Distributed transaction anomaly intelligent screening and tracing method and system

Abstract

The application belongs to the technical field of financial risk big data monitoring, and particularly relates to a distributed transaction abnormality intelligent screening and tracing method and system, wherein the method comprises the following steps: a plurality of participant nodes respectively extract time series graph structure features from local transaction data by using a local graph attention network to generate local node embedding representation; a federal learning coordinator adopts a risk perception dynamic aggregation strategy to perform weighted aggregation on local model parameters to generate global model parameters; each participant node performs abnormality scoring on real-time transaction data based on the global model parameters and generates an alarm; a tracing request is submitted to a blockchain tracing layer through an intelligent contract, a related transaction path is traced back, and a transaction propagation link graph is constructed; and the graph is input into a multi-expert parallel network, and an abnormality type label and an interpretable attribution analysis result are output through a gating mechanism. The application solves the contradiction between cross-institution data sharing and privacy protection, and realizes accurate screening and credible tracing of abnormal transactions.

Description

Technical Field

[0001] This invention relates to the field of big data monitoring technology for financial risks, and in particular to a distributed intelligent screening and tracing method and system for abnormal transactions. Background Technology

[0002] Currently, mainstream transaction anomaly detection solutions in the industry mainly fall into two categories: one is detection systems based on expert rule engines, which screen transactions by pre-setting rules such as large transactions, frequent transfers, and transactions outside of working hours. This type of method relies heavily on human experience, has limited rule coverage, struggles to cope with constantly evolving and complex anomaly patterns, and has a high false positive rate. The other type is detection systems based on centralized machine learning, which aggregate transaction data from various institutions onto a unified platform for model training and inference. While this type of method possesses self-learning capabilities, its centralized architecture directly violates data privacy protection regulations. Financial institutions, for reasons of trade secrets and customer privacy, typically refuse to share raw transaction data, resulting in limited training samples and insufficient generalization ability for the models.

[0003] To address the conflict between data silos and privacy protection, federated learning, as a distributed machine learning paradigm, has been introduced into the field of financial risk control. However, existing federated learning methods are mostly designed for general tasks such as image classification and text processing, failing to fully consider the graph structure characteristics of financial transaction data and the common problems of class imbalance and data heterogeneity in anomaly detection tasks. Specifically, the transaction network topologies of different financial institutions vary significantly, and directly applying general federated aggregation strategies to graph neural networks leads to global model performance degradation. Furthermore, even if existing solutions detect abnormal transactions, they typically only output simple anomaly labels or scores, lacking accurate classification of anomaly types and interpretable attribution analysis, thus failing to provide effective decision support for subsequent regulatory enforcement.

[0004] In terms of traceability, some existing technologies utilize blockchain to store and trace transaction records. However, such solutions typically treat anomaly detection and blockchain traceability as two independent processes, lacking an automated linkage mechanism between them. Furthermore, the traceability process often employs a fixed depth and scope, failing to dynamically correlate with the risk level of anomaly alerts, resulting in inefficient system resource utilization or insufficient traceability of high-risk transactions. Simultaneously, existing solutions have limited capabilities for integrated traceability of cross-chain transactions, making it difficult to address the increasingly prevalent need for tracking fund flows between heterogeneous blockchain networks. Summary of the Invention

[0005] This invention proposes a distributed intelligent screening and tracing method and system for abnormal transactions, aiming to solve the technical problem in existing technologies that lack credible tracing and interpretable attribution analysis for risk-adaptive abnormal transactions in financial transaction anomaly monitoring scenarios.

[0006] In a first aspect, the present invention provides a distributed intelligent screening and tracing method for transaction anomalies, including: S1, multiple participating nodes respectively use local graph attention networks to extract the temporal graph structure features of transaction behavior on local transaction data, and generate local node embedding representations; S2, each participating node uploads the local node embedded representation to the federated learning coordinator. The federated learning coordinator uses a risk-aware dynamic aggregation strategy to weight and aggregate the received local model parameters, generate global model parameters, and distribute them. The risk-aware dynamic aggregation strategy determines the aggregation weights based on the structural risk intensity of abnormal samples in each participating node. S3, each participating node scores the anomaly probability of the real-time transaction data based on the received global model parameters, and generates an anomaly alarm event when the anomaly probability exceeds a preset threshold. S4, package the transaction data associated with the abnormal alarm event into a traceability request, and submit the traceability request to the blockchain traceability layer through a smart contract; S5, the blockchain traceability layer traces back the associated transaction path from the stored transaction logs based on the transaction identifier in the traceability request, and constructs a transaction propagation link graph; S6, the transaction propagation link graph is input into the anomaly type identification expert network, and adaptively routed to the corresponding expert sub-network through a gating mechanism, and the anomaly type label and interpretability attribution analysis results are output; the anomaly type identification expert network contains multiple parallel expert sub-networks, and the multiple parallel expert sub-networks correspond to different anomaly types respectively.

