and the specific risk level of the transaction determined in previous steps, the system retrieves a preset handling strategy mapping table from the risk handling strategy library to determine the appropriate handling action to be taken for this risk event. This handling action is then encapsulated as a transaction interception suggestion. The risk handling strategy library stores handling actions corresponding to different business scenarios and risk levels. For example, for the "transfer" business type, under the "high risk" level, the strategy might directly point to "strong interception," i.e., suspending the transaction and freezing the account; under the "medium risk" level, the strategy might point to "weak verification," i.e., requiring additional identity verification such as facial recognition. Refer to Table 1 for an exemplary strategy mapping relationship.

[0032] Table 1: Mapping Table of Business Type, Risk Level, and Handling Method It is understandable that the calculation of contribution weights is the core of the attention tracking mechanism. Contribution weights quantify the influence of each input feature group on the final comprehensive risk score. A specific method for calculating contribution weights can be achieved by analyzing the attention allocation of the decision fusion layer to the outputs of each channel in the risk decision fusion model. The formula for calculating contribution weights can be expressed as: in: This represents the contribution weight of the feature group in the risk-related feature vector. This indicates that when the decision fusion layer processes the current transaction, it assigns the original value of the attention score output by the risk correlation calculation channel. This represents the summation of the original attention scores assigned to all input channels (including risk correlation calculation channels and behavioral analysis calculation channels) by the decision fusion layer during the processing of the current transaction, after an exponential operation. (This is achieved through comparison.) Contribution weight corresponding to behavioral deviation index This allows us to determine the input feature group with the highest contribution weight. Finally, the system packages the determined risk cause code, the transaction interception suggestion retrieved from the strategy library, and the unique transaction serial number of the current transaction into a structured warning instruction that conforms to the predetermined interface specification, and sends the warning instruction to the downstream risk disposal system or risk control operation platform.

[0033] See Figure 4This is a time-varying graph of risk score and dynamic threshold, showing the changes in the comprehensive risk score and dynamic risk threshold from 0:00 to 23:00, intuitively reflecting the risk fluctuations and warning triggering within a day. At 9:00, the comprehensive risk score reached 0.80, far exceeding the daily dynamic threshold of 0.70, triggering a strong risk warning. At 17:00, the comprehensive risk score reached 0.75, exceeding the daily dynamic threshold of 0.69, triggering a risk warning. At 1:00, 11:00, 15:00, and 23:00, the comprehensive risk score was as low as 0.20-0.21, far below the dynamic threshold, indicating extremely low risk levels. The threshold remained generally stable in the 0.58-0.70 range, only slightly increasing during peak periods according to the risk level. The threshold fluctuations matched the threat level of the business scenario, reflecting the dynamic adjustment characteristic. The dynamic threshold effectively distinguished between normal transactions and high-risk transactions, avoiding excessive or missed warnings.

[0034] In one embodiment of the present invention, the system initiates a feedback data collection process after a preset time window. The length of the preset time window can be set according to business needs, such as 24 hours or 48 hours. The feedback data collection process targets all transactions that have triggered alerts and generated alert commands, collecting the subsequent processing result data of these transactions. The subsequent processing result data includes the final confirmation result given by risk operations personnel after manual review of the alerted transactions, as well as the record of the system's secondary release operation for the transaction after meeting specific conditions. The collection module associates and binds these subsequent processing result data with the original transaction behavior feature record on which the alert command was based and the comprehensive risk score calculated at that time. After binding, a complete data sample containing input features, model score, handling action, and final result label is formed, and this complete data sample is stored in a feedback dataset dedicated to model iteration.

[0035] In some embodiments, the process of periodically updating the weight parameters of the risk decision fusion model and the normal behavior baseline model using the feedback dataset first involves redefining the labels of the samples in the feedback dataset. Based on subsequent processing results, the label redefinition operation marks transaction samples confirmed as fraudulent by manual review as real positive examples and transaction samples confirmed as normal through secondary release verification as real negative examples. Using the sample set composed of real positive and real negative examples, the risk decision fusion model is retrained. The retraining process aims to adjust the fusion weight parameters of the risk correlation calculation channel and the behavior analysis calculation channel within the risk decision fusion model at the decision fusion layer. The objective function of the model update is to minimize the loss on the new sample set. A rule for weight adjustment can be expressed as: in: This represents the updated set of model weight parameters. This represents the set of model weight parameters before the update. This indicates the learning rate used during model retraining. Indicates in the feedback dataset The loss function calculated above with respect to the old weight parameters The gradient is calculated. Through iterative optimization using the backpropagation algorithm, the risk decision fusion model is adapted to the latest fraud patterns and normal behavior distributions.

