Digital financial fraud risk intelligent identification method based on space-time feature driving

Abstract

The application belongs to the field of computer and Internet finance, and discloses a digital financial fraud risk intelligent identification method based on space-time feature driving, which comprises the following steps: S1. Collecting credit original data of a target user; S2. Building a "six-level data governance and real-time mapping" mechanism for pre-processing combined features derived from step S1 to solve the problems of multi-source heterogeneity, field missing, distribution drift and dynamic evolution of graph structure in the credit scenario; S3. Building a three-channel heterogeneous model; S4. Inputting the credit data pre-processed in step S2 into the three-channel heterogeneous model built in step S3 to complete the default probability inference, and then outputting the final risk score through the "strong leading type weighted fusion" strategy. The method can analyze the financial indicators, behavior sequence and potential associated risks of the borrower in real time, pre-identify high-risk individuals and fraud gang networks, advance the risk discovery to the pre-loan approval link, and reduce the credit loss and risk exposure of financial institutions from the source.

Description

Technical Field

[0001] This invention belongs to the field of computer and internet finance, specifically relating to a method for intelligent identification of digital financial fraud risk based on spatiotemporal features. Background Technology

[0002] Current credit risk assessment generally faces core challenges such as high data dimensionality, extremely imbalanced samples, and complex customer relationships. Traditional scoring cards and single machine learning models are insufficient to effectively characterize the temporal characteristics of borrower behavior and the risk transmission effects in implicit social / transactional networks, leading to insufficient identification of high-risk customers, weak penetration of organized fraud, and persistent pressure on bad debt rates. These problems seriously affect the efficiency of financial institutions' credit business decision-making and risk management capabilities, urgently requiring an intelligent, multi-model integrated, efficient, and accurate credit risk assessment solution. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a digital financial fraud risk intelligent identification method based on spatiotemporal features. This invention aims to solve the problem that existing methods cannot accurately identify high-risk customers and are prone to bad debt rates.

[0004] The present invention solves the above problems by adopting the following technical solution: A method for intelligent identification of digital financial fraud risk based on spatiotemporal features includes the following steps: S1. Collect raw credit data of target users and perform feature derivation; S2. Construct a "six-level data governance and real-time mapping" mechanism to preprocess the combined features derived from step S1, in order to solve the problems of multi-source heterogeneity, field omission, distribution drift and dynamic evolution of graph structure in credit scenarios; S3. Construct a three-channel heterogeneous model; S4. Input the preprocessed credit data from step S2 into the three-channel heterogeneous model constructed in step S3 to complete the default probability inference, and then output the final risk score through the "strong dominant weighted fusion" strategy.

[0005] Furthermore, step S1 includes the following sub-steps: S1.1 Collection of raw credit data; The target user's raw credit data includes: a unique letter of credit identifier assigned to the loan list, loan default status, loan amount, loan term, loan interest rate, installment payment amount, loan grade, sub-grades of the loan grade, employment title, years of employment, property ownership status provided by the borrower at the time of registration, annual income, verification status, month of loan disbursement, loan purpose, postal code, area code, debt-to-income ratio, delinquency events, FICO score, credit profile, public records, total credit revolving balance, revolving credit utilization rate, total credit line, loan list, loan score, publicly available strategy codes, and a series of anonymized features; S1.2 Feature Derivation; The raw data was extracted into 10 combined features, including balance, used credit limit, annual repayment amount, annual income / annual repayment, debt, interest rate*number of periods, installment payment / annual income, average debt per borrower, sum of anonymized features, and number of valid bad records.

[0006] Furthermore, the specific content of the "six-level data governance and real-time mapping" mechanism in step S2 is as follows: I. The first level is "Missing-Abnormal Joint Perception Filling": For floating-point features and discrete enumeration features in the combined features, a zero-value hard-filling strategy is uniformly adopted; that is, for NaN null values, positive infinity inf and negative infinity -inf existing in the data matrix, the numpy.nan_to_num function is used to force mapping to 0.0; for missing enumeration keys in the input dictionary, the dict.get(key, 0) interface returns 0 by default; II. The second level is "extreme value hard truncation boundary protection": static threshold truncation is implemented to deal with extreme outliers; the upper and lower boundaries are set to ±1×10. 6 For feature values ​​that exceed the range, a clip operation is performed to force mapping to the boundary value; for values ​​that exceed the boundary, no smooth decay processing is performed, but they are directly truncated. The gradient self-adjustment property of the nonlinear activation function embedded in the model during backpropagation is used to alleviate the gradient abruptness problem that may be caused by hard truncation. III. The third level is "single-space normalization mapping": standard Z-score normalization is used to align feature distributions; during offline training, the column-wise mean of all training samples is calculated using sklearn.preprocessing.StandardScaler. μ with standard deviation σ And persist the scaler object; during the online inference phase, reuse the scaling parameters estimated offline to perform a linear transformation on the input features. x - μ ) / σ ; IV. Level 4 is "Graph Augmentation and Anchor Point Perception Bias Coding": This level provides prior knowledge injection of default for HGCN and GCN channels; Specifically, in the offline stage, feature vectors of all default samples after dimensionality reduction by PCA are extracted to construct a default anchor feature library, where default = 1; then, the average 3-nearest neighbor distance between any new sample x and the anchor library is calculated and defined as the "default tendency distance" d; d is compressed by the inversion function and concatenated to the original features to form an 11-dimensional input. V. The fifth level is "Dynamic edge index generation in real time": In the online stage, the full adjacency list is not saved. Instead, a "build as needed" strategy is adopted. When a new sample arrives, the system completes the k-nearest neighbor search within 5 ms and obtains 5 undirected edges. To enhance robustness, "self-loop + reverse edge" is added and deduplication is performed. The final edge index length is ≤12. VI. Level 6 is "Static Global Randomness Governance": For all operations involving randomness, a fixed global seed strategy is adopted; that is, during the model initialization phase, torch.manual_seed(42) and numpy.random.seed(42) are uniformly set to lock the random SVD rotation of PCA, the data shuffling order and the Dropout mask generation logic.