[0007] The technical advantages of the distributed intelligent screening and tracing method for transaction anomalies disclosed in this invention are as follows: By integrating federated graph attention networks with blockchain smart contract tracing across domains, collaborative detection and reliable tracing of anomaly transactions across institutions are achieved while ensuring the data privacy of all participants. Local graph attention networks can capture the temporal dependencies and graph topological features of transaction data, improving the accuracy of anomaly identification; the risk-aware dynamic aggregation strategy optimizes the data heterogeneity and class imbalance problems in anomaly detection tasks, ensuring that the global model has good generalization performance across all participants; the smart contract-driven blockchain tracing mechanism ensures the immutability and verifiability of transaction paths; and the multi-expert gating network enables refined classification of anomaly types. These technical means work together organically to solve the technical challenges of the inability to simultaneously address privacy protection and collaborative detection, and the disconnect between detection and tracing in existing technologies.

[0008] Furthermore, the local graph attention network in S1 includes a temporal coding module and a multi-head attention aggregation module; the temporal coding module performs multi-scale time difference feature extraction and periodic position encoding fusion on the timestamps of transaction data to generate temporally enhanced node features; the multi-head attention aggregation module calculates the attention weights between adjacent nodes based on the temporally enhanced node features and aggregates multi-level neighbor information through multiple rounds of message passing.

[0009] Furthermore, the aggregation range of the multi-order neighbor information is adaptively determined based on the degree centrality of the nodes; the temporal coding module also introduces a feature perturbation compensation term, which is calculated based on the heterogeneity of the clustering coefficients and the degree distribution skewness of the node neighborhood, and is used to correct the differences in the transaction graph topology between different participating nodes.

[0010] Furthermore, the risk perception dynamic aggregation strategy in S2 includes: calculating the structural risk intensity index of abnormal nodes in the local transaction graph of each participating node, wherein the structural risk intensity index is obtained by weighted summation of the node's clustering coefficient anomaly, centrality deviation, and community affiliation anomaly; constructing a mapping function with time decay characteristics to map the structural risk intensity index into an aggregation weight value; and performing a weighted average of the local model parameters uploaded by each participating node based on the aggregation weight value.

[0011] Furthermore, the risk perception dynamic aggregation strategy also includes: calculating the topological structure representation vector of the local transaction graph of each participating node, constructing a graph topological structure similarity regularization constraint term, and using the regularization constraint term to adjust the parameter update magnitude during global model parameter aggregation.

[0012] Furthermore, the anomaly probability score in S3 is a weighted fusion value of the node anomaly probability value output by the global model and the rule hit weighted score output by the rule engine; the rules preset by the rule engine include at least one of the following: large-amount frequent transaction rules, non-working-hour transaction rules, cross-border high-frequency transaction rules, and wash trading rules.

[0013] Furthermore, the smart contract in S4 performs the following operations: verifying the legitimacy of the identity of the participating node initiating the traceability request, the existence of the transaction identifier, and the query permission; after successful verification, triggering the traceability execution process of the blockchain traceability layer, and recording the traceability request to the blockchain ledger.

[0014] Furthermore, the smart contract dynamically adjusts the tracing depth based on the risk level of the abnormal alarm event, triggering bidirectional tracing along the entire path for high-risk alarms and limiting the number of hops for medium- and low-risk alarms.

[0015] Furthermore, the interpretability attribution analysis results in S6 include anomaly type labels and their confidence levels, ranking of attribution contributions of key transaction nodes, key time window identifiers, and anomaly propagation path diagrams. The attribution contribution is obtained by backpropagating the attention mechanism weights within the expert subnetwork to the input node features, and is weighted according to the edge weights in the transaction propagation link graph to quantify the cascading influence factor of upstream transaction nodes on the current anomaly type.