[0036] Understandably, updates to the normal behavior baseline model are performed concurrently. The update operation adds samples marked as true negatives in the feedback dataset to the historical transaction data pool of the corresponding transaction initiator. This is because true negatives represent a transaction that was misjudged by the model but was actually normal, and its behavioral characteristics should be incorporated into the subject's normal pattern. Based on the expanded historical transaction data pool, the system recalculates and updates the key statistical parameters recorded in the subject's normal behavior baseline model. This recalculation includes calculating the subject's average transaction frequency over different time periods based on the new data set, and re-determining the lower and upper limits of the subject's regular transaction amount range using statistical methods. Through this periodic feedback loop update, the weight parameters in the risk decision fusion model and the statistical parameters in the normal behavior baseline models of each transaction subject are continuously optimized, enabling the system's risk identification capabilities to dynamically adapt to the ever-changing trading environment and fraudulent methods.

[0037] See Figure 5 This is a performance analysis chart of the payment risk warning model iteration, showing the changes in core evaluation indicators during 10 iterations. It clearly reflects the optimization effect of the feedback loop mechanism on model performance. As the number of iterations increases, the model accuracy continues to rise, while the false positive and false negative rates decrease simultaneously, indicating that the feedback loop mechanism is effective and the model can continuously learn new fraud patterns. The magnitude of indicator changes narrows between iterations 8-10, indicating that model performance is approaching saturation and stabilizing overall. A low false negative rate effectively prevents financial losses, a low false positive rate ensures a normal user transaction experience, and high accuracy guarantees the overall reliability of the system. To further improve performance, feature enhancement can be attempted for scenarios with high false positive / false negative rates. Based on business needs, thresholds can be fine-tuned to balance the false positive and false negative rates, building upon the existing accuracy.

[0038] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments that can be applied to other fields. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A real-time payment risk early warning method based on AI, characterized in that, The method includes: Obtain transaction behavior feature records, which include standardized transaction amount ranges, transaction time slice distributions, and transaction participant association graphs; The transaction participant association graph in the transaction behavior feature record is input into the graph structure analyzer for relationship chain deconstruction, extracting the potential indirect association path between the transaction initiator and the historical risk account, and generating a risk association feature vector; Multidimensional behavioral pattern analysis is performed on the transaction time slice distribution and the standardized transaction amount range to identify abnormal behavioral patterns that deviate from the normal behavioral baseline and obtain a behavioral deviation index. The risk-related feature vector and the behavioral deviation index are input into the risk decision fusion model to perform cross-validation and weight allocation of the features, and generate a comprehensive risk score. Based on the comprehensive risk score, the corresponding risk level is matched from the preset risk management strategy library, and the feature parameters under the risk level are called to generate a dynamic risk threshold for the current transaction. The overall risk score of the current transaction is compared with the dynamic risk threshold. When the overall risk score exceeds the dynamic risk threshold, a risk warning signal is triggered, and a warning instruction containing a risk reason code and a transaction interception suggestion is generated.

2. The AI-based real-time payment risk early warning method according to claim 1, characterized in that, The acquisition of transaction behavior feature records includes: The raw transaction flow data containing the transaction serial number, transaction amount, transaction time, transaction initiator device identifier and transaction recipient account information is obtained from the payment transaction gateway and formed into a queue of transaction data to be processed. The transaction data queue is cleaned and standardized. After removing outliers, the remaining data is converted into unified transaction behavior feature records, specifically including: For each transaction record in the transaction data queue, check whether its transaction amount is outside the preset legal business scope and whether the transaction time falls within the system's allowed operating hours; Transaction records that do not meet the validity check are marked as invalid records and removed from the transaction data queue. The remaining valid records enter the formatting and conversion stage. In the formatting and conversion process, the transaction amount is mapped to discrete amount level labels, the transaction occurrence time is mapped to a fixed time window index, and a unique hash value of the transaction initiator's device identifier is recorded. The amount level label, time window index, unique hash value, and transaction recipient account information are structured and encapsulated to generate a complete record of the transaction behavior characteristics.

