A dynamic risk assessment and intelligent alarm system for bill circulation time sequence modeling

Abstract

The application provides a kind of dynamic risk assessment and intelligent alarm system for bill circulation time sequence modeling, it is related to the field of electric digital data processing, including link diagram construction module, graph-time sequence joint coding module, dynamic risk assessment module, multi-dimensional anomaly detection module and intelligent alarm scheduling module.The link diagram construction module dynamically maintains global bill circulation graph;The graph-time sequence joint coding module embeds the graph structure of the operation subject into the event embedding calculation process, and realizes the joint representation of link topology structure features and time sequence dynamic evolution features through bidirectional cross fusion layer;The dynamic risk assessment module outputs risk score and generates comprehensive risk score through dynamic weight fusion;The intelligent alarm scheduling module removes, grades and distributes the detection results.The application solves the problem of existing scheme that flattens endorsement link into linear sequence processing, resulting in loss of topology information, and improves the identification ability of associated risks and topology anomalies.

Description

Technical Field

[0001] This invention relates to the field of electronic digital data processing, specifically to a dynamic risk assessment and intelligent alarm system for modeling the time sequence of invoice circulation. Background Technology

[0002] Commercial paper involves multiple stages in its circulation, including endorsement, transfer, collection, discounting, and rediscounting. Each stage may introduce credit risk, liquidity risk, and operational risk. As the commercial paper market continues to expand, the need for real-time risk monitoring throughout the entire lifecycle of commercial paper circulation is becoming increasingly urgent.

[0003] Existing bill risk assessment solutions mainly follow two technical routes. One type of solution is based on rule engines, which pre-define several risk judgment rules and perform compliance checks on each circulation event. This type of solution is simple to implement and highly interpretable, but the rule coverage is limited, and its ability to identify complex related risks and new fraud patterns is insufficient. The other type of solution introduces machine learning models, representing bill circulation records as linear event sequences, and using time-series models such as recurrent neural networks or Transformers to extract sequence features and perform risk scoring. This type of solution improves the ability to detect anomalies in time-series patterns to some extent, but its method of flattening the endorsement link into a linear sequence has a fundamental flaw: the bill endorsement link naturally has a directed graph topology, and topological information such as the position characteristics of the bill holder in the link, the branching structure of the link, and the overlapping relationships of the main body across links are all discarded in the linear sequence representation. This leads to systematic omissions in risk scenarios such as circular bill holding and multi-bill convergence, which rely on topological structure for effective identification.

[0004] In the prior art, patent document CN118657573B discloses a digital bill management method and system based on data vouchers. This solution combines blockchain networks with quantum key distribution technology, generating digital bill vouchers by combining bill circulation rules and key elements of the bill, and embedding them into electronic bills in the form of QR code watermarks, thus achieving anti-counterfeiting storage and on-chain management of bills. The technical focus of the above solution is on the authenticity verification and secure storage of bills, solving the problems of anti-counterfeiting and compliance control of bill vouchers. Essentially, it is a bill management solution based on cryptographic methods. However, this solution does not involve dynamic assessment of the risks generated during the bill circulation process. It neither models the topology of the endorsement chain nor provides a quantitative scoring mechanism for credit risk, liquidity risk, and operational risk, nor does it include intelligent alarm functions based on risk scoring. Therefore, the above solution cannot solve the problem of real-time identification of complex associated risks during the bill circulation process.

[0005] In summary, existing technologies in the field of negotiable instrument risk assessment have the following shortcomings: Firstly, both rule-based engine-based solutions and machine learning solutions based on linear sequence modeling neglect the directed graph topology of the endorsement chain, leading to systematic omissions in topology-dependent risk scenarios. Secondly, while existing blockchain-based negotiable instrument management solutions can ensure the security of negotiable instruments, they lack the ability to dynamically perceive and intelligently alert to circulation risks. Therefore, a risk assessment solution is needed that can simultaneously model both the topological characteristics of the negotiable instrument circulation chain and its temporal dynamic evolution characteristics to overcome the aforementioned shortcomings of existing technologies. Summary of the Invention

[0006] The purpose of this invention is to address the shortcomings by proposing a dynamic risk assessment and intelligent alarm system based on time-series modeling of bill circulation.