[0016] Secondly, the present invention provides a distributed intelligent screening and tracing system for transaction anomalies, the system being used to execute the method, the system comprising: A distributed detection layer, deployed across multiple participant nodes, is used to extract the temporal graph structure features of local transaction data using a local graph attention network and generate local node embedding representations. The federated learning coordination layer is used to receive the local node embedding representations uploaded by each participating node, and uses a risk-aware dynamic aggregation strategy to weight and aggregate the local model parameters to generate global model parameters and distribute them. A real-time screening layer is deployed on each participating node to score the anomaly probability of real-time transaction data based on the global model parameters and generate an anomaly alarm event when the anomaly probability exceeds a preset threshold. The blockchain traceability layer is used to receive traceability requests through smart contracts, trace back the related transaction paths based on the transaction identifiers in the traceability requests, and construct a transaction propagation link graph. The anomaly analysis layer includes a gating network and multiple parallel expert subnetworks. The gating network is used to adaptively route the transaction propagation path graph to the corresponding expert subnetwork. The multiple parallel expert subnetworks correspond to different anomaly types. The anomaly analysis layer outputs anomaly type labels and interpretability attribution analysis results.

[0017] The technical advantages of the system disclosed in this invention are as follows: Through a layered architecture design consisting of a distributed detection layer, a federated learning coordination layer, a real-time screening layer, a blockchain tracing layer, and an anomaly analysis layer, it achieves end-to-end technical capabilities from local feature extraction, privacy-preserving model aggregation, real-time anomaly screening, risk adaptive tracing, to explainable anomaly classification. The functional layers collaborate through standard interfaces, ensuring both high cohesion and low coupling of the system, and forming a complete business closed loop of "screening—tracing—analysis—feedback." This system can operate stably in scenarios involving joint deployment by multiple financial institutions, effectively supporting cross-institutional anti-money laundering and anti-fraud collaborative supervision needs, and possesses significant technological advancement and industrial application value. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the distributed transaction anomaly intelligent screening and tracing method proposed in this embodiment of the invention; Figure 2 This is a schematic diagram of the principle of a local graph attention network provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of a risk perception dynamic aggregation strategy provided in an embodiment of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example 1 This embodiment provides a distributed intelligent screening and tracing method for transaction anomalies, the overall process of which is shown in the attached figure. Figure 1 As shown. This method operates in a consortium network composed of multiple financial institutions (such as banks, payment platforms, and securities companies), with each institution deploying the system as a participating node. The method specifically includes the following steps: Step S1: Local transaction graph construction and feature extraction.

[0021] Each participating node maintains its own transaction dataset locally. These datasets contain sensitive information such as account information, transaction records, and timestamps. For privacy protection and compliance requirements, the raw data does not leave the local environment.

[0022] First, participating nodes construct a transaction sequence graph G=(V,E,T) based on local transaction data, where node V represents a transaction account, edge E represents a fund transfer relationship, and each edge includes attributes such as transaction amount, transaction type, and timestamp. (See attached graph) Figure 2 As shown, the constructed transaction time series graph is input into a local graph attention network for feature extraction. This network includes a temporal encoding module and a multi-head attention aggregation module.

[0023] The temporal coding module extracts multi-scale time difference features (such as the time interval between adjacent transactions and the average daily transaction interval) and fuses periodic position codes (such as whether it is a weekday, whether it is the end of the month or quarter, etc.) from the timestamp of each transaction to generate temporally enhanced node features. To overcome the topological drift problem in the transaction graph caused by different participants' business types (such as retail banking and investment banking), the temporal coding module further introduces a feature perturbation compensation term. This compensation term is calculated based on the heterogeneity of the clustering coefficients and the skewness of the degree distribution of the node's neighborhood, and its calculation formula is as follows: ; in, For nodes Skewness of the degree distribution of neighbor sets λ is a measure of the heterogeneity of the neighbor clustering coefficients, and λ is a learnable scaling parameter. This compensation term effectively corrects for the feature distribution shift caused by topological differences in the graphs among participants, ensuring the comparability of local features extracted from different nodes.

