Spatiotemporal financial network illegal transaction prediction method based on dual-path contrastive learning

Abstract

The application discloses a kind of space-time financial network illegal transaction prediction method based on two-way contrast learning, belong to the field of financial technology and graph data processing technology.The application constructs dynamic space-time graph: according to time window, transaction sequence is divided, and graph snapshot is constructed every time step, node represents account, and edge represents transaction.Two-way contrast learning is used to extract spatial dependence: local structure neighbor node is as local positive sample set and is endowed with initialization low weight, based on light-weight dot product attention, K nodes similar in global semantics are selected as global semantic positive sample set and are endowed with initialization high weight, wherein the weight of two-way positive sample is learnable, and the rest nodes are negative sample, and positive and negative sample set is used to calculate spatial contrast loss.Further introduce the time sequence encoder of Transformer, model the spatial embedding sequence of each node at continuous time step, capture the time sequence evolution mode of transaction frequency, amount and other characteristics.The model is trained by joint contrast loss, and the probability that node becomes illegal transaction account in future time window is output.The application can early warning illegal transactions such as credit card fraud, and the parameter quantity is fixed and independent of the number of nodes, which achieves remarkable results in real-time risk control and early warning scenarios.

Description

Technical Field

[0001] This invention belongs to the field of financial technology and graph data processing technology, specifically involving a spatiotemporal illegal transaction prediction method for financial transaction networks, which can be used in scenarios such as early warning of illegal transaction accounts, credit card fraud prediction, and third-party payment risk prevention and control. Background Technology

[0002] Financial transaction networks can be modeled as graph structures, with nodes representing accounts and edges representing transaction records. Timely detection of fraudulent transactions such as theft is a core requirement for financial institutions' risk control. With the exponential growth of transaction volume and the continuous evolution of fraud methods, traditional manual review and rule-based screening are no longer sufficient. Graph neural networks have become a research hotspot due to their ability to naturally model the transaction relationships between accounts.

[0003] However, existing methods have two main drawbacks. First, they cannot effectively handle the heterogeneity of financial networks. Most graph neural networks are based on the isogeneity assumption, meaning connected nodes tend to be of the same type. But in illicit transaction networks, fraudulent accounts deliberately trade with a large number of legitimate accounts to hide themselves, resulting in edges often having nodes of different types. On such heterogeneous graphs, standard graph neural networks, by aggregating neighbor information, severely pollute node representations, pulling the characteristics of fraudulent accounts toward legitimate accounts, leading to numerous false negatives and false negatives. Second, they cannot capture the temporal evolution patterns of transaction behavior. Illegal transactions often exhibit specific temporal characteristics: illegal transaction accounts show "rapid entry and exit," fraudulent accounts experience a sharp increase followed by a sharp decrease in transaction frequency, and fraudulent accounts are unusually active in the early morning. However, most existing methods model financial networks as static graphs, using only historical statistical features (such as the average transaction amount over the past 30 days), compressing the time dimension into a single statistic, and losing the sequential information of behavioral evolution. Therefore, there is an urgent need for an illicit transaction prediction method that can handle both heterogeneous graph structures and capture temporal evolution patterns. Summary of the Invention

[0004] The technical problem this invention aims to solve is that current methods for detecting illegal transactions on financial networks cannot simultaneously handle the temporal evolution patterns of heterogeneous graph structures and transaction behaviors, thus failing to provide early warnings of illegal transactions. This invention proposes a spatiotemporal method for predicting illegal transactions by extracting spatial dependencies through dual-path contrastive learning, capturing temporal evolution through a Transformer, and achieving early warning.