[0007] The present invention adopts the following technical solution:

[0008] A dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling is characterized by including a link graph construction module, a graph-time-series joint encoding module, a dynamic risk assessment module, a multi-dimensional anomaly detection module, and an intelligent alarm scheduling module.

[0009] The link graph construction module is used to transform the original circulation record of the bill into a directed heterogeneous graph representation. The bill holder is used as the node and the endorsement or transfer behavior is used as the directed edge. The global bill circulation graph is dynamically maintained. The node feature vector is composed of the static attributes and dynamic attributes of the subject. The edge feature vector includes the face value, circulation timestamp, remaining term of the bill, and the time interval between the current circulation and the previous circulation. In addition to the endorsement relationship edge, the directed heterogeneous graph also introduces the holding relationship edge and the historical cooperation relationship edge.

[0010] The graph-temporal joint coding module is used to simultaneously capture the link topology features and temporal dynamic evolution features of the ticket circulation in a unified representation space. The graph-temporal joint coding module includes a graph structure coding layer, a temporal dynamic coding layer and a bidirectional cross-fusion layer.

[0011] The dynamic risk assessment module is used to take the joint representation output by the graph-time series joint coding module as input, and output risk scores in parallel on three dimensions: credit risk, liquidity risk and operational risk, and generate a comprehensive risk score through weighted fusion.

[0012] The multi-dimensional anomaly detection module is used to perform specialized detection on four types of anomaly scenarios: topology loops, link anomaly density, cross-link subject overlap, and timeliness risks.

[0013] The intelligent alarm scheduling module is used to deduplicate, classify, and distribute the detection results.

[0014] Furthermore, the graph structure encoding layer performs message passing operations on the global bill flow graph. The aggregation function adopts an attention aggregation mechanism with edge feature weighting. The message contribution weight of the neighbor node to the target node is obtained by normalizing the concatenation of the edge feature and the node pair feature after linear transformation. After multiple layers of message passing, the graph structure embedding of each subject node is obtained. The graph structure embedding integrates the position feature of the subject in the endorsement link and the overall risk status of its neighboring subjects.

[0015] Furthermore, when embedding each event in the sequence of events, the temporal dynamic coding layer injects the current graph structure embedding of the event operation subject into the event embedding calculation process through a gating fusion mechanism. The gating coefficient is activated by the concatenation vector of the original event attribute embedding and the graph structure embedding after linear transformation. The enhanced embedding is obtained by the element-wise weighted fusion of the original event attribute embedding and the graph structure embedding by the gating coefficient. The enhanced event embedding sequence is sent to the Transformer encoder with time position encoding to output the temporal context representation.

[0016] Furthermore, the first direction of the bidirectional cross-fusion layer is represented as a query vector using temporal context, and attention-weighted aggregation is performed on the graph structure embedding of all subject nodes involved in the target ticket to obtain a temporal-aware link graph summary vector;

[0017] The second direction of the bidirectional cross-fusion layer uses a topology condition vector consisting of the path length of the target bill endorsement link, the number of nodes where the path branches, and the degree of node heterogeneity. This vector is then linearly transformed to generate a scaling factor vector, which is used to scale the temporal context representation element by element to obtain a graph-aware temporal summary vector.

[0018] The link graph summary vector and the time sequence summary vector are concatenated and then linearly mapped to obtain a joint representation.

[0019] Furthermore, the dynamic risk assessment module includes a credit risk sub-model, a liquidity risk sub-model, and an operational risk sub-model;

[0020] The credit risk sub-model uses cross-attention fusion of the historical behavior vector of the operating entity and the joint representation to quantitatively assess the positional risk and neighborhood risk transmission of the bill holder in the endorsement link and output a credit risk score.