[0024] The multi-head attention aggregation module calculates the attention weights between neighboring nodes based on temporal enhancement features. For the center node i and any of its neighboring nodes j∈N(i), the original attention scores between node i and node j are first calculated. : ; in, and , respectively, are the feature vectors of nodes i and j after being enhanced by the temporal coding module; W is a trainable shared linear transformation matrix; Let be the temporal feature vector on the transaction edge from node i to node j, including the normalized value of the transaction amount, the transaction time interval, etc.; || represents the vector concatenation operation; a is the weight vector of a trainable single-layer feedforward neural network; LeakyReLU is the linear rectified activation function with leakage.

[0025] Subsequently, the original scores on the neighbor node set N(i) are normalized using the Softmax function to obtain the final attention weight coefficients. : ; To enhance the model's robustness, a multi-head attention mechanism is employed. The above computation process is executed K times in parallel, with the updated features of the central node i after multi-head attention aggregation. The outputs from each head are spliced ​​together to obtain: ; ELU is the exponential linear unit activation function.

[0026] Multi-round message passing is used to aggregate multi-level neighbor information. The aggregation range is adaptively determined based on the node degree centrality: for core nodes with a degree centrality higher than the threshold, the aggregation radius is reduced to 1 hop to avoid over-smoothing; for edge nodes with a low degree centrality, the aggregation radius can be expanded to 2-3 hops to obtain sufficient contextual information. After L layers of propagation, the final output is a local node embedding representation. . Local graph attention networks can effectively capture complex spatiotemporal dependencies in transaction networks. The temporal encoding module makes the model highly sensitive to time-sensitive anomalies such as "frequent transactions outside of working hours" and "rapid inflows and outflows of funds within a short period." The introduction of feature perturbation compensation terms addresses the performance degradation caused by heterogeneous data distribution among participants in federated learning scenarios, improving the generalization ability and stability of the global model.

[0027] Step S2: Federated learning of dynamic aggregation of risk perception.

[0028] After each participating node completes its local feature extraction, it uploads its local node embedding representation and model parameters to the federated learning coordinator. The federated learning coordinator does not access the original data; it only receives the model parameters. To address the common problems of class imbalance and data heterogeneity in anomaly detection tasks, this invention proposes a risk-aware dynamic aggregation strategy.

[0029] As attached Figure 3 As shown in the upper part, the strategy first calculates the structural risk intensity index of each participating node. : ; in, As a participant The outlier of the clustering coefficient of known fraudulent nodes in the local transaction graph (the deviation from the average clustering coefficient of normal nodes). Centrality deviation (the degree to which the betweenness centrality of a fraudulent node in the graph deviates from the mean). Community affiliation anomaly (the frequency of fraudulent nodes crossing different community modules). Weight The detection performance is dynamically calibrated using historical validation sets.

[0030] Then, a mapping function with time decay characteristics is constructed to map the structural risk intensity index to aggregated weight values. : ; Where σ is the Sigmoid activation function, η is the risk intensity scaling factor, β is the historical contribution baseline, η is the time decay factor, and Δt is the time interval since the participant last uploaded model parameters. The time decay mechanism ensures that participants with excellent recent detection performance have a higher say in the aggregation.

[0031] During the global model parameter update phase, the federated learning coordinator performs iterative updates in the (t+1)th round of communication. The amount of local model parameter updates uploaded by the k-th participating node is... The specific formula for updating the global model parameters is as follows: ; in, Here are the global model parameters for round t; N is the total number of nodes participating in this round of aggregation. This represents the number of local samples at the k-th node. This represents the total number of samples. The weights are adjusted for risk; η is the strength coefficient of the regularization term. The regularization loss term is constructed based on graph topology similarity and is defined as the mean square error between the topological representation vectors of each participant and the center point.

[0032] Finally, the updated global model parameters will be... The data is distributed to all participating nodes, completing one round of federated learning iteration.

[0033] Traditional federated averaging algorithms can lead to a global model bias towards participants with larger datasets in heterogeneous data scenarios. This invention addresses this by using dynamic weighting driven by structural risk intensity, which focuses the model on participants with high-value fraud samples, significantly improving the ability to identify rare anomalies. The introduction of graph topology similarity regularization smooths out parameter update biases caused by heterogeneous topologies, ensuring stable performance of the global model across all types of participants.

[0034] Step S3: Real-time transaction anomaly screening.

[0035] Each participating node receives global model parameters Then, an anomaly probability score is performed on the real-time transaction data. (See attached image.) Figure 3 As shown in the middle section, the score is obtained by weighted fusion of two parts: the node anomaly probability output by the global graph neural network model. and the rule hit weighted score output by the rule engine. .