[0005] This invention presents an illegal transaction prediction method that integrates spatiotemporal neural networks and financial risk control models. The method divides the entire dataset into training and testing sets according to time windows: first, a feature dataset from a portion of the time steps is selected to train a deep neural network model; then, the trained network model is used to detect the dataset from the remaining time steps, thereby verifying the predictive performance of the trained deep neural network model. Specifically: A method for predicting illegal transactions in spatiotemporal financial networks based on dual-path contrastive learning, comprising the following steps: Step S1: Obtain historical transaction data and construct a dynamic spatiotemporal graph; divide the time window into T consecutive time steps, and construct a graph snapshot for each time step; the nodes of the graph snapshot represent financial accounts, the edges represent transaction records within that time step, and each node has a behavioral feature vector; Step S2: For each time step, input the node feature matrix into the spatial encoder, extract the spatial dependencies between nodes through dual-path contrastive learning, and obtain the spatial embedding representation of that time step; wherein, the calculation scope of the spatial contrastive loss is limited to the node set of the same time step. Step S3: For each node, spatially embed the sequence into the temporal encoder at all time steps, capture the temporal evolution pattern of node behavior features through the multi-head self-attention mechanism of Transformer, and output the node representation fused with temporal information. Step S4: Train the spatial encoder and temporal encoder using the loss function, which includes two parts: cross-entropy classification loss and spatial contrastive loss; Step S5: Use the Adam optimizer to train the model, updating parameters through batch iterative backpropagation until the model converges; Step S6: Input the behavioral feature sequence of the account to be detected in the test set over the past T time steps into the trained model. After spatial encoding and temporal encoding, the prediction classification layer outputs the probability that the node will become an illegal transaction account in the future time window. If the probability exceeds the preset threshold, it is determined to be a potential illegal transaction account, and an early warning instruction is generated.

[0006] Preferably, the construction of the heterogeneous financial transaction network specifically includes:

[0007] S11, For each time step Extract all transaction records that occurred within that time step and construct a graph snapshot. .in, This is the set of account nodes that have had transaction records within this time step; For the set of transaction edges, if the account With account At time step If at least one transaction occurs within an edge, then an edge exists. ; The feature matrix of the nodes includes the transaction frequency, total transaction amount, average transaction amount, standard deviation of transaction amount, proportion of nighttime transactions, counterparty diversity entropy, and net capital inflow / outflow within that time step.

[0008] Preferably, the spatial encoder's process for extracting spatial dependencies between nodes through dual-path contrastive learning specifically includes the following steps.

[0009] S21, Multilayer Perceptron Feedforward Network. The node feature matrix... Input multilayer perceptron The initial embedding representation of the node is obtained through forward propagation. . The structure includes at least two hidden layers, each followed by a GeLU activation function, a layer normalization, and a Dropout layer in sequence.

[0010] S22. Construct a dual-path positive sample set for each target node. The steps are as follows: S221, The first path consists of positive samples with local structure: based on graph snapshots. The graph structure determines the target node. of Jump Neighbor As a local positive sample set ; S222, the second path is global semantic positive samples: based on a lightweight projective dot product attention mechanism, samples with the highest similarity to the target node features are selected from the global account. The non-neighbor nodes are used as the global positive sample set. Specifically, a first projection matrix shared by all nodes is introduced. Second projection matrix Calculate query vector and key vector Then calculate the attention score: in, This is a scaling factor to prevent the softmax gradient from saturating due to excessively large dot product values. Then, the K highest-scoring non-neighboring nodes are selected as the global positive sample set.

[0011] S23. Calculate the weights of the dual-path positive sample sets: Define the weights respectively. and Let be learnable scalars, representing the weight coefficients of the local positive sample set and the global positive sample set, respectively. Considering that the transaction network is a heterogeneous graph, semantically similar global positive samples are more important for the classification task than local structural positive samples. Therefore, the initial weight values ​​are set to 0.2 and 0.8, respectively, and are automatically updated during model training. The model can assign high weights to important features based on the actual data characteristics. The remaining nodes are defined as negative samples with a weight coefficient of 0. The final positive sample set... Its weight Defined as: .

[0012] S24. Calculate the spatial contrast loss. Use the weighted InfoNCE loss function: in, For nodes At time step The set of positive samples, Represents a node and The weighting coefficients between them The cosine similarity function is used. This represents the temperature coefficient. The key constraint is that the summation range of both the numerator and denominator is limited to the same time step. Node set Inside.

[0013] Preferably, the temporal encoder employs a Transformer network to capture the temporal evolution pattern processing flow of node behavioral characteristics, specifically including the following:

[0014] S31, For each node Step S21 yields the spatial embedding sequence of each node at each time step. ,in For nodes Number of time steps in time, Represents a node The Spatial embedding of each time step.