[0021] The liquidity risk sub-model overlays macro liquidity indicators on the joint representation and uses an LSTM structure to output the conditional probability that the bills cannot be redeemed normally within a future predetermined time window, which serves as the liquidity risk score.

[0022] The operational risk sub-model is based on a hybrid mechanism of isolated forest and sequence pattern rules. It detects and scores the abnormal topological patterns reflected in the joint representation and outputs an operational risk score.

[0023] The comprehensive risk score is obtained by dynamically weighting and integrating the credit risk score, liquidity risk score, and operational risk score. The weights of each dimension are dynamically adjusted by the macro risk status sensor according to the current market environment.

[0024] Furthermore, the macro risk status perceiver subscribes to external macro data sources, outputs current market risk tendency labels through a text classification model, and maps them to a preset set of weight vectors to achieve dynamic switching of the weights of each dimension in the comprehensive risk score.

[0025] Furthermore, the multi-dimensional anomaly detection module includes a topology loop detection unit, a link anomaly density detection unit, a cross-link main body overlap detection unit, and a timeliness risk detection unit;

[0026] The topology loop detection unit executes a directed loop discovery algorithm on the global flow graph to identify the set of entities that form closed loops in the endorsement links;

[0027] The link anomaly density detection unit calculates the local subgraph density of the ticket path in the graph in real time. When the edge insertion rate around a specific subject deviates significantly from the historical baseline, a link density anomaly alarm is triggered.

[0028] The cross-link entity overlap detection unit identifies the convergence risk of multiple bills flowing through the same key intermediate entity simultaneously by calculating the proportion of shared nodes between different bill links.

[0029] The timeliness risk detection unit performs high-frequency scanning of bills that are about to mature and dynamically assesses the risk of imminent redemption by combining the current graph centrality indicators of the bill holder.

[0030] Furthermore, the intelligent alarm scheduling module uses the comprehensive risk score and anomaly detection results as the basis for alarm classification, dividing them into three levels: general concern, key monitoring, and emergency response. For alarms at the emergency response level, it automatically generates structured response suggestions that include a summary of the risk causes, suggested response measures, and references to regulatory rules.

[0031] Furthermore, the system also includes a risk knowledge graph module. This module maintains a multi-relationship knowledge graph with bill entities, bill holder entities, guarantor entities, and accepting bank entities as nodes, and endorsement relationships, guarantee relationships, holding relationships, and historical default relationships as edges. It supports multi-hop path queries for bills that have triggered alarms to restore the complete credit transmission path, and extracts first-order neighborhood features for sparse data entities as prior knowledge to inject into the credit risk sub-model.

[0032] The beneficial effects achieved by this invention are:

[0033] This invention proposes a graph-temporal joint coding framework, which uses a directed heterogeneous graph to represent the topology of the endorsement link of a bill. Through a graph structure coding layer, the positional characteristics of the bill holder in the link, the neighborhood risk density, and the overlapping relationship of the entities across links are structured and encoded. This overcomes the problem of topological information loss caused by the existing schemes that flatten the endorsement link into a linear event sequence, and fundamentally improves the ability to identify topology-dependent risk scenarios such as circular bill holding and multi-bill convergence.

[0034] The gating fusion mechanism proposed in this invention enables the dynamic injection of graph structure information into the temporal coding process. The gating coefficients are adaptively determined by the correlation between event attribute embedding and graph structure embedding, allowing the temporal encoder to perceive the topological position of the current operating entity in the global flow network when processing each flow event. Compared with fixed-weight fusion or simple splicing methods, it can more accurately capture the characteristics of topological risk signals that change dynamically with flow events.