[0036] The rules engine pre-sets multiple expert rules, including but not limited to: Large and frequent transaction rules: The cumulative transaction amount of the same account in a short time window (such as 1 hour) exceeds 3 times the historical average; Transaction rules outside of working hours: Transactions occurring between 0:00 and 6:00 AM and exceeding the threshold amount; Cross-border high-frequency trading rules: More than 5 transfers to overseas accounts in a single day; Wash trading rules: There is a two-way flow of funds between two accounts and the amounts are highly matched.

[0037] Rule hit weighted score This is the summation and normalization of the weights of all hit rules. The final overall score S is: ; Where δ is the model trust coefficient, which can be dynamically adjusted based on the historical detection accuracy of the participants. When S exceeds the preset threshold θ, the system generates an abnormal alarm event and records the alarm context information, including the transaction identifier, transaction time, participating account, abnormal score, and trigger rule list.

[0038] The dual-engine mechanism, integrating deep learning and expert rules, combines the advantages of both. Graph neural networks can automatically discover unknown and complex anomaly patterns, filling the coverage gaps of manual rules; expert rules provide high interpretability and business compliance assurance, reducing the risk of false positives from pure model-based decisions. The synergistic work of the two significantly improves the overall accuracy and interpretability of the screening process.

[0039] Step S4: Triggering a traceability request based on a smart contract.

[0040] After an anomaly alarm is generated, the system automatically packages the transaction data associated with the alarm (mainly transaction identifiers) into a tracing request. The tracing request is submitted to the blockchain tracing layer through a smart contract deployed on the consortium blockchain.

[0041] The smart contract first executes the verification logic: Verify the digital signature of the participating node that initiated the request to ensure its legitimacy; Verify that the transaction identifier exists in the blockchain transaction log storage module; Verify the participating node's query permissions for the transaction data (based on a preset access control list).

[0042] Once the verification is successful, the smart contract triggers the traceability execution process of the blockchain traceability layer and writes the metadata of this traceability request (requester, timestamp, transaction ID) into the blockchain ledger as an immutable record, forming a complete audit traceability starting point.

[0043] Furthermore, the smart contract can dynamically adjust the tracing depth based on the risk level of the anomaly alert. The risk level is determined by the comprehensive score S and the preliminary inference of the anomaly type (provided by a lightweight classifier). For high-risk money laundering or fraud alerts, the smart contract triggers full-path bidirectional tracing, i.e., tracing back to the initial source of funds and backward to the final destination of funds, and automatically requesting cross-chain relay nodes to obtain the associated cross-chain transaction data; for medium- and low-risk alerts, a limited tracing of a preset number of hops (e.g., 3 hops forward and 3 hops backward) is triggered to save system computing and query resources.

[0044] Through a smart contract-driven traceability triggering mechanism, a seamless, automated process from anomaly screening to evidence fixation is achieved. The strategy of dynamically adjusting the traceability depth ensures comprehensive tracking of high-risk transactions while avoiding unnecessary consumption of system resources. All traceability requests are recorded on the blockchain, providing irrefutable timestamped evidence for subsequent regulatory audits.

[0045] Step S5: Blockchain transaction path backtracking and graph construction.

[0046] Upon receiving a traceability request, the blockchain traceability layer retrieves the target abnormal transaction from the transaction log storage module based on the transaction identifier. The transaction log storage module is based on a consortium blockchain ledger, where each transaction is written after multi-party consensus, ensuring data immutability and consistency across the entire chain.

[0047] The traceability execution module starts with the target abnormal transaction and performs bidirectional backtracking along the flow of funds: Tracing Backwards (Source of Funds): Iteratively query all transactions transferred into the target account and their upstream transactions until the preset tracing depth is reached or the initial source of funds (such as cash deposits or transfers from external wallets) is reached.

[0048] Backward tracking (fund destination): Iteratively query all transactions transferred out of the target account and their downstream transactions until the preset tracking depth is reached or the final destination of the funds is reached.

[0049] For scenarios involving cross-chain transactions (such as transferring funds from a traditional bank account to a cryptocurrency exchange address), a cross-chain relay mechanism is used to obtain related transaction records from heterogeneous blockchain networks. Cross-chain relay nodes maintain the light node states of different blockchain networks, can verify the existence of cross-chain transactions, and extract information such as transaction amount, timestamp, and counterparty address, thus unifying and integrating multi-chain transaction information.