[0007] Furthermore, in step S3, the three-channel heterogeneous model includes three parallel models: LSTM, GCN, and HGCN. LSTM: Targeting customer repayment behavior, account changes, and fund flow sequence data, it mines long-term and short-term dependencies and abnormal trends, improving the sensitivity to identify "behavioral degradation / decline in repayment willingness". The improvement of LSTM is that it treats 10-dimensional static features as single-step multi-dimensional signals, uses a single-layer LSTM with 64 hidden units to extract cross-feature coupled memories, and finally maps them to binary classification logit through a fully connected layer. GCN: Constructs a customer association graph in a 10-dimensional feature space, aggregates neighbor risk features through graph convolution, and effectively captures risk node diffusion and associated defaults; The GCN channel adopts a "lightweight block + jump connection" structure: After the input projection, three LightBlocks are stacked. Each LightBlock includes GCNConv, LayerNorm and Dropout, and residual connections are added between blocks. Finally, Jumping Knowledge is used to concatenate the outputs of each layer, and then output convolution is performed to obtain node-level logits; HGCN: Introduces hyperbolic geometric space to model complex credit networks with multi-level, non-Euclidean structures, enhancing the ability to penetrate and identify deep gang structures and cross-level risk transmission; The HGCN model adopts stable Lorentz manifold parameterization, designs Exp-Map0 and Log-Map0 to complete the bidirectional mapping between the tangent space and the manifold, and performs hyperbolic residual connections after each convolution to avoid gradient vanishing.

[0008] Furthermore, in step S4, the "strongly dominant weighted fusion" strategy refers to assigning fixed weights of 50% to HGCN, 30% to GCN, and 20% to LSTM.

[0009] Furthermore, the three-channel heterogeneous model constructs independent "feature-label" training samples for each channel in the offline stage, and adopts a joint mechanism of SMOTE oversampling and class-weighted cross-entropy to alleviate the imbalance of positive and negative samples and ensure that the model maintains recall in scenarios with few defaults.

[0010] Furthermore, in the online inference stage, the three-channel heterogeneous model completes feature standardization, outlier truncation, and PCA projection through a "plug-and-play" data pipeline, reusing the offline estimated scaler matrix and PCA rotation matrix throughout the process to ensure consistent training-inference distribution.

[0011] Furthermore, all calculations in step S4 are performed locally in a GPU / CPU hybrid environment, with the data remaining within the intranet and progress feedback provided by TQDM through asynchronous batch processing.

[0012] Beneficial effects: This invention leverages the dual business context of "high-dimensional sparse financial data + dynamic relational networks," integrating temporal modeling and graph neural network technologies to achieve a leap from single-point characterization to a three-dimensional risk profile. The method can analyze borrowers' financial indicators, behavioral sequences, and potential associated risks in real time, proactively identifying high-risk individuals and fraudulent networks, thus advancing risk discovery to the pre-loan approval stage and reducing credit losses and risk exposure for financial institutions at the source.

[0013] This invention constructs a "multi-model collaborative decision-making system" that integrates the advantages of three models: LSTM (capturing time-series features), GCN (mining graph structure relationships), and HGCN (adapting to heterogeneous data). For time-series data such as historical repayments and credit limit usage of credit users, LSTM extracts dynamic trend features; for relationships between users such as guarantees and transactions, GCN constructs graph structures and extracts associated risk features; for heterogeneous entity relationships such as "user-institution-asset," HGCN mines implicit risk transmission paths across different entity types; and finally, through multi-model voting or weighted fusion strategies, it outputs comprehensive risk assessment results, overcoming the limitations of a single model.

[0014] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0015] Figure 1 This is a flowchart of a digital financial fraud risk intelligent identification method based on spatiotemporal features according to the present invention; Figure 2 This is a technical roadmap for a digital financial fraud risk intelligent identification method based on spatiotemporal features, as described in this invention. Detailed Implementation

[0016] To make the technical solutions, advantages, and objectives of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention without creative effort are within the protection scope of this application.

[0017] like Figure 1 and Figure 2 As shown, this invention provides a method for intelligent identification of digital financial fraud risk based on spatiotemporal features, comprising the following steps: S1. Collect raw credit data of target users and perform feature derivation; S1.1 Collection of raw credit data; The target user's raw credit data includes: A unique letter of credit identifier assigned to the loan list: a unique number for each loan, used to distinguish and track different loan applications.

[0018] Loan default situation, task objective: label variable, with a value of 0 or 1, where 1 indicates that the loan has defaulted and is the target that the model needs to predict.

[0019] Loan Amount: The total amount of loans applied for and approved by users is a core indicator for measuring loan size.

[0020] Loan term (year): The repayment period for a loan, usually measured in years, commonly 3 or 5 years.

[0021] Loan interest rate: The annualized interest rate of this loan determines the interest cost that the user needs to pay.

[0022] Installment payment amount: The fixed amount of principal and interest that the user needs to repay each month.

[0023] Loan rating: The loan risk level given by the platform based on the user's qualifications, usually from A to G, where A is the lowest risk and G is the highest risk.

[0024] Loan grade sub-grades: finer-grained classification of grades, such as A1 and A2, to further differentiate risks.

[0025] Job title: The job title that the user fills in when applying, such as "engineer" or "manager".

[0026] Length of employment: The duration of a user's current employment, usually measured in years, reflecting income stability.

[0027] The property ownership status provided by the borrower during registration: This indicates the user's housing type, such as owner-occupied, mortgaged, or rented, reflecting their asset status.

[0028] Annual income: The user's declared pre-tax annual income is a key indicator for assessing repayment ability.

[0029] Verification status: The platform's verification result of information such as income provided by the user, such as verified or unverified.

[0030] The month of loan disbursement: The actual date the loan was disbursed, used to analyze risk changes over time.

[0031] The loan purpose category when applying for a loan includes debt consolidation, home renovation, education, etc., and different purposes have different risk characteristics.

[0032] The first three digits of the postal code provided by the borrower in the loan application are used to locate the approximate area where the user is located and to analyze regional risk.

[0033] Regional coding: A standardized coding system for the user's location, used for regional risk analysis.

[0034] Debt-to-income ratio: The ratio of a user's monthly debt expenditure to their monthly income is an important indicator for measuring repayment pressure; the higher the value, the greater the risk.

[0035] The number of default events with overdue payments of more than 30 days in the borrower's records over the past two years: This reflects the borrower's recent credit history and is a key indicator for assessing their willingness to repay; the higher the value, the greater the risk.

[0036] The lower limit of a borrower's FICO score at the time of loan disbursement: The FICO score is a core indicator for measuring personal credit. This value represents the lower limit of a borrower's credit score; the lower the value, the higher the credit risk.

[0037] The upper limit of a borrower's FICO score at the time of loan disbursement: the upper limit of the FICO score, which, together with the lower limit, determines the borrower's credit score range.

[0038] The number of outstanding credit lines in a borrower's credit file: This refers to the number of credit accounts that the borrower currently holds that have not yet been settled. An excessive number of such accounts may indicate a high level of debt pressure.

[0039] The amount of public records reflects the risk: including publicly available negative credit records such as bankruptcy, tax liens, and court judgments. The more records there are, the higher the risk.

[0040] Number of publicly cleared records: This refers to the number of public records such as bankruptcy records that have been cleared, which can reflect the improvement of a borrower's credit to some extent.

[0041] Total Credit Revolving Balance: The current total amount owed in a borrower's revolving credit account (such as a credit card), which is an indicator of the size of their debt.

[0042] Revolving credit utilization, or the amount of credit a borrower uses relative to all available revolving credit: calculated as revolBal / total available revolving credit. A higher ratio indicates a greater reliance on revolving credit by the borrower and thus a higher risk.

[0043] Total current credit limit in the borrower's credit profile: This refers to the total number of all credit accounts a borrower has, reflecting the richness of their credit history.

[0044] Initial listing status of a loan: This indicates the initial display status of the loan on the platform, usually divided into "full" and "partial", which will affect the efficiency of loan fund matching.

[0045] Indicate whether the loan is an individual application or a joint application with two co-borrowers: joint applications usually imply greater repayment ability, but may also increase credit complexity.

[0046] The month in which the borrower first reported the credit line was opened: This reflects the length of the borrower's credit history. The longer the credit history, the higher the credibility of the assessment is generally considered.

[0047] Loan score provided by the borrower: This refers to the FICO score provided by the borrower, which is different from the score calculated by the platform based on a range.

[0048] The strategy code is publicly available, but not for new products: The strategy code used for risk decision-making within the platform is not publicly available for some new products.

[0049] Anonymous features: Derived features obtained by anonymizing some sensitive or unusable borrower behavioral characteristics, used for model training.

[0050] S1.2 Feature Derivation; The raw data was extracted into 10 combined features, including balance, used credit limit, annual repayment amount, annual income / annual repayment, debt, interest rate*number of periods, installment payment / annual income, average debt per borrower, sum of anonymized features, and number of valid bad records.

[0051] S2. Construct a "six-level data governance and real-time mapping" mechanism to preprocess the combined features extracted in step S1, in order to solve the problems of multi-source heterogeneity, field omission, distribution drift and dynamic evolution of graph structure in credit scenarios; In step S2, the specific content of the "six-level data governance and real-time mapping" mechanism is as follows: I. The first level is "Missing-Abnormal Joint Hard-Coded Imputation": For floating-point features and discrete enumeration features in the original credit data, this invention uniformly adopts a zero-value hard-imputation strategy. Specifically, for NaN null values, positive infinity (inf), and negative infinity (-inf) in the data matrix, the numpy.nan_to_num function is used to force mapping to 0.0; for missing enumeration keys in the input dictionary, the dict.get(key, 0) interface returns 0 by default. This invention abandons the computational overhead of traditional multi-imputation models, treats the imputation error as a low-confidence signal, and automatically suppresses it through the weight decay mechanism of the subsequent deep model, avoiding the risk of distribution shift caused by external imputation. After imputation, the data dimension remains unchanged from the original dimension, and no auxiliary mask channel is added, making it suitable for high-throughput, low-latency online inference scenarios. II. The second level is "extreme value hard truncation boundary protection": This invention implements static threshold truncation to handle extreme outliers. The upper and lower boundaries are set to ±1×10. 6 For feature values ​​exceeding this range, a clip operation is performed to force mapping to boundary values. This threshold is determined based on the 99.99% quantile of the training set, covering the normal business fluctuation range. Values ​​exceeding the boundary are not subject to smoothing attenuation but are directly truncated. The gradient self-adjustment characteristics of the non-linear activation function (such as GELU) embedded in the model during backpropagation are utilized to mitigate the gradient abruptness problem that may be caused by hard truncation. This strategy reduces memory usage by 60% and is 3 times faster than truncation methods based on dynamic quantiles, making it suitable for batch processing of tens of millions of samples. III. The third level is "single-space standardized mapping": This invention uses standard Z-score standardization to align feature distributions. During the offline training phase, the column-wise mean μ and standard deviation of all training samples are calculated using sklearn.preprocessing.StandardScaler.σ And persist the scaler object; during the online inference phase, reuse the scaling parameters estimated offline to perform a linear transformation on the input features. x - μ ) / σ This invention does not distinguish between long-tailed distributions and approximately normal distributions, but standardizes them uniformly in the original feature space. It relies on the model's built-in weight regularization (weight_decay=5e-4) and LayerNorm in the graph convolutional layer to improve robustness against distribution skew. This simplification reduces preprocessing time from 12ms in traditional dual-space fusion to 0.8ms, with an AUC loss of less than 0.005, satisfying both engineering accuracy and efficiency constraints. IV. The fourth level is "Graph Augmentation and Anchor Point Awareness Propensity Encoding": This level provides prior knowledge injection of default to the HGCN and GCN channels. Specifically, in the offline stage, the feature vectors of all default samples (y==1) after PCA dimensionality reduction are extracted to construct a default anchor point feature library; in the online stage, for any new sample x to be predicted, the average 3-nearest neighbor distance d between it and the anchor point library is quickly calculated using NearestNeighbors (n_neighbors=3). d is then linearly compressed and concatenated to the end of the original feature vector to form an 11-dimensional augmented input vector. This distance is defined as the default tendency distance, which can provide initial message passing directionality for the graph convolutional layer without relying on real social network relationships, enabling isolated new nodes to quickly integrate into the global graph structure. This invention preferably uses cosine distance to measure similarity, ensuring that the directionality is not affected by the feature scale; Level V, the fifth level, features "Dynamic Instant Edge Index Generation": This level employs a build-as-you-go strategy to dynamically expand the graph structure, without storing the full adjacency matrix during the online phase. When a new sample arrives, the system performs a k-nearest neighbor search within 5ms using NearestNeighbors(n_neighbors=5, metric='cosine') to obtain the 5 most similar training samples. To enhance robustness, self-loops and reverse edges are added, and duplicate edges are removed using torch.unique, resulting in an edge index length ≤ 12. This strategy reduces memory usage from O(N) to O(N)^2. 2 The computation time is reduced to O(N), and a single card supports 12,000 graph expansions per second, enabling the graph structure to evolve in real time with the data flow without global graph reconstruction. This invention preferably uses NeighborLoader for batch neighbor sampling, combined with GPU acceleration, reducing the average time of a single graph expansion to 3.2ms, meeting millisecond-level online inference requirements. VI. Level 6 is "Static Global Randomness Governance": For all operations involving randomness, this invention adopts a fixed global seed strategy. During the model initialization phase, torch.manual_seed(42) and numpy.random.seed(42) are uniformly set to lock the random SVD rotation of PCA, the data shuffling order, and the Dropout mask generation logic. This invention does not provide request-level dynamic seeds or audit mode switches, but relies on global static seeds to ensure that the binary results are consistent before and after the service restart, which facilitates model debugging and effect reproduction. This design achieves 100% result reproducibility in single-machine API services, and synchronizes random states through a parameter server in distributed deployment, meeting the stringent stability requirements of financial institutions.

[0052] S3. Construct a three-channel heterogeneous model; The three-channel heterogeneous model includes three parallel models: LSTM, GCN, and HGCN. LSTM channels are used to capture long-short-term dependencies among the 10-dimensional derived features of credit customers. This invention uses the static feature vector X ∈ [preprocessed step S2] to... 10 (Corresponding to 10 derived features: revolving balance account ratio, account utilization rate, loan amount to term ratio, income to loan ratio, total debt, job stability index, monthly payment to income ratio, loan application type interaction value, negative event count, and number of bad records) are reconstructed into a single-step time series signal and input into a single-layer LSTM network with 64 hidden units.

[0053] Specifically, the implicit state update of the LSTM unit at time step t follows a gating mechanism: The input gate controls the flow of current information: in, σ This represents the Sigmoid activation function. The input gate weight matrix, For bias vectors, This is the implicit state from the previous moment. Input features for the current time step (t=1 in this invention, i.e., single-step input).

[0054] The Forgotten Gate determines the preservation of historical information: in, Here is the forget gate weight matrix. This is the bias vector.

[0055] Cell state updates store long-term memory: Here, ⊙ represents element-wise multiplication. This represents the cell state at the previous moment. The cell state weight matrix is... This is the bias vector.

[0056] The output gate generates the current output: in, This is the output gate weight matrix. For bias vector Latent states (i.e., extracted temporal features): This invention will hide the final layer state via fully connected layer Mapped to binary logits, after Softmax activation, the default probability PLSTM∈[0,1] is output.

[0057] The GCN channel performs message passing on a dynamically constructed k-nearest neighbor graph, capturing potential customer community effects and risk contagion paths. Let Graph = (V, E), where the node set V corresponds to credit samples, the edge set E is dynamically generated by the fifth level, the adjacency matrix is ​​A ∈ {0,1}^(N×N), and the node feature matrix H... ∈ ^(N×11) (10-dimensional original features + 1-dimensional default tendency distance).

[0058] Specifically, the convolution operation of the l-th layer graph follows: in, The adjacency matrix for adding self-loops, where IN is the identity matrix. Degree matrix ( ), The learnable weight matrix for the l-th layer (d(0) = 11 in this invention, and the hidden layer dimension is 64). Let l be the feature matrix of the nodes in the l-th layer. σ This represents the ReLU activation function.

[0059] This invention employs a "lightweight block + skip connection" structure, stacking 3 LightBlocks. Updates to node v within each LightBlock follow the following rules: in, , Let v represent the set of neighbors of node v. Let v be the degree of node v.

[0060] Jump connections concatenate the outputs of each layer using Jumping Knowledge: in, This represents feature concatenation. The final output is then processed through a fully connected layer. Mapped to logits, after Softmax, the default probability PGCN∈[0,1] is obtained.

[0061] The HGCN channel introduces hyperbolic geometric space to accurately characterize the distances of hierarchical credit networks. This invention uses the Lorentz manifold as the hyperbolic space model, defined in... The above satisfies: The hyperbolic inner product , For the time dimension component.

[0062] Specifically, feature mapping is achieved through tangent space mapping. Given points on the manifold... and any point The tangent space mapping is: in, x 1: indicates x Spatial components other than the 0th dimension, This represents the Euclidean norm.

[0063] Exponential mapping will tangent space vector Projected manifold: The execution process of the hyperbolic graph convolutional layer for each node is as follows: For nodes v At layer l, the feature update follows:

[0064] in: This represents the hyperbolic embedding of node v at layer l. Let v be the set of neighbors of node v, AGG represents the neighbor aggregation operation in hyperbolic space (hyperbolic mean is used in this invention), and proj is the projection operator that guarantees manifold constraints.

[0065] Hyperbolic residual connections prevent gradient vanishing in deep networks: in, For hyperbolic addition, via M Implemented using Bius addition.

[0066] Finally, the logmap is mapped back to Euclidean space, and the default probability PHGCN∈[0,1] is output.

[0067] LSTM: Analyzes customer repayment behavior, account changes, and fund flow sequence data to uncover long-term and short-term dependencies and abnormal trends, improving the sensitivity to identify "behavioral deterioration / decline in repayment willingness"; GCN: Constructs a customer association graph in a 10-dimensional feature space, and aggregates neighbor risk features through graph convolution to effectively capture risk node diffusion and associated defaults; HGCN: Introduces hyperbolic geometric space to model complex credit networks with multi-level, non-Euclidean structures, enhancing the ability to penetrate and identify deep gang structures and cross-level risk transmission. The LSTM, GCN, and HGCN models were jointly trained and their hyperparameters were adaptively tuned to improve the model's sensitivity to identifying default risks.

[0068] S4. Input the preprocessed credit data from step S2 into the three-channel heterogeneous model constructed in step S3 to complete the default probability inference, and then output the final risk score through the "strong dominant weighted fusion" strategy.

[0069] I. Parallel Default Probability Inference of Three Channels: The standardized, dimensionality-reduced and graph augmented data after the six-level governance in step S2 are synchronously input into the three-channel heterogeneous model. The three sub-models independently perform forward propagation and generate default probability outputs respectively; (1) LSTM Channel Temporal Memory Extraction: For the static financial feature vector of credit customers, this invention reconstructs it into a single-step multi-dimensional temporal signal and inputs it into a single-layer LSTM network with 64 hidden units. Through the gating mechanism (forget gate, input gate, output gate), the high-order coupling relationship and long-short-term dependency pattern across feature dimensions are dynamically captured, especially strengthening the temporal memory ability of augmented features such as "default tendency distance". The hidden state of the last layer of LSTM is mapped to binary classification logits through the fully connected layer, and the default probability P_LSTM is output after Softmax activation. In the absence of real temporal data, this channel effectively realizes the feature interaction of virtual time steps, which significantly improves the robustness to extreme feature combinations; (2) GCN Channel Graph Structure Risk Diffusion: On the dynamically constructed k-nearest neighbor graph, this invention adopts the "lightweight block + skip connection" architecture to perform graph convolution operation. The input node features are aggregated with first-order neighbor information by GCNConv, and are stably trained by LayerNorm and Dropout. Three LightBlocks are superimposed to achieve deep message passing. Each LightBlock contains residual connections to retain the original node information. Finally, the outputs of each layer are spliced ​​through the JumpingKnowledge mechanism, and node-level logits are generated through the output convolutional layer. After Softmax, the default probability P_GCN is obtained. This channel effectively captures the potential community effect and risk contagion path of customers, and improves the early warning sensitivity of associated defaults. (3) Hyperbolic geometric hierarchical modeling of HGCN channel: Euclidean space features are mapped to Lorentz hyperbolic manifolds, and the multi-level tree structure of the credit network is characterized by the "exponential expansion rate" of hyperbolic space. The bidirectional mapping between expmap0 and logmap0 is realized through StableLorentz manifolds. Each layer of hyperbolic graph convolution performs a closed loop of tangent space linear transformation-manifold exponential mapping-residual connection to avoid gradient vanishing. HGCN has a stronger ability to distinguish the low-dimensional sparse features of "thin document" customers, outputting the default probability P_HGCN, thus enhancing the identification of gang fraud and cross-layer risk transmission.

[0070] II. Strong Dominant Weighted Fusion Strategy: In order to overcome the information overwhelming caused by simple averaging of multiple models, this invention proposes a fixed weight weighted fusion mechanism, which assigns differentiated weights based on the expression capacity of the three channels in sparse data scenarios: (1) HGCN weight: 50% (hyperbolic geometry has the largest expression capacity for non-Euclidean network data, dominating default judgment); (2) GCN weight: 30% (graph structure captures second-order association risk, assisting in community contagion identification); (3) LSTM weight: 20% (temporal memory supplements feature interaction, improving the robustness of extreme values).

[0071] The fusion formula is as follows: III. Risk Score Generation and Classification: This involves generating and classifying the merged continuous probabilities. Mapped to a 100-point risk score:

[0072] This invention classifies risk levels into three levels based on the scoring range and provides corresponding differentiated credit strategies: (1) Low risk (Score < 50%): the probability of default is less than 0.5, and it is recommended to approve the loan and offer preferential interest rates; (2) Medium risk (50% ≤ Score < 80%): the probability of default is between 0.5 and 0.8, and it is recommended to approve the loan prudently, with interest rates increased and additional collateral conditions; (3) High risk (Score ≥ 80%): the probability of default is not less than 0.8, and it is generally rejected; if special approval is granted, full collateral and high-frequency post-loan monitoring are required.

[0073] IV. Offline Threshold – Online Reuse Strategy During the offline training phase, this invention uses a grid search with a step size of 0.005 on the validation set to determine the optimal binary classification threshold `best_th` that achieves an accuracy of ≥65% for class 0 and ≥65% for class 1. This threshold is then persisted to `best_threshold.json` in JSON format. During online inference, each model directly loads this threshold, converting continuous probabilities into binary labels for real-time calculation of model accuracy metrics in the backend. The front-end interface still displays continuous risk scores, balancing the accuracy requirements of business decisions with the interpretability needs of users.

[0074] The method of this invention is also equipped with a risk interpretation module, which analyzes risk factors, verifies the rationality of risk identification results, and proposes reasonable credit recommendations.

[0075] This invention proposes for the first time a "three-channel heterogeneous model collaboration" architecture in the back-end risk assessment process. Customer static features are simultaneously fed into the time memory channel, the graph relation channel, and the hyperbolic geometry channel. The default probability inference is independently completed by the Long Short-Term Memory Network (LSTM), the Graph Convolutional Network (GCN), and the Hyperbolic Graph Convolutional Network (HGCN), respectively. Finally, the risk score is output through a "strongly dominant weighted fusion" strategy, thereby taking into account three different data characteristics: sequence dependence, relation diffusion, and hierarchical distance, and significantly improving the prediction stability for low-sample, highly sparse credit scenarios.

[0076] To address the issue that traditional scoring cards cannot capture high-order nonlinear relationships, this invention constructs independent "feature-label" training samples for each channel in the offline stage. However, the three models share the same 10-dimensional numerical space after unified dimensionality reduction by PCA, which reduces the input dimension while retaining more than 95% of variance information. Subsequently, a joint mechanism of SMOTE oversampling and class-weighted cross-entropy is adopted to alleviate the imbalance between positive and negative samples and ensure that the model maintains recall in scenarios with few defaults.

[0077] During the online inference phase, feature standardization, outlier truncation, and PCA projection are completed through a "plug-and-play" data pipeline. The scaler matrix and PCA rotation matrix estimated offline are reused throughout the process to ensure consistency between training and inference distributions. For GCN and HGCN, a "dynamic graph expansion" step is further introduced: new samples are treated as incremental nodes, and their k-nearest neighbor relationships with the anchor points of the training set are calculated in real time. Edge indices are quickly spliced ​​and the adjacency list is updated, so that the graph structure grows dynamically with new data without retraining the entire graph, achieving millisecond-level response.

[0078] The improvement of the LSTM channel lies in breaking the conventional constraint of "must rely on time series": the 10-dimensional static features are regarded as single-step multi-dimensional signals, and the cross-feature coupling memory is extracted by a single-layer LSTM with 64 hidden units. Finally, it is mapped to the binary classification logit through a fully connected layer. In the credit scenario, this design is equivalent to a high-order feature interactor of "virtual time step". It can still give full play to the gating advantage of LSTM when there is no real time series data, and significantly improve the robustness to extreme value combinations.

[0079] The GCN channel adopts a "lightweight block + jump connection" structure: after the input projection, three LightBlocks are stacked. Each block consists of GCNConv, LayerNorm and Dropout, and residual connections are added between blocks. Finally, Jumping Knowledge is used to concatenate the outputs of each layer, and then output convolution is performed to obtain node-level logits. This structure captures the potential community effect of customers through local neighbor aggregation, and can especially detect the risk contagion caused by "guarantee chain" and "group loan fraud", thus improving the early warning capability of associated defaults.

[0080] The HGCN channel is the first to introduce hyperbolic geometry into retail credit risk measurement. It leverages the "naturally tree-like structure and exponential expansion rate" of hyperbolic space to more accurately characterize the distances of credit data with hierarchical relationships (such as region-industry-occupation-customer). The model employs stable Lorentz manifold parameterization, designs Exp-Map0 and Log-Map0 to complete the bidirectional mapping between the tangent space and the manifold, and performs hyperbolic residual connections after each convolution layer to avoid gradient vanishing. Experiments show that this channel significantly outperforms the Euclidean model in distinguishing customers with "thin files" (few features).

[0081] To overcome the information overload caused by simple averaging of multiple models, this invention proposes a "strongly dominant weighted fusion" mechanism: assigning fixed weights of 50% to HGCN, 30% to GCN, and 20% to LSTM. The rationale is that hyperbolic channels have the largest expressive capacity under sparse data, followed by GCN, while LSTM is mainly responsible for feature interaction and supplementation. This weighting has been verified by both grid search and business interpretability, and can improve the recall rate of high-risk customers (default probability ≥ 0.8) by more than 8% while maintaining AUC.

[0082] This invention also introduces an "offline threshold-online reuse" strategy: by using a grid search with a step size of 0.02-0.98 on the training set, the optimal threshold is found that makes the accuracy of class 0 ≥ 65% and the accuracy of class 1 ≥ 65%; this threshold is persisted as a JSON file, which is directly read during the inference stage to convert continuous probabilities into binary classification labels for real-time calculation of model accuracy in the background, while the front end still displays continuous probabilities, balancing the accuracy of business decisions with user interpretability.

[0083] Ultimately, the backend exposes three interfaces in the form of RESTful API: "single prediction", "batch CSV prediction" and "built-in result query". All calculations are completed locally in a GPU / CPU hybrid environment, and the data does not leave the internal network, meeting the stringent privacy compliance requirements of financial institutions. At the same time, through asynchronous batch processing and TQDM progress feedback, inference of 10,000 samples can be completed within 3 minutes, and horizontal scaling with multiple GPUs in parallel is supported.

[0084] It is hereby declared that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for intelligent identification of digital financial fraud risk based on spatiotemporal features, characterized in that, Includes the following steps: S1. Collect raw credit data of target users and perform feature derivation; S2. Construct a "six-level data governance and real-time mapping" mechanism to preprocess the combined features derived from step S1, in order to solve the problems of multi-source heterogeneity, field omission, distribution drift and dynamic evolution of graph structure in credit scenarios; S3. Construct a three-channel heterogeneous model; S4. Input the credit data preprocessed in step S2 into the three-channel heterogeneous model constructed in step S3 to complete the default probability inference, and then output the final risk score through the "strong dominant weighted fusion" strategy.

2. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 1, characterized in that, Step S1 includes the following sub-steps: S1.1 Collection of raw credit data; The target user's raw credit data includes: a unique letter of credit identifier assigned to the loan list, loan default status, loan amount, loan term, loan interest rate, installment payment amount, loan grade, sub-grades of the loan grade, employment title, years of employment, property ownership status provided by the borrower at the time of registration, annual income, verification status, month of loan disbursement, loan purpose, postal code, area code, debt-to-income ratio, delinquency events, FICO score, credit profile, public records, total credit revolving balance, revolving credit utilization rate, total credit line, loan list, loan score, publicly available strategy codes, and a series of anonymized features; S1.2 Feature Derivation; The raw data was extracted into 10 combined features, including balance, used credit limit, annual repayment amount, annual income / annual repayment, debt, interest rate*number of periods, installment payment / annual income, average debt per borrower, sum of anonymized features, and number of valid bad records.

3. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 2, characterized in that, In step S2, the specific content of the "six-level data governance and real-time mapping" mechanism is as follows: I. The first level is "Missing-Abnormal Joint Perception Filling": For floating-point features and discrete enumeration features in the combined features, a zero-value hard-filling strategy is uniformly adopted; that is, for NaN null values, positive infinity inf and negative infinity -inf existing in the data matrix, the numpy.nan_to_num function is used to force mapping to 0.0; for missing enumeration keys in the input dictionary, the dict.get(key, 0) interface returns 0 by default; II. The second level is "extreme value hard truncation boundary protection": static threshold truncation is implemented to deal with extreme outliers; the upper and lower boundaries are set to ±1×10. 6 For feature values ​​that exceed the range, a clip operation is performed to force mapping to the boundary value; for values ​​that exceed the boundary, no smooth decay processing is performed, but they are directly truncated. The gradient self-adjustment property of the nonlinear activation function embedded in the model during backpropagation is used to alleviate the gradient abruptness problem that may be caused by hard truncation. III. The third level is "single-space normalized mapping": feature distribution alignment is achieved using standard Z-score normalization; During the offline training phase, the column-wise mean of all training samples is calculated using sklearn.preprocessing.StandardScaler. μ with standard deviation σ And persist the scaler object; During the online inference phase, the scaling parameters from the offline estimation are reused to perform a linear transformation on the input features. x - μ ) / σ ; IV. Level 4 is "Graph Augmentation and Anchor Point Perception Bias Coding": This level provides prior knowledge injection of default for HGCN and GCN channels; Specifically, in the offline stage, feature vectors of all default samples after dimensionality reduction by PCA are extracted to construct a default anchor feature library, where default = 1; then, the average 3-nearest neighbor distance between any new sample x and the anchor library is calculated and defined as the "default tendency distance" d; d is compressed by the inversion function and concatenated to the original features to form an 11-dimensional input. V. The fifth level is "Dynamic edge index generation in real time": In the online stage, the full adjacency list is not saved. Instead, a "build as needed" strategy is adopted. When a new sample arrives, the system completes the k-nearest neighbor search within 5 ms and obtains 5 undirected edges. To enhance robustness, "self-loop + reverse edge" is added and deduplication is performed. The final edge index length is ≤12. VI. Level 6 is "Static Global Randomness Governance": For all operations involving randomness, a fixed global seed strategy is adopted; that is, during the model initialization phase, torch.manual_seed(42) and numpy.random.seed(42) are uniformly set to lock the random SVD rotation of PCA, the data shuffling order and the Dropout mask generation logic.

4. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 3, characterized in that: In step S3, the three-channel heterogeneous model includes three parallel models: LSTM, GCN, and HGCN. LSTM: Targeting customer repayment behavior, account changes, and fund flow sequence data, it mines long-term and short-term dependencies and abnormal trends, improving the sensitivity to identify "behavioral degradation / decline in repayment willingness". The improvement of LSTM is that it treats 10-dimensional static features as single-step multi-dimensional signals, uses a single-layer LSTM with 64 hidden units to extract cross-feature coupled memories, and finally maps them to binary classification logit through a fully connected layer. GCN: Constructs a customer association graph in a 10-dimensional feature space, aggregates neighbor risk features through graph convolution, and effectively captures risk node diffusion and associated defaults; The GCN channel adopts a "lightweight block + jump connection" structure: After the input projection, three LightBlocks are stacked. Each LightBlock includes GCNConv, LayerNorm and Dropout, and residual connections are added between blocks. Finally, Jumping Knowledge is used to concatenate the outputs of each layer, and then output convolution is performed to obtain node-level logits; HGCN: Introduces hyperbolic geometric space to model complex credit networks with multi-level, non-Euclidean structures, enhancing the ability to penetrate and identify deep gang structures and cross-level risk transmission; The HGCN model adopts stable Lorentz manifold parameterization, designs Exp-Map0 and Log-Map0 to complete the bidirectional mapping between the tangent space and the manifold, and performs hyperbolic residual connections after each convolution to avoid gradient vanishing.

5. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 4, characterized in that: In step S4, the "strong-dominant weighted fusion" strategy refers to assigning fixed weights of 50% to HGCN, 30% to GCN, and 20% to LSTM.

6. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 5, characterized in that: The three-channel heterogeneous model constructs independent "feature-label" training samples for each channel in the offline stage, and adopts a joint mechanism of SMOTE oversampling and class-weighted cross-entropy to alleviate the imbalance of positive and negative samples and ensure that the model maintains recall in scenarios with few defaults.

7. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 6, characterized in that: The three-channel heterogeneous model completes feature standardization, outlier truncation, and PCA projection through a "plug-and-play" data pipeline during the online inference phase. The entire process reuses the offline estimated scaler matrix and PCA rotation matrix to ensure consistent training-inference distribution.

8. The intelligent identification method for digital financial fraud risk based on spatiotemporal features according to claim 7, characterized in that: All calculations in step S4 are performed locally in a GPU / CPU hybrid environment, with data remaining within the intranet, and progress is fed back to TQDM via asynchronous batch processing.

Images