[0015] S32. Add positional encoding to the sequence so that the model can distinguish the sequential relationship between different time steps: ,in, The positional encoding vector uses sinusoidal positional encoding (fixed encoding).

[0016] S33. Input the position-encoded sequence into the Transformer encoder. The Transformer encoder consists of a multi-head self-attention layer and a feedforward network layer, with residual connections and layer normalization added after each sub-layer. The calculation formula for the multi-head self-attention mechanism is as follows: in, , , , , Dimensions for each attention head; For the number of attention heads; The feedforward network adopts a two-layer fully connected structure: Then, through residual connections and layer normalization: Finally, The outputs at each time step are aggregated into a single node representation vector. The aggregation method is either extraction at the last time step or average pooling.

[0017] Preferably, the contrast loss is...

[0018] S41. Spatial contrast loss: The average of the summed spatial contrast losses at each time step. .

[0019] S42. The total loss is: in, Represents cross-entropy loss, This is the balance coefficient.

[0020] The optimizer parameters for the preferred model are as follows.

[0021] S51. Optimization Strategy: The optimizer uses Adam, with a learning rate ranging from 0.0001 to 0.01. Early stopping is employed, based on the validation set AUC, with a patience value ranging from 5 to 20.

[0022] S61, the online inference process is as follows: First, receive the behavioral feature sequence of the account to be detected over the past T time steps; Next, the feature sequence is input into the spatial encoder. For each time step, the spatial encoder independently computes the spatial embedding for that time step; Then, the spatially embedded sequence is input into the temporal encoder, and the output is a node representation that incorporates temporal information. ; Finally, the node representations are input into the prediction classification layer to obtain the probability of illegal transactions: like If the account is deemed a potential illegal trading account, an alert will be generated; otherwise, it will be considered a normal account. Attached Figure Description

[0023] Figure 1This is a flowchart of the spatiotemporal financial network illegal transaction prediction method based on dual-path contrastive learning according to the present invention. Figure 2 This is a graph for constructing the first-order local positive sample set in this invention, for nodes... Sample its first-order neighbors as a local positive sample set; Figure 3 To construct the global positive sample set graph in this invention, let the target node be... The embedding is represented as Candidate Nodes The embedding is represented as Select nodes from the global nodes using dot product attention. The first K similar nodes are used as nodes The global set of semantic positive samples. Detailed Implementation

[0024] To better understand the technical solution of this invention, the following is in conjunction with the appendix. Figure 1-3 The embodiments of the present invention will be described in detail below. It should be understood that all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present invention.

[0025] Step S1: Obtain historical financial transaction data and divide it into equal time intervals. A series of consecutive time steps. The value ranges from 7 to 90, preferably from 30 to 60. A snapshot is constructed at each time step. ,in: For the first The set of account nodes containing transaction records within a given time step; For the first The set of transaction edges within a time step, if the account With account If at least one transaction occurs within this time step, then an edge exists. ; This is a node behavior feature matrix, where each node has a feature dimension. The value is 32 (the typical dimension is 16-32). Node behavior characteristics include one or more of the following: transaction frequency, total transaction amount, average transaction amount, standard deviation of transaction amount, maximum single transaction amount, proportion of nighttime transactions (22:00 to 6:00 the next day), proportion of early morning transactions (0:00 to 6:00 the next day), number of trading counterparties, trading counterparty diversity entropy, net capital inflow, net capital outflow, and suspicion of circular transactions.

[0026] Step S2, Spatial Encoder: The spatial encoder runs independently for each time step and is responsible for extracting the spatial dependencies between nodes within a single time step. The specific process is as follows.

[0027] S21, MLP forward propagation: Transforming the node feature matrix... Inputting into a multilayer perceptron (MLP), the initial embedding representations of the nodes are obtained through forward propagation: in, The embedding dimension ranges from 32 to 128. The MLP structure includes at least two hidden layers, each with a dimension ranging from 64 to 512, decreasing progressively. Each hidden layer is followed by an activation function, layer normalization, and a Dropout layer. The activation function can be either GeLU or ReLU, preferably GeLU. The Dropout rate ranges from 0.1 to 0.3. As an optional implementation, the MLP uses a three-layer structure: a first hidden layer with a dimension of 256, a second hidden layer with a dimension of 128, and an output embedding dimension of 64.