[0050] The final transaction propagation graph is a directed acyclic graph, where nodes represent account entities and edges represent fund flows. Each edge includes metadata such as transaction amount, timestamp, and transaction type. The graph also labels the affiliation information of the participants at each node, facilitating subsequent cross-institutional collaborative analysis.

[0051] The blockchain-based traceability mechanism ensures the credibility and integrity of transaction paths. Even when multiple financial institutions and heterogeneous blockchain networks are involved, the complete fund flow chain can be reconstructed, providing a legally valid chain of evidence for regulatory enforcement. Compared to traditional traceability methods that rely on data reported by individual institutions, the traceability results of this invention have the advantages of being tamper-proof and publicly verifiable.

[0052] Step S6: Multi-expert anomaly type identification and interpretability attribution analysis.

[0053] The transaction propagation chain graph constructed in step S5 is input into the anomaly type identification expert network. This network adopts a hybrid expert architecture, which includes four parallel expert subnetworks, corresponding to four typical anomaly types: money laundering, fraud, market manipulation, and system failure.

[0054] Money Laundering Experts Sub-Network: Focuses on identifying money laundering characteristics such as multi-layered nested transfers, structured splitting, and aggregation-decentralization patterns; Fraud Experts Sub-Network: Focused on identifying fraudulent features such as account theft, fake transactions, and phishing payments; Market Manipulation Experts Sub-Network: Focused on identifying characteristics of market manipulation such as wash trading, false reporting, and end-of-day manipulation; System Fault Expert Sub-network: Focuses on identifying system fault characteristics such as duplicate deductions, delayed accounting, and reconciliation discrepancies.

[0055] As attached Figure 1 Bottom and attached Figure 3 As shown in the lower part, the gated routing network employs a stress-modulated gated network. This network takes the structural characteristics of the graph (node ​​degree distribution, clustering coefficients, graph diameter, etc.) and temporal characteristics (transaction frequency variation rate, time interval distribution, etc.) as input, and outputs the routing weights of each expert subnetwork through a multilayer perceptron. ,satisfy The routing weights directly reflect the probability distribution of the input graph belonging to each anomaly type, requiring no additional post-processing interpretation.

[0056] Each expert subnetwork performs independent forward inference on the input graph and outputs a confidence score for that type. The final anomaly type label is the category corresponding to the maximum value of the weighted average of the route weight and the expert confidence score. ; The results of interpretable attribution analysis include the following four aspects: Anomaly type labels and confidence levels: Clearly specify the main anomaly types and their confidence probabilities; Key transaction node contribution ranking: obtained by backpropagating the weights of the attention mechanism within the expert subnetwork to the input node features. The higher the contribution of a node, the greater its influence on the final decision. Key time window identifier: Extract the time period that plays a decisive role in anomaly detection by using the temporal attention weights in the gating network; Diagram of abnormal propagation paths: The main propagation paths of abnormal behavior are highlighted on the transaction propagation chain map.

[0057] Specifically, the attribution contribution is further weighted and propagated based on the edge weights in the graph to quantify the cascading impact factors of upstream transaction nodes on the current anomaly type. For example, in a money laundering scenario, the impact of fund flows from a "collection account" to a "distribution account" on the final money laundering determination can be quantified.

[0058] The multi-expert parallel network architecture enables refined classification of abnormal transactions, allowing regulators to take differentiated measures based on different types (e.g., money laundering transactions require account freezing and reporting, while system malfunctions only require manual verification). The interpretability mechanism embedded in the gating network makes the "black box" decision-making process transparent, and the output cascading influence factors can reveal the transmission path and key nodes of abnormal behavior, providing strong decision support for accurately combating financial crimes.

[0059] Step S7: Closed-loop feedback optimization mechanism.

[0060] This embodiment also includes a closed-loop feedback optimization step. The anomaly type label output in step S6 and the interpretability attribution analysis results are written back to the blockchain traceability layer via a smart contract and stored in association with the corresponding traceability request record, forming a complete audit record containing information from the entire process of "detection—traceability—classification—attribution".