[0035] The bidirectional cross-fusion layer proposed in this invention achieves bidirectional mutual enhancement of graph structure features and temporal features. On the one hand, it dynamically focuses on the node with the greatest risk contribution in the link using temporal context; on the other hand, it adaptively scales the temporal summary based on the link topology complexity. This ensures that the final joint representation retains both the temporal evolution law and the dual risk information of the link structure complexity, resulting in a stronger risk characterization capability compared to the one-way information injection method.

[0036] To further understand the features and technical content of the present invention, please refer to the following detailed description and drawings of the present invention. However, the drawings provided are for reference and illustration only and are not intended to limit the present invention. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the overall structural framework of the present invention;

[0038] Figure 2 This is a schematic diagram of the internal structure of the timing-coordinated coding module of the present invention;

[0039] Figure 3 This is a detailed flowchart illustrating the gating fusion mechanism of the present invention;

[0040] Figure 4 This is a schematic diagram of the multi-dimensional anomaly detection module of the present invention. Detailed Implementation

[0041] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can understand the advantages and effects of the present invention from the content disclosed in this specification. The present invention can be implemented or applied through other different specific embodiments, and various details in this specification can also be modified and changed based on different viewpoints and applications without departing from the spirit of the present invention. Furthermore, the accompanying drawings of the present invention are for simple illustrative purposes only and are not depictions of actual dimensions; this is stated beforehand. The following embodiments will further describe the relevant technical content of the present invention in detail, but the disclosed content is not intended to limit the scope of protection of the present invention.

[0042] Example 1.

[0043] This embodiment provides a dynamic risk assessment and intelligent alarm system based on time-series modeling of bill circulation, combined with... Figure 1 The system consists of a link graph construction module, a graph-time series joint coding module, a dynamic risk assessment module, a multi-dimensional anomaly detection module, and an intelligent alarm scheduling module.

[0044] The link graph construction module is responsible for transforming the original circulation records of bills into a structured directed heterogeneous graph representation. For all bills in transit in the system, the module dynamically maintains a global bill circulation graph, with the bill holder as the node and endorsement or transfer behavior as the directed edge. ,node For a market entity participating in the circulation of bills, its initial feature vector It is composed of the static and dynamic attributes of the main body, and the edges are... For a single endorsement or transfer event from subject i to subject j, its edge feature vector It includes the face value of the bill in this transaction, the transaction timestamp, the remaining term of the bill, and the time interval between this transaction and the last transaction.

[0045] The main static attributes include enterprise type, registered capital, industry classification, and credit rating;

[0046] The entity's dynamic attributes include the total amount of bills currently held, the frequency of endorsements in the past 30 days, and the number of historical defaults;

[0047] It should be noted that this graph is a heterogeneous graph. In addition to endorsement relationships, controlling stake relationships and historical cooperation relationships are also introduced between nodes to embed prior association information between entities in the graph structure. This enables the subsequent graph neural network encoding to perceive the cross-link entity overlap and the transmission path of associated risks.

[0048] Combination Figure 2The graph-temporal joint coding module is used to simultaneously capture the link topology features and temporal dynamic evolution features of the ticket circulation in a unified representation space, overcoming the information loss problem when the two are processed separately. The module adopts a graph neural network temporal coupled encoder to achieve this goal, which is specifically divided into three sub-layers: graph structure coding layer, temporal dynamic coding layer and bidirectional cross-fusion layer.

[0049] The graph structure coding layer performs message passing operations on the global ticket flow graph G, and calculates the structure-aware embedding of each principal node in the current graph topology.

[0050] For node v, its hidden representation in the k-th layer of the graph neural network The aggregation function is obtained by aggregating the features of its neighboring nodes. It adopts an attention aggregation mechanism with edge feature weighting: the contribution weight of neighboring node u to the message of node v. By edge features The concatenation of node features, after linear transformation and normalization, results in a higher weighting for recent large-amount transactions on the node representation compared to older small-amount transactions. After K layers of message passing, the graph structure of node v is embedded. By integrating the topological information within its K-hop neighborhood, it is possible to perceive the positional characteristics of the entity in the endorsement link and the overall risk status of neighboring entities.