[0028] S22. Construction of local structure positive samples: For each target node Based on graph snapshot The graph structure, determine its Jump neighbors as a local positive sample set: in, For nodes in time step t and The shortest path distance between them The value of is in the range of 1 to 3, preferably 1.

[0029] S23. Construction of global semantic positive samples: Based on a lightweight projective dot product attention mechanism, nodes with similar features to the target node are selected from the global account; Introducing a shared first projection matrix Second projection matrix Shared by all nodes, with fixed parameters. It is independent of the number of nodes; For the target node Calculate the query vector: For the target node Calculate the key vector: Calculate the target node at time step t With candidate nodes Attention scores between: in, A scaling factor is used to prevent the softmax gradient from saturating due to excessively large dot product values. Then, the K highest-scoring non-neighbor nodes are selected as the global positive sample set. The value of K ranges from 5 to 20, with 10 being the preferred value.

[0030] S24. Calculate the weights of the dual-path positive sample sets: Define the weights respectively. and Let be learnable scalars, representing the weight coefficients of the local and global positive sample sets, respectively. Considering that the transaction network is a heterogeneous graph, semantically similar global positive samples are more important for the classification task than local structural positive samples. Therefore, the initial weight values ​​are set to 0.2 and 0.8, respectively, and are automatically updated during model training. The model can assign higher weights to important features based on the actual data characteristics. The remaining nodes are defined as negative samples with a weight coefficient of 0. The final set of positive samples for each node is... For each node Its weight Defined as: .

[0031] S25, Spatial Contrast Loss: For each time step Calculate the weighted InfoNCE spatial contrast loss: in: The cosine similarity function, This is a temperature coefficient, with a value ranging from 0.05 to 0.15, preferably 0.07. For nodes At time step The set of positive samples, Represents a node and The weighting coefficients between them.

[0032] Key constraint: The summation range in both the numerator and denominator is limited to the same time step. Node set Within this framework, node embeddings at different time steps are not included in the computation. This constraint ensures that the spatial contrast loss does not become invalid due to changes in the node set.

[0033] Step S3, Transformer Temporal Encoder: The temporal encoder is responsible for capturing the temporal evolution pattern of the behavioral characteristics of each node, and runs independently for each node. The specific process is as follows.

[0034] S31. Spatial Embedding Sequence Collection: For each node Collect its spatial embedding at each time step (only retaining the time steps in which the node exists): in For nodes The number of time steps in which it occurs, ranging from 1 to T.

[0035] S32, Position Encoding: Adding positional information to each position in the sequence, enabling the model to distinguish the sequential relationships between different time steps: in This is the positional encoding vector. The positional encoding uses sinusoidal positional encoding (fixed encoding).

[0036] S33, Transformer Encoding: The position-encoded sequence is input into the Transformer encoder. The Transformer encoder consists of a multi-head self-attention layer and a feedforward network layer, with residual connections and layer normalization added after each sub-layer. The calculation formula for the multi-head self-attention mechanism is: in, , , , , Dimensions for each attention head; The number of attention heads, ranging from 4 to 12; the number of layers in the Transformer encoder. The value ranges from 2 to 6; The feedforward network adopts a two-layer fully connected structure: Then, through residual connections and layer normalization: .

[0037] S34, Time Series Aggregation: ... The outputs at each time step are aggregated into a single node representation vector. The aggregation method is optional: Last time step extraction: Average pooling: Attention pooling: ,in Learnable weights (suitable for allowing the model to automatically learn important time steps); Extraction is preferred at the last time step.

[0038] Step S4, loss function.

[0039] S41. Spatial contrast loss: The average of the summed spatial contrast losses at each time step. .

[0040] S42. Classification Loss: For labeled nodes, calculate the binary cross-entropy loss: in, For nodes The true label (1 indicates an illegal trading account, 0 indicates a normal account); ; This is the sigmoid function.