[0061] Each participating node periodically retrieves complete audit records from the blockchain, and updates its local risk rule base and the loss function weights of the graph neural network model accordingly. If a certain abnormal pattern occurs repeatedly but is not covered by existing rules, the system will automatically generate new rule suggestions or adjust the threshold of existing rules. If a rule is marked as having a high false positive rate during validation, its weight in the rule engine will be automatically reduced. If attribution analysis finds that certain types of anomalies are strongly correlated with specific graph topologies, then the loss weight of the corresponding samples will be increased in the next round of federated learning training.

[0062] The closed-loop feedback mechanism enables the entire system to continuously learn and adaptively optimize. As the system operates, the accuracy of anomaly detection and the efficiency of source tracing will continuously improve, enabling it to cope with ever-evolving financial crime methods and maintain long-term effectiveness.

[0063] Example 2 This embodiment provides a distributed intelligent screening and tracing system for transaction anomalies, which is used to implement the above method. Its overall architecture is shown in the attached figure. Figure 1 As shown, it includes a distributed detection layer, a federated learning coordination layer, a real-time screening layer, a blockchain traceability layer, and an anomaly analysis layer.

[0064] The distributed detection layer is deployed across multiple participant nodes. Each participant node includes a temporal graph construction unit and a local graph attention network unit. The temporal graph construction unit converts local transaction log data into a transaction temporal graph. The local graph attention network unit is configured with a temporal encoding module and a multi-head attention aggregation module to extract the temporal graph structural features of transaction behavior and generate local node embedding representations. This unit also includes a feature perturbation compensation module to correct graph topology drift caused by differences in business operations among participants.

[0065] The federated learning coordination layer is deployed on the coordination server of the consortium network and includes a risk perception aggregation unit and a global model update unit. The risk perception aggregation unit calculates structural risk intensity indicators based on the local model parameters uploaded by each participant, generates aggregation weights through a time decay mapping function, and adjusts the aggregation process using graph topology similarity regularization constraints. The global model update unit performs weighted aggregation operations, generates global model parameters, and distributes them.

[0066] The real-time screening layer is deployed on each participating node and includes an anomaly scoring unit and an alarm generation unit. The anomaly scoring unit runs global model inference on real-time transaction data and performs weighted fusion with the rule hit score of the rule engine; the alarm generation unit generates an anomaly alarm event when the fused score exceeds a threshold.

[0067] The blockchain traceability layer is built on a consortium blockchain architecture and includes a smart contract module, a transaction log storage module, and a traceability execution module. The smart contract module is responsible for receiving and verifying traceability requests and dynamically adjusting the traceability depth according to the risk level; the transaction log storage module stores all transaction logs in an immutable manner; the traceability execution module performs bidirectional path backtracking based on transaction identifiers and calls cross-chain relay nodes to obtain cross-chain transaction information, ultimately constructing a transaction propagation chain graph.

[0068] The anomaly analysis layer comprises a gated routing network, a multi-expert subnetwork array, and an attribution analysis module. The gated routing network maps the input graph to routing weights for each expert subnetwork; the multi-expert subnetwork array corresponds to anomaly types such as money laundering, fraud, market manipulation, and system failure, and performs inference in parallel; the attribution analysis module integrates the outputs and attention weights of each expert to generate anomaly type labels and interpretable attribution analysis results containing cascading influence factors.

[0069] The system communicates with each other through standard APIs and message queues, and is deployed in a containerized environment, supporting elastic scaling and high availability.