[0051] The temporal dynamic coding layer is for the sequence of events in the circulation of a single target ticket. Dynamic modeling is performed, unlike general time-series coding schemes. This layer performs dynamic modeling for each transition event. When embedding, embed the current graph structure of the event operation subject. The computational process of embedding as a conditional signal injection event: combining Figure 3 ,event Enhanced embedding Embedded from original event attributes through gating fusion mechanism Embedded with graph structure Specifically, the gating coefficient is calculated. The concatenated vector from both vectors is obtained by linear transformation followed by activation using the sigmoid function:

[0052] ;

[0053] in and b is a learnable parameter. It is the sigmoid function;

[0054] Enhanced Embedding The result is obtained by element-wise weighted fusion of the two source vectors using gating coefficients:

[0055] ;

[0056] in This represents element-wise multiplication;

[0057] The physical meaning of this mechanism is that when the correlation between event attribute embedding and graph structure embedding is high, the gating coefficient approaches 0.5, and the two are balanced and integrated; when the graph structure features of the operating subject are in strong contrast with the event's own attributes, the gating coefficient is adaptively shifted, so that the graph structure signal occupies a greater weight in the enhanced embedding, thereby effectively injecting the risk signal at the topology level into the time-series coding process.

[0058] Enhanced event embedding sequence It is then fed into a Transformer encoder with time position encoding, and the output is a temporal context representation s containing global dependencies.

[0059] The bidirectional cross-fusion layer further enables bidirectional mutual enhancement of graph structure information and temporal information;

[0060] The first direction of the bidirectional cross-fusion layer uses the temporal context representation s as the query vector, and embeds the graph structure of all principal nodes involved in the target document. Perform attention-weighted aggregation to obtain a time-aware link graph summary vector:

[0061] ;

[0062] ;

[0063] in The learnable bilinear attention parameter matrix, attention weights It reflects the degree of attention that the temporal context pays to each main node in the link, enabling the link graph summary to dynamically focus on the node with the greatest risk contribution based on the current temporal state;

[0064] The second direction of the bidirectional cross-fusion layer adaptively scales the temporal context representation s element-wise based on the three topological statistical features of the link graph.

[0065] The three topological statistical features are: the path length l of the target bill endorsement link, the number of nodes f where the path branches, and the degree of node heterogeneity d.

[0066] The above three features are concatenated into a topological condition vector. After linear transformation, a scaling factor vector with the same dimension as the temporal context representation s is generated. :

[0067] ;

[0068] The graph-aware temporal summary vector is obtained by applying a scaling factor element-wise to the temporal context representation:

[0069] ;

[0070] The physical meaning of this scaling operation is that the longer the path, the more branches, and the more complex the node types of the ticket, the greater the suppression or enhancement effect of the scaling factor driven by the topology condition vector in the corresponding dimension. This makes the feature dimensions that are strongly related to the link complexity in the time-series summary vector more explicit, thereby preserving the structural influence of link topology complexity on risk scoring in the joint representation.

[0071] and After concatenation, a linear mapping is performed to obtain the final joint representation. This serves as a unified input for subsequent risk assessments.

[0072] The topological characteristics of a ticket path include path length, number of branches, and degree of node heterogeneity.

[0073] The dynamic risk assessment module takes the joint representation z as input and outputs risk scores in parallel across three dimensions: credit risk, liquidity risk, and operational risk. , and The credit risk sub-model focuses on utilizing the link topology information contained in the joint representation to quantitatively assess the location risk of the bill holder and the transmission of neighborhood risk in the endorsement link. The liquidity risk sub-model overlays macro liquidity indicators on the joint representation and uses a lightweight LSTM structure to output the conditional probability of the bill failing to be redeemed within the next T days. The operational risk sub-model uses a hybrid mechanism of isolated forest and sequence pattern rules to detect and score abnormal topology patterns reflected in the joint representation. The three-dimