A risk behavior detection method based on a large model and multi-field data fusion

Abstract

The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing. tab The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing. tab The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing. The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing. The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing. The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing. The application discloses a risk behavior detection method based on a large model and multi-field data fusion, and belongs to the technical field of electric digital data processing.

Description

Technical Field

[0001] This invention relates to the field of risk behavior detection technology, and in particular to a risk behavior detection method based on large models and multi-domain data fusion. Background Technology

[0002] With the rapid development of large-scale modeling, multimodal learning, and anomaly detection technologies, intelligent risk identification methods for multi-source heterogeneous data have shown great application potential in public service scenarios such as education subsidies, medical settlement, social security, civil affairs assistance, housing security, employment subsidies, and elderly care services. In the context of district and county public service processing, there are complex coupling relationships between business forms, fund records, process times, entity information, geographical location, relational connections, and textual materials. Practical applications require models to possess multi-domain data fusion, cross-modal semantic understanding, low-annotation anomaly identification, and interpretable results to meet the routine supervision needs of pre-event warning, in-event monitoring, and post-event auditing. However, existing risk behavior detection technologies for district and county public services mainly have the following shortcomings: (1) Single modality or rule limitation: Existing methods usually make independent judgments based on a single data source or a single modality of information, failing to effectively integrate multi-source data such as business forms, fund records, process time, subject information, geographical location, relationship association and text materials, resulting in information blind spots, difficulty in simultaneously utilizing multi-source information such as text materials and relationship networks, difficulty in capturing implicit relationships between different field groups, resulting in information blind spots and missed detections.

[0003] (2) Fixed thresholds are difficult to migrate. Existing methods use fixed empirical thresholds, which are difficult to adapt to the differences in data distribution in different districts and counties and different business areas. The false alarm rate fluctuates greatly when migrating across scenarios.

[0004] (3) Scarcity of abnormal samples and underfitting of single-center boundary. Real risk behaviors are a minority of events, and abnormal samples are extremely scarce, making it difficult for traditional supervised learning methods to train effectively. Existing unsupervised or single-class learning methods mostly adopt the single-center boundary assumption, which cannot fit the different normal business models of various sub-sectors of people's livelihood such as education, medical care, and social security, resulting in loose boundaries and the coexistence of false positives and false negatives.

[0005] (4) Insufficient interpretability of results. The consistency between structured data and text materials relies heavily on manual review, lacking automated numerical-text consistency verification and subject relationship anomaly identification mechanisms, making it difficult to meet the requirements of auditability and traceability in digital supervision. Summary of the Invention

[0006] The purpose of this invention is to provide a risk behavior detection method based on large model and multi-domain data fusion to solve the technical problems in existing risk behavior detection, such as insufficient utilization of single modality information, difficulty in transferring fixed thresholds across scenarios, underfitting of single-center boundaries to multi-domain distributions, and insufficient interpretability of detection results.

[0007] To achieve the above objectives, the technical solution adopted by this invention is as follows: a risk behavior detection method based on large-scale model and multi-domain data fusion, comprising the following steps: S1, construct a multimodal dataset, including S11~S12; S11: Obtain multiple business items involving transactions from the public service platform. For each business item, extract its continuous scalar and ratio features S, category ID features C, time series features T, geographical features GEO, relationship graph features G, and text material features W to form a multimodal sample x=(S,C,T,GEO,G,W). S12, construct a multimodal dataset from all multimodal samples and divide it into a training set and a validation set; S2 encodes S, C, T, and GEO in x to a unified dimension, and then stacks them into a tabular feature matrix X. tab ; S3, construct a multimodal network, including a table encoder, a text encoder, a graph encoder, and a concatenation mapping layer. The table encoder, text encoder, and graph encoder are used to respectively process X... tab W and G are encoded as table-side features h tab Text-side features h W , Figure side features h G The splicing mapping layer is used to splice the three together, and then obtain the fused feature h through two MLP layers; S4, the total loss L for constructing the multimodal network total This includes gated multicenter normal domain loss and structural text consistency loss; S5, using the training set to minimize L total Train the multimodal network until it converges to obtain the multimodal model; S6, Generate quantile thresholds for calibration based on the validation set, including S61~S62; S61, for a multimodal sample x in the validation set j The fusion feature h is generated through a multimodal model. j And calculate h respectively j The minimum value of the L2 distance to the centers of the K sub-neighborhoods is marked as the minimum distance. S62, calculate the minimum distance for each multimodal sample in the validation set, forming a distance set. ,Pick The (1-α) quantile is used as the quantile threshold q 1-α α is the target false alarm rate; S7: Obtain the business item to be detected, generate the corresponding multimodal sample, and obtain the corresponding minimum distance according to S61. ,like If it is, it is considered abnormal; otherwise, it is considered normal.

[0008] Preferably, the business transactions include engineering project contracts, purchase orders, fund disbursement, salary payment, service contracts, and asset transactions.

[0009] Preferably, in S11, the continuous scalar and the ratio feature S are constructed according to the following formula: ; In the formula, a, b, and p represent the contract amount, budget, and execution amount of the multimodal sample, respectively, and Δ b =pb, representing the sample budget bias. Here, m represents the average unit price, and m represents the number of changes. The average value of a single change, n pay For the number of payments, Δt pay For the first and last payment interval, Δt acc To account for the time difference between acceptance and payment, t is the average time taken for each stage. max For the slowest step, T flow For total time, r staff r represents the historical business approval rate of the person in charge. sup k represents the historical normal performance rate of the business counterparty. pair This represents the number of times the collaboration was repeated.

[0010] The category ID feature C={id proj ,id sup ,id staff ,cate bid ,c inv ,c tax}, where id proj id sup id staff These are the project ID, supplier ID, and handler ID, respectively. bid For the type of bidding method, c inv For the invoice header, c tax For taxpayer identification number consistency markers; The time series feature T={T pay ,T prog}, , among which, T pay For containing L pay The payment progress sequence of each payment, ti p i T represents the timestamp and payment amount of the i-th payment, respectively. prog For containing L prog The business progress sequence of each stage, t j s j The timestamp and progress value of the j-th stage are respectively defined, wherein the progress value is the completion percentage, stage number, or acceptance status; The geographical feature GEO={JW p JW c ,d pc}, where JW p The latitude and longitude of the location where the business transaction occurred, JW c Latitude and longitude for the service provider of business matters, d pc The distance between their spherical surfaces; The relationship graph G=(V,E) is where V is the set of nodes and E is the set of edges. Nodes include people, enterprises, projects, contracts, and accounts, and edges include appointment, signing, payment, and winning a bid. The textual material features W include contract terms, tender notices, bid evaluation reports, approval opinions, reimbursement instructions, and / or original texts of complaints and reports.

[0011] Preferably, in S2, S, C, T, and GEO in x are encoded to a unified dimension. Specifically, the continuous scalar and the ratio feature S are standardized and mapped to 512 dimensions using an MLP to obtain h. S The elements in the category ID feature C are processed through an embedding layer to generate field-level embeddings, which are then concatenated to obtain h. C Each element in the time series feature T is encoded using a two-layer GRU and then concatenated to obtain h. T The spherical distance in the geographic feature GEO is binned, one-hot encoded, and then linearly mapped to h. GEO .

[0012] Preferably, in S3, the table encoder includes a Transformer encoder, a pooling layer, and an MLP layer connected in sequence, wherein the Transformer encoder is a stack of two Transformer encoding layers used for input X. tab Output encoding matrix The pooling layer and the MLP layer are used to respectively... The four row vectors are average pooled and then mapped to table-side features h. tab The text encoder is used to encode the text material features W into text-side features h. W The graph encoder is used to encode the relational graph features G into graph-side features h. G .

[0013] Preferably, S4 includes S41 to S43; S41, pre-defined K sub-domains, where the center c of sub-domain k is... k radius R k 1≤k≤K, based on the gating network, the weight π of the sample belongs to sub-domain k. k And construct a gated multicenter normal domain loss L MoE ; , , Where softmax(⋅) is the softmax function, W g b g These are the weight matrix and bias of the gating network, respectively, where N is the total number of multimodal samples in a batch, and h is the weight matrix and bias of the gating network. i Let be the fused feature of the i-th multimodal sample, and max(⋅) be the maximum value. ∈(0,1] is the relaxation factor; S42, Constructing the structural text consistency loss L cons ; , In the formula, | represents the concatenation operation, and ϕ s Let ϕ be the linear projection function on the structural side. t Here, is the text-side linear projection function, and cos(⋅,⋅) is the cosine similarity function; S43, Total Construction Loss L total =L MoE +λ cons L cons , where λ cons For L cons Weights.

[0014] Compared with the prior art, the advantages of the present invention are as follows: (1) Construct a multimodal sample x=(S,C,T,GEO,G,W) containing continuous scalar and ratio features S, category ID features C, time series features T, geographic features GEO, relationship graph features G, and text material features W; it can achieve a panoramic characterization of “numerical + temporal + spatial + relational + semantic”.

[0015] (2) Introduce a table column interactive modeling and multi-domain data fusion mechanism, encode scalar and ratio features S, category ID features C, time series features T, and geographic features GEO into unified dimensional features, and stack them into a table feature matrix X. tab Then, a multimodal network is used to separate X... tabThe method encodes, concatenates, and maps W, G, and H into a fusion feature h, thereby enabling interactive learning of six types of features and improving the modeling ability of implicit associations between different field groups. This method can improve the information deficiency problem caused by single-field judgment and enhance the ability to express associations between multiple types of features.

[0016] (3) By introducing large-scale model text semantic understanding and structural text consistency constraints, the semantic information in the text materials, such as proofs, explanations, invoices, and contracts, can be analyzed in correspondence with structured business data, thereby improving the interpretability of risk behavior identification. This method not only focuses on the overall integration of multi-domain data, but also judges whether changes in business numerical values ​​have corresponding textual basis, whether there are abnormal correlations in the subject relationships, and whether the samples deviate from the normal business patterns of the same type. It is suitable for scenarios with few abnormal samples, complex business types, and results that need to be verified.

[0017] In summary, this invention improves the accuracy, stability, and application value of risk behavior detection in public service operations by introducing technologies such as multi-domain data fusion, interactive table column modeling, large-scale model text semantic understanding, relationship graph modeling, gated multi-center normal domain detection, and quantile threshold calibration. It provides a new technical approach for risk behavior identification in business scenarios such as education subsidies, medical settlement, social security, civil affairs assistance, housing security, employment subsidies, and elderly care services. Attached Figure Description

[0018] Figure 1 This is a flowchart of the present invention; Figure 2 This is a diagram of a multimodal network structure. Detailed Implementation

[0019] The present invention will be further described below with reference to the embodiments and accompanying drawings.

[0020] Example 1: See Figure 1 and Figure 2 A risk behavior detection method based on large model and multi-domain data fusion includes the following steps: S1, construct a multimodal dataset, including S11~S12; S11: Obtain multiple business items involving transactions from the public service platform. For each business item, extract its continuous scalar and ratio features S, category ID features C, time series features T, geographical features GEO, relationship graph features G, and text material features W to form a multimodal sample x=(S,C,T,GEO,G,W). S12, construct a multimodal dataset from all multimodal samples and divide it into a training set and a validation set; S2 encodes S, C, T, and GEO in x to a unified dimension, and then stacks them into a tabular feature matrix X. tab ; S3, construct a multimodal network, including a table encoder, a text encoder, a graph encoder, and a concatenation mapping layer. The table encoder, text encoder, and graph encoder are used to respectively process X... tab W and G are encoded as table-side features h tab Text-side features h W , Figure side features h G The splicing mapping layer is used to splice the three together, and then obtain the fused feature h through two MLP layers; S4, the total loss L for constructing the multimodal network total This includes gated multicenter normal domain loss and structural text consistency loss; S5, using the training set to minimize L total Train the multimodal network until it converges to obtain the multimodal model; S6, Generate quantile thresholds for calibration based on the validation set, including S61~S62; S61, for a multimodal sample x in the validation set j The fusion feature h is generated through a multimodal model. j And calculate h respectively j The minimum value of the L2 distance to the centers of the K sub-neighborhoods is marked as the minimum distance. S62, calculate the minimum distance for each multimodal sample in the validation set, forming a distance set. ,Pick The (1-α) quantile is used as the quantile threshold q 1-α α is the target false alarm rate; S7: Obtain the business item to be detected, generate the corresponding multimodal sample, and obtain the corresponding minimum distance according to S61. ,like If it is, it is considered abnormal; otherwise, it is considered normal.

[0021] Example 2, see Figure 1 and Figure 2 More specifically, based on Example 1: The business transactions include engineering project contracts, purchase orders, fund disbursement, salary payment, service contracts, and asset transactions.

[0022] In S11, the continuous scalar and the ratio feature S are constructed using the following formula: ; In the formula, a, b, and p represent the contract amount, budget, and execution amount of the multimodal sample, respectively, and Δ b =pb, representing the sample budget bias. Here, m represents the average unit price, and m represents the number of changes. The average value of a single change, n payFor the number of payments, Δt pay For the first and last payment interval, Δt acc To account for the time difference between acceptance and payment, t is the average time taken for each stage. max For the slowest step, T flow For total time, r staff r represents the historical business approval rate of the person in charge. sup k represents the historical normal performance rate of the business counterparty. pair This represents the number of times the collaboration was repeated. The category ID feature C={id proj ,id sup ,id staff ,cate bid ,c inv ,c tax}, where id proj id sup id staff These are the project ID, supplier ID, and handler ID, respectively. bid For the type of bidding method, c inv For the invoice header, c tax For taxpayer identification number consistency markers; The time series feature T={T pay ,T prog}, , among which, T pay For containing L pay The payment progress sequence of each payment, t i p i T represents the timestamp and payment amount of the i-th payment, respectively. prog For containing L prog The business progress sequence of each stage, t j s j The timestamp and progress value of the j-th stage are respectively defined, wherein the progress value is the completion percentage, stage number, or acceptance status; The geographical feature GEO={JW p JW c ,d pc}, where JW p The latitude and longitude of the location where the business transaction occurred, JW c Latitude and longitude for the service provider of business matters, d pc The distance between their spherical surfaces; The relationship graph G=(V,E) is where V is the set of nodes and E is the set of edges. Nodes include people, enterprises, projects, contracts, and accounts, and edges include appointment, signing, payment, and winning a bid. The textual material features W include contract terms, tender notices, bid evaluation reports, approval opinions, reimbursement instructions, and / or original texts of complaints and reports.

[0023] In S2, S, C, T, and GEO in x are encoded to a unified dimension. Specifically, the continuous scalar and the ratio feature S are standardized and mapped to 512 dimensions using an MLP to obtain h. S The elements in the category ID feature C are processed through an embedding layer to generate field-level embeddings, which are then concatenated to obtain h. C Each element in the time series feature T is encoded using a two-layer GRU and then concatenated to obtain h. T The spherical distance in the geographic feature GEO is binned, one-hot encoded, and then linearly mapped to h. GEO .

[0024] In S3, the table encoder includes a Transformer encoder, a pooling layer, and an MLP layer connected in sequence, wherein the Transformer encoder is a stack of two Transformer encoding layers used to input X. tab Output encoding matrix The pooling layer and the MLP layer are used to respectively... The four row vectors are average pooled and then mapped to table-side features h. tab The text encoder is used to encode the text material features W into text-side features h. W The graph encoder is used to encode the relational graph features G into graph-side features h. G .

[0025] S4 includes S41~S43; S41, pre-defined K sub-domains, where the center c of sub-domain k is... k radius R k 1≤k≤K, based on the gating network, the weight π of the sample belongs to sub-domain k. k And construct a gated multicenter normal domain loss L MoE ; , , Where softmax(⋅) is the softmax function, W g b g These are the weight matrix and bias of the gating network, respectively, where N is the total number of multimodal samples in a batch, and h is the weight matrix and bias of the gating network. i Let be the fused feature of the i-th multimodal sample, and max(⋅) be the maximum value. ∈(0,1] is the relaxation factor; S42, Constructing the structural text consistency loss L cons ; , In the formula, | represents the concatenation operation, and ϕ s Let ϕ be the linear projection function on the structural side. t Here, is the text-side linear projection function, and cos(⋅,⋅) is the cosine similarity function; S43, Total Construction Loss L total =L MoE +λ cons L cons , where λ cons For L cons Weights.

[0026] The English and Chinese names of each model in this invention are listed below: GRU: Gated Recurrent Unit; MLP: Multilayer Perceptron; GNN: Graph Neural Network.

[0027] Example 3: More specifically, based on Example 1: Regarding the business transactions of S11, normal business transactions are selected when constructing multimodal samples. These normal business transactions are manually verified or selected from historically stable business transactions. Abnormal business transactions are not included in training and are only used for testing and effect evaluation. Furthermore, when constructing multimodal samples x through feature engineering, the specific features of S, C, T, GEO, G, and W can be added, removed, or modified as needed. In the category ID feature, c... tax This is a taxpayer identification number consistency marker used to indicate whether the entity number in the contract, invoice, payment account, and business counterpart registration information is consistent.

[0028] Regarding S2, S, C, T, and GEO in x are encoded to a unified dimension and then stacked to form a tabular feature matrix X. tab This embodiment provides a specific operating method: (1) Encoding continuous scalars and ratio features S: Standardize S into features Then, use MLP to map to 512 dimensions to obtain h. S The i-th element in S is labeled as s i , The i-th element is marked as s i and One-to-one correspondence, h S Calculate according to the following formulas respectively: , μi σ i s i The mean and standard deviation are estimated from the multimodal samples in the training set, MLP. S (⋅) is for generating h S The MLP used in this process.

[0029] (2) Encode the category ID feature C by first generating the field-level embeddings of each element in C according to the following formula, and then concatenating them: , , In the formula, Embed(⋅) is the learnable lookup table operation of the embedding layer, and [·|·] is vector concatenation.

[0030] (3) Encoding time series features T={T pay ,T prog}: because , First, encode according to the following formula and then concatenate: , , , In the formula, PE(⋅) is the sine and cosine time position code, and GRU ×2 (⋅) represents a 2-layer GRU encoding for T pay First, t i Encode with PE(⋅) and then with p i The intermediate vector z is obtained by concatenation. i Then use GRU ×2 (⋅) Encodes T pay The encoded sequence h pay , for T prog Following the same procedure, we obtain T. prog The encoded sequence h prog Then splice them together to get h T .

[0031] (4) Encoding geographic features GEO={JW p JW c ,d pc}: , , In the formula, ϕ p , λ p JW p latitude and longitude, ϕ c , λ c JWc latitude and longitude, d pc The sub-binding indicates that d pc The data is divided into 8 bins according to a preset range: 0–2km, 2–5km, 5–10km, 10–20km, 20–50km, 50–100km, 100–300km, and greater than 300km. One-hot encoding is used to obtain the intermediate vector o. geo , This indicates that the B-dimensional o geo The linear mapping is 512 bits for h. GEO .

[0032] (5) Then h S h C h T h GEO Stacked in a fixed order to form a tabular feature matrix X tab , .

[0033] Regarding the encoding of S3 multimodal networks: (1) For X tab The table-side features h are obtained by processing them using a table encoder according to the following formula. tab : , , TransEnc ×2 (⋅) represents two Transformer coding layers in the Transformer encoder. Indicates to The 4-row vector is summed element-wise and then divided by 4, which is the pooling layer operation, MLP. tab_out (⋅) represents the MLP layer operation, which maps the output of the pooling layer back to 512 dimensions to obtain h. tab .

[0034] (2) Encode the text material feature W using the following formula: , This formula represents dividing W into L text segments, extracting the [CLS] semantic vector of each segment using the bert-base-chinese model, averaging the vectors, and then passing the average through a linear layer. 768→512 The text-side features h are obtained by mapping from 768 dimensions to 512 dimensions. W In the formula, s lLet be the l-th text segment, 1≤l≤L. BERT(⋅) is the BERT-base-Chinese model, which is also the text encoder of this invention. During training, the first 8 layers of BERT are frozen, and only the last 4 layers are fine-tuned to retain general semantic knowledge and adapt to downstream tasks.

[0035] (3) Encode the feature G of the relation graph using the following formula: , , The first formula is the formula for the layer-by-layer transfer of node features in a GNN network, corresponding to two layers when l=0 and l=1 respectively, V x Let G be the set of nodes, and V be the set of nodes. x Internal node u, Let be the neighboring nodes of u, and mean{⋅} be the average of the neighboring features. Let u be the feature vector of node u in the l-th layer. W is the initial embedding representation of node u. (l) Let be the linear encoding matrix of the l-th layer, σ(⋅) be the non-linear activation function, and AttnReadout(⋅) be the attention pooling operation.

[0036] (4) The splicing mapping layer generates the fusion feature h according to the following formula; , MLP fusion (⋅) represents the splicing of two MLP operations in the mapping layer.

[0037] Regarding the target false alarm rate α: it can be set to 0.03~0.08. In this embodiment, α=0.05 is set, indicating that the target false alarm rate is expected to be controlled at 5%. 1-α=0.95 is the quantile level corresponding to the quantile threshold. Both are preset control parameters and do not require model learning.

[0038] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A risk behavior detection method based on large-scale model and multi-domain data fusion, characterized in that, Includes the following steps: S1, construct a multimodal dataset, including S11~S12; S11: Obtain multiple business items involving transactions from the public service platform. For each business item, extract its continuous scalar and ratio features S, category ID features C, time series features T, geographical features GEO, relationship graph features G, and text material features W to form a multimodal sample x=(S,C,T,GEO,G,W). S12, construct a multimodal dataset from all multimodal samples and divide it into a training set and a validation set; S2 encodes S, C, T, and GEO in x to a unified dimension, and then stacks them into a tabular feature matrix X. tab ; S3, construct a multimodal network, including a table encoder, a text encoder, a graph encoder, and a concatenation mapping layer. The table encoder, text encoder, and graph encoder are used to respectively process X... tab W and G are encoded as table-side features h tab Text-side features h W , Figure side features h G The splicing mapping layer is used to splice the three together, and then obtain the fused feature h through two MLP layers; S4, the total loss L for constructing the multimodal network total This includes gated multicenter normal domain loss and structural text consistency loss, including S41~S43; S41, pre-defined K sub-domains, where the center c of sub-domain k is... k radius R k 1≤k≤K, based on the gating network, the weight π of the sample belongs to sub-domain k. k And construct a gated multicenter normal domain loss L MoE ; ， ， Where softmax(⋅) is the softmax function, W g b g These are the weight matrix and bias of the gating network, respectively, where N is the total number of multimodal samples in a batch, and h is the weight matrix and bias of the gating network. i Let be the fused feature of the i-th multimodal sample, and max(⋅) be the maximum value. ∈(0,1] is the relaxation factor; S42, Constructing the structural text consistency loss L cons ; ， In the formula, | represents the concatenation operation, and ϕ s Let ϕ be the linear projection function on the structural side. t Here, is the text-side linear projection function, and cos(⋅,⋅) is the cosine similarity function; S43, Total Construction Loss L total =L MoE +λ cons L cons , where λ cons For L cons Weight; S5, using the training set to minimize L total Train the multimodal network until it converges to obtain the multimodal model; S6, Generate quantile thresholds for calibration based on the validation set, including S61~S62; S61, for a multimodal sample x in the validation set j The fusion feature h is generated through a multimodal model. j And calculate h respectively j The minimum value of the L2 distance to the centers of the K sub-neighborhoods is marked as the minimum distance. S62, calculate the minimum distance for each multimodal sample in the validation set, forming a distance set. ,Pick The (1-α) quantile is used as the quantile threshold q 1-α α is the target false alarm rate; S7: Obtain the business item to be detected, generate the corresponding multimodal sample, and obtain the corresponding minimum distance according to S61. ,like If it is, it is considered abnormal; otherwise, it is considered normal.

2. The risk behavior detection method based on large model and multi-domain data fusion according to claim 1, characterized in that, The business transactions include engineering project contracts, purchase orders, fund disbursement, salary payment, service contracts, and asset transactions.

3. The risk behavior detection method based on large model and multi-domain data fusion according to claim 1, characterized in that, In S11, the continuous scalar and the ratio feature S are constructed using the following formula: ； In the formula, a, b, and p represent the contract amount, budget, and execution amount of the multimodal sample, respectively, and Δ b =pb, representing the sample budget bias. Here, m represents the average unit price, and m represents the number of changes. The average value of a single change, n pay For the number of payments, Δt pay For the first and last payment interval, Δt acc To account for the time difference between acceptance and payment, t is the average time taken for each stage. max For the slowest step, T flow For total time, r staff r represents the historical business approval rate of the person in charge. sup k represents the historical normal performance rate of the business counterparty. pair This represents the number of times the collaboration was repeated. The category ID feature C={id proj ,id sup ,id staff ,cate bid ,c inv ,c tax }, where id proj id sup id staff These are the project ID, supplier ID, and handler ID, respectively. bid For the type of bidding method, c inv For the invoice header, c tax For taxpayer identification number consistency markers; The time series feature T={T pay ,T prog }, , among which, T pay For containing L pay The payment progress sequence of each payment, t i p i T represents the timestamp and payment amount of the i-th payment, respectively. prog For containing L prog The business progress sequence of each stage, t j s j The timestamp and progress value of the j-th stage are respectively defined, wherein the progress value is the completion percentage, stage number, or acceptance status; The geographical feature GEO={JW p JW c ,d pc }, where JW p The latitude and longitude of the location where the business transaction occurred, JW c Latitude and longitude for the service provider of business matters, d pc The distance between their spherical surfaces; The relationship graph G=(V,E) is where V is the set of nodes and E is the set of edges. Nodes include people, enterprises, projects, contracts, and accounts, and edges include appointment, signing, payment, and winning a bid. The textual material features W include contract terms, tender notices, bid evaluation reports, approval opinions, reimbursement instructions, and / or original texts of complaints and reports.

4. The risk behavior detection method based on large model and multi-domain data fusion according to claim 1, characterized in that, In S2, S, C, T, and GEO in x are encoded to a unified dimension, specifically as follows: After standardizing the continuous scalar and the ratio feature S, the MLP is used to map it to 512 dimensions to obtain h. S ; Each element in the category ID feature C is processed through an embedding layer to generate field-level embeddings, which are then concatenated to obtain h. C ; Each element in the time series feature T is encoded using a two-layer GRU and then concatenated to obtain h. T ; The spherical distance in the geographic feature GEO is binned, one-hot encoded, and then linearly mapped to h. GEO .

5. The risk behavior detection method based on large model and multi-domain data fusion according to claim 1, characterized in that, In S3 The table encoder comprises a Transformer encoder, a pooling layer, and an MLP layer connected in sequence, wherein the Transformer encoder consists of two stacked Transformer encoding layers for input X. tab Output encoding matrix The pooling layer and the MLP layer are used to respectively... The four row vectors are average pooled and then mapped to table-side features h. tab ; The text encoder is used to encode the text material features W into text side features h. W ; The graph encoder is used to encode the graph features G into graph-side features h. G .

Images