3. The AI-based real-time payment risk early warning method according to claim 2, characterized in that, The transaction participant relationship graph in the transaction behavior feature record is input into a graph structure analyzer for relationship chain deconstruction, extracting potential indirect relationship paths between the transaction initiator and historical risk accounts, and generating a risk relationship feature vector, including: Import the transaction participant association graph into the graph database, and use the current transaction initiator node as the starting point and the preset set of historical risk account nodes as the ending point set. The breadth-first traversal algorithm is executed in the graph database to search for the shortest path and the second shortest path between the starting point and the ending point set, while limiting the search depth to no more than the set upper limit of the number of hops; Risk assessment is performed on all searched associated paths, and the risk transmission coefficient of each associated path is calculated based on the risk attributes of the nodes in the path and the connection frequency of the edges. The risk transmission coefficients of the shortest path, the second shortest path, and the total number of associated paths are normalized and concatenated into a multidimensional numerical sequence, which is the risk association feature vector.

4. The AI-based real-time payment risk early warning method according to claim 3, characterized in that, Multidimensional behavioral pattern analysis is performed on the transaction time slice distribution and the standardized transaction amount range to identify abnormal behavioral patterns that deviate from the normal behavioral baseline, resulting in behavioral deviation indices, including: Retrieve recent historical transaction data associated with the device identifier of the transaction initiator to construct a normal behavior baseline model of the subject. The normal behavior baseline model records the average transaction frequency and regular transaction amount range of the subject in different time periods. The deviation factor in the time dimension is obtained by calculating the ratio of the transaction time slice distribution of the current transaction to the average transaction frequency of the corresponding time period in the normal behavior baseline model. Calculate the percentage of intersection between the standardized transaction amount range of the current transaction and the regular transaction amount range in the normal behavior baseline model to obtain the deviation factor in the amount dimension; The deviation factors in the time dimension and the deviation factors in the monetary dimension are input into the anomaly detection function. After weighted calculation, a scalar value is obtained, and the scalar value is used as the behavioral deviation index.

5. The AI-based real-time payment risk early warning method according to claim 4, characterized in that, The risk-related feature vector and the behavioral deviation index are input into the risk decision fusion model for cross-validation and weight allocation of the features to generate a comprehensive risk score, including: Initialize two parallel computing channels in the risk decision fusion model, which are used to receive the risk-related feature vector and the behavior deviation index, respectively. In the risk association calculation channel, the received risk association feature vector is matched with the pre-stored risk pattern template for similarity, and an association risk score is output. In the behavior analysis calculation channel, the received behavior deviation index is compared with the pre-stored behavior risk level table, and a behavior risk score is output. The associated risk score and behavioral risk score are sent to the decision fusion layer. The decision fusion layer dynamically adjusts the fusion weight of the two scores according to the threat level of the current business scenario, and linearly combines the two scores to output the final comprehensive risk score. The steps for constructing the risk decision fusion model include: Based on historical fraud and normal transaction samples, a model training dataset is constructed that includes risk-related feature vectors and behavioral deviation indicators as input features. The input features in the model training dataset are then standardized and preprocessed. A dual-channel parallel processing structure is constructed, which includes a risk correlation calculation channel and a behavior analysis calculation channel. A multilayer perceptron network is embedded in the risk correlation calculation channel, and an ensemble learner based on gradient boosting tree is embedded in the behavior analysis calculation channel, which are used to process risk correlation feature vectors and behavior deviation indicators, respectively. In the decision fusion layer, a trainable weight allocation matrix is ​​configured, and the association risk score output by the multilayer perceptron network and the behavior risk score output by the gradient boosting tree-based ensemble learner are taken as inputs and weighted summed through the trainable weight allocation matrix to generate a comprehensive risk score. The multilayer perceptron network, the gradient boosting tree-based ensemble learner, and the trainable weight assignment matrix are jointly and iteratively trained using the model training dataset through backpropagation algorithm to minimize the loss function between the comprehensive risk score and the true risk label of historical transactions until the model converges, thus completing the construction of the risk decision fusion model.