[0041] Total loss: The total loss is the weighted sum of classification loss and spatial contrast loss. in, The balance coefficient is set to a value between 0.1 and 1.0, preferably 0.5.

[0042] S43. Training Strategy: An independent batch processing strategy within each time step is used for training. The specific steps are as follows: 1. Initialize all learnable parameters: MLP weights, projection matrix and Transformer parameters, classification layer parameters; 2. In each training round, iterate through the time steps sequentially. (1) From The sampling process involves selecting nodes from a single batch (batch size ranging from 512 to 4096). (2) Calculate the spatial contrast loss at this time step. ; (3) Store the spatial embedding of this time step, and do not immediately perform backpropagation; 3. After traversing all time steps, collect the spatial embedding sequence of each node; 4. Input the spatial embedding sequence into the temporal encoder to obtain the node representation. ; 5. Calculate classification loss ; 6. Calculate the total loss: ; 7. Backpropagation to update all learnable parameters; 8. Repeat steps 2 to 7 until the model converges or reaches the preset number of training rounds.

[0043] Step S5: The optimizer uses Adam, with a learning rate ranging from 0.0001 to 0.01, preferably 0.001. Early stopping can be used, based on the validation set AUC, with a patience value ranging from 5 to 20. Parameters are updated through batch iterative backpropagation, and steps S2-S4 are repeated to train the model until convergence.

[0044] Step S6: Online Inference. After the model training is complete, it is deployed to the online risk control system for real-time inference: 1. Receive the account to be detected in the past Behavioral feature sequence at each time step ; 2. Input the feature sequence into the spatial encoder: for each time step Computational spatial embedding ; 3. Input the spatially embedded sequence into the temporal encoder: After position encoding, Transformer encoding, and temporal aggregation, the node representation is obtained. ; 4. Represent the nodes Input the classification layer to obtain the probability of illegal transactions. : 5. With preset threshold Compare, The value of is in the range of 0.3 to 0.7, preferably 0.5. (1) If If so, the account is determined to be a potential illegal trading account, and an early warning instruction is generated; (2) Otherwise, the account is deemed normal and the transaction is allowed; The entire inference process requires only one forward propagation, without the need for graph structure retrieval or iterative optimization. The inference latency for a single account can be controlled at the millisecond level, meeting real-time risk control requirements.

[0045] Preferably, the present invention provides various variations of the above embodiments. For example: Variation Example 1: Replace the dual-path positive sample filtering method in the spatial encoder with other similarity measurement methods (such as Euclidean distance, Manhattan distance, etc.), or replace dot product attention with additive attention; Variant Example 2: Replace the Transformer in the temporal encoder with other sequence modeling networks, such as Long Short-Term Memory (LSTM), Gated Recurrent Unit (GRU), or Temporal Convolutional Network (TCN). Variant Example 3: Add time contrast loss and / or cross contrast loss as regularization terms to the loss function to further improve model performance; Variation Example 4: Apply the present invention to other financial risk control scenarios, such as credit card fraud detection, insurance claim fraud identification, and online lending risk control.

Claims

1. A method for predicting illegal transactions in spatiotemporal financial networks based on dual-path contrastive learning, characterized in that, Includes the following steps: Step S1: Obtain historical financial transaction data and divide it into equal time intervals. Each time step is a consecutive time step. A graph snapshot is constructed at each time step. ;in: It is a set of nodes, where each node represents a financial account; For the first The set of transaction edges within a time step. For the first Node behavior feature matrix within each time step; Step S2: For each time step , node feature matrix Input the spatial encoder to obtain the spatial embedding representation for that time step. The spatial encoder extracts spatial dependencies between nodes through dual-path contrastive learning, wherein the computational scope of the spatial contrastive loss is limited to the set of nodes at the same time step. Inside; Step S3: For each node , and put it in The spatially embedded sequence is input to a temporal encoder at each time step. The temporal encoder is a Transformer network that captures the temporal evolution patterns of node behavior features through a multi-head self-attention mechanism and outputs node representations that fuse temporal information. ; Step S4: Train the spatial encoder and temporal encoder using loss functions, including spatial contrast loss and classification loss; Step S5: Train the neural network model using the data in the training set. When the loss value of the network model converges to the minimum or the training reaches the specified number of iterations, the training ends and the trained network model is output as the prediction model. Step S6: The account to be tested in the past The behavioral feature sequence at each time step is input into the trained model. After spatial and temporal encoding, the model outputs the probability that the node will become an illegal trading account within a future time window through a prediction and classification layer. ;like If the value exceeds a preset threshold, the account is identified as a potential illegal trading account, and an early warning instruction is generated.

2. The method according to claim 1, characterized in that, The spatial encoder in step S2 includes: converting the feature matrix of the node... Inputting the multilayer perceptron yields the initial node embeddings. For each target node, based on graph snapshots The graph structure determines its local neighbor nodes as the local positive sample set and assigns learnable initial weights. Based on a learnable attention mechanism, the K non-neighbor nodes with the highest feature similarity to the target node are selected from the global account as a global positive sample set, and learned initial weights are assigned to them. ,in When a node belongs to both the local positive sample set and the global positive sample set, the weight of the node is the sum of the local weight and the global weight; the multilayer perceptron is trained using a spatial contrast loss function with the weights.

3. The method according to claim 2, characterized in that, The attention mechanism is a lightweight projective dot product attention, which includes: introducing a shared matrix. and It is shared by all nodes; for the target node Calculate the query vector For candidate nodes Calculate the query vector The attention score is calculated using the following formula: The K non-neighbor nodes with the highest attention scores are selected as the global positive sample set.

4. The method according to claim 2, characterized in that, Local weights and For the shared learnable scalar parameters, the sigmoid function is used to constrain them to the (0,1) interval. Considering that the transaction network is a heterogeneous graph, global positive samples with similar semantics are more important to the classification task of this invention than positive samples with local structure. Therefore, the initial weight values ​​are set to 0.2 and 0.8 respectively, which can be automatically updated as the model is trained. High weights are assigned to important features according to the actual data structure.

5. The method according to claim 1, characterized in that, The formula for calculating the spatial contrast loss is: in, For nodes At time step The set of positive samples, Represents a node and The weighting coefficients between them The cosine similarity function is used. This is the temperature coefficient.

6. The method according to claim 1, characterized in that, The timing encoder in step S3 includes: (1) Multi-head self-attention layer: Calculate the attention weights of the same node at different time steps; (2) Feedforward network layer: performs nonlinear transformation on the attention output; (3) Residual connections and layer normalization: Add residual connections and layer normalization after each sub-layer; (4) Temporal aggregation layer: aggregates the outputs of T time steps into a single node representation vector.

7. The method according to claim 1, characterized in that, The loss function is: in, For classification cross-entropy loss, This is the balance coefficient.

8. The method according to claim 1, characterized in that, The behavioral feature matrix The node behavior characteristics include one or more of the following: transaction frequency, total transaction amount, average transaction amount, standard deviation of transaction amount, maximum single transaction amount, proportion of nighttime transactions, proportion of early morning transactions, number of counterparties, counterparty diversity entropy, net capital inflow, and net capital outflow.

9. The method according to claim 1, characterized in that, The process involves selecting K non-neighbor nodes from the global account and using an approximate nearest neighbor index to accelerate retrieval. This index is periodically updated based on the current node embedding representation.

10. A spatiotemporal financial network illegal transaction prediction system based on dual-path contrastive learning, characterized in that, include: (1) Data acquisition module: acquire historical transaction data and extract the behavioral feature sequence of nodes according to time windows; (2) Spatiotemporal graph construction module: Divide the transaction sequence according to time steps and construct a dynamic spatiotemporal graph snapshot sequence. ; (3) Spatial coding module: Execute step S2 to extract the spatial embedding representation of each time step; (4) Timing coding module: Execute step S3 and output the node representation of the fused timing information; (5) Model training module: Execute steps S4 and S5 to train the spatial encoder and the temporal encoder; (6) Prediction and early warning module: Input the feature sequence of the account to be detected into the trained model, output the probability that the node will become an illegal trading account in the future time window, and generate an early warning instruction when the probability exceeds the preset threshold.

Images