[0070] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. A distributed transaction anomaly intelligent screening and tracing method, characterized in that, include: S1, multiple participating nodes respectively use local graph attention networks to extract the temporal graph structure features of transaction behavior on local transaction data, and generate local node embedding representations; The local graph attention network includes a temporal coding module and a multi-head attention aggregation module; The time-series coding module performs multi-scale time difference feature extraction and periodic position coding fusion on the timestamps of transaction data to generate time-series enhanced node features. The multi-head attention aggregation module calculates the attention weights between adjacent nodes based on the temporal enhanced node features, and aggregates multi-level neighbor information through multiple rounds of message passing; The aggregation range of the multi-order neighbor information is adaptively determined based on the degree centrality of the nodes; the temporal coding module also introduces a feature perturbation compensation term, which is calculated based on the heterogeneity of the clustering coefficients and the degree distribution skewness of the node's neighborhood, and is used to correct the differences in the transaction graph topology between nodes of different participants; S2, each participating node uploads the local node embedded representation to the federated learning coordinator. The federated learning coordinator uses a risk-aware dynamic aggregation strategy to weight and aggregate the received local model parameters, generate global model parameters, and distribute them. The risk-aware dynamic aggregation strategy determines the aggregation weights based on the structural risk intensity of abnormal samples in each participating node. The risk perception dynamic aggregation strategy includes: calculating the structural risk intensity index of abnormal nodes in the local transaction graph of each participating node, wherein the structural risk intensity index is obtained by weighted summation of the node's clustering coefficient anomaly, centrality deviation, and community affiliation anomaly; constructing a mapping function with time decay characteristics to map the structural risk intensity index to an aggregation weight value; and performing a weighted average of the local model parameters uploaded by each participating node based on the aggregation weight value. S3, each participating node scores the anomaly probability of the real-time transaction data based on the received global model parameters, and generates an anomaly alarm event when the anomaly probability exceeds a preset threshold. S4, the transaction data associated with the abnormal alarm event is packaged into a tracing request, and the tracing request is submitted to the blockchain tracing layer through a smart contract; the smart contract performs the following operations: verifying the legality of the identity of the participating node initiating the tracing request, the existence of the transaction identifier, and the query permission; after successful verification, the tracing execution process of the blockchain tracing layer is triggered, and the tracing request is recorded in the blockchain ledger; the smart contract also dynamically adjusts the tracing depth according to the risk level of the abnormal alarm event, triggering full-path bidirectional tracing for high-risk alarms, and triggering tracing with limited hops for medium- and low-risk alarms; S5, the blockchain traceability layer traces back the associated transaction path from the stored transaction logs based on the transaction identifier in the traceability request, and constructs a transaction propagation link graph; S6, the transaction propagation link graph is input into the anomaly type identification expert network, and adaptively routed to the corresponding expert sub-network through a gating mechanism, and the anomaly type label and interpretability attribution analysis results are output; the anomaly type identification expert network contains multiple parallel expert sub-networks, and the multiple parallel expert sub-networks correspond to different anomaly types respectively.

2. The method according to claim 1, characterized in that, The risk perception dynamic aggregation strategy further includes: calculating the topological structure representation vector of the local transaction graph of each participating node, constructing a graph topological structure similarity regularization constraint term, and using the regularization constraint term to adjust the parameter update magnitude when aggregating global model parameters.

3. The method according to claim 1, characterized in that, The anomaly probability score in S3 is a weighted fusion value of the node anomaly probability value output by the global model and the rule hit weighted score output by the rule engine; the rules preset by the rule engine include at least one of the following: large-amount frequent transaction rules, non-working-hour transaction rules, cross-border high-frequency transaction rules, and wash trading rules.

4. The method according to claim 1, characterized in that, The interpretability attribution analysis results in S6 include anomaly type labels and their confidence levels, ranking of attribution contributions of key transaction nodes, key time window identifiers, and anomaly propagation path diagrams. The attribution contribution is obtained by backpropagating the attention mechanism weights within the expert subnetwork to the input node features, and is weighted according to the edge weights in the transaction propagation link graph to quantify the cascading influence factor of upstream transaction nodes on the current anomaly type.

5. A distributed intelligent screening and tracing system for abnormal transactions, characterized in that: The system is used to perform the method according to any one of claims 1-4, the system comprising: A distributed detection layer, deployed across multiple participant nodes, is used to extract the temporal graph structure features of local transaction data using a local graph attention network and generate local node embedding representations. The federated learning coordination layer is used to receive the local node embedding representations uploaded by each participating node, and uses a risk-aware dynamic aggregation strategy to weight and aggregate the local model parameters to generate global model parameters and distribute them. A real-time screening layer is deployed on each participating node to score the anomaly probability of real-time transaction data based on the global model parameters and generate an anomaly alarm event when the anomaly probability exceeds a preset threshold. The blockchain traceability layer is used to receive traceability requests through smart contracts, trace back the related transaction paths based on the transaction identifiers in the traceability requests, and construct a transaction propagation link graph. The anomaly analysis layer includes a gating network and multiple parallel expert subnetworks. The gating network is used to adaptively route the transaction propagation path graph to the corresponding expert subnetwork. The multiple parallel expert subnetworks correspond to different anomaly types. The anomaly analysis layer outputs anomaly type labels and interpretability attribution analysis results.

Images