6. The AI-based real-time payment risk early warning method according to claim 5, characterized in that, Based on the comprehensive risk score, a corresponding risk level is matched from a preset risk management strategy library, and feature parameters under the risk level are invoked to generate a dynamic risk threshold for the current transaction, including: In the pre-set risk management strategy library, establish a mapping relationship table between comprehensive risk scoring range and risk level, as well as the risk threshold adjustment coefficient corresponding to each risk level; The calculated comprehensive risk score is matched with the score range in the mapping table to determine the specific risk level of the current transaction; Read the risk threshold adjustment coefficient corresponding to the specific risk level, and obtain the baseline risk threshold configured by the system; The result of multiplying the baseline risk threshold by the risk threshold adjustment coefficient is used as the dynamic risk threshold for this judgment.

7. The AI-based real-time payment risk early warning method according to claim 6, characterized in that, When the comprehensive risk score exceeds the dynamic risk threshold, a risk warning signal is triggered, and a warning instruction containing a risk reason code and a transaction interception suggestion is generated, including: In the risk assessment logic, the comprehensive risk score is compared with the dynamic risk threshold. When the comprehensive risk score is determined to be greater than the dynamic risk threshold, the early warning generation process is activated. From the internal state of the risk decision fusion model, trace back the main source of the characteristics that lead to high risk. If the main source is the risk-related feature vector, generate a cause code that represents the associated risk. If the main source is the behavioral deviation index, generate a cause code that represents the abnormal behavior. Based on the specific business type and risk level of the current transaction, the risk handling strategy library is searched to determine whether to execute strong interception or weak verification, which serves as a transaction interception suggestion. The risk cause code and transaction interception suggestion are packaged together and the current transaction serial number is attached to assemble them into a structured warning instruction.

8. The AI-based real-time payment risk early warning method according to claim 7, characterized in that, The process of tracing back from the internal state of the risk decision fusion model to identify the main sources of high risk includes: An attention tracking mechanism is embedded in the risk decision fusion model, which records the contribution weight of each input feature in the process of generating a comprehensive risk score. When a high-risk determination result is received, the log records of the attention tracking mechanism are retrieved to identify the input feature group with the highest contribution weight; If the input feature group corresponds to a risk-related feature vector, then the risk attribution is directed to an external relationship; otherwise, it is directed to an internal behavioral pattern. The type of the risk cause code is determined based on this.

9. The AI-based real-time payment risk early warning method according to claim 8, characterized in that, It also includes a feedback loop step for the execution status of the warning command: After a preset time window, data on the follow-up processing results of transactions that have triggered warnings are collected. The follow-up processing results data include the final manual review results or the system's secondary release records. The subsequent processing results data are associated with the transaction behavior characteristics record and comprehensive risk score on which the warning was based, and stored in the feedback dataset; The weight parameters in the risk decision fusion model and the normal behavior baseline model are periodically updated using the feedback dataset, so that the next prediction is more in line with the latest fraud methods. The weight parameters in the risk decision fusion model and the normal behavior baseline model are periodically updated using the feedback dataset, specifically including: The samples in the feedback dataset are relabeled, and transactions that are manually verified as fraud are marked as real positive examples, while normal transactions that pass the second release verification are marked as real negative examples. Using the sample set composed of the real positive examples and real negative examples, the risk decision fusion model is retrained, and the fusion weight parameters of the risk correlation calculation channel and the behavior analysis calculation channel within it are adjusted. Simultaneously, samples marked as true negative examples are added to the historical transaction data of the corresponding transaction initiator, and the average transaction frequency and regular transaction amount range in the subject's normal behavior baseline model are recalculated and updated.

10. An AI-based real-time payment risk early warning system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the AI-based real-time payment risk warning method described in any one of claims 1 to 9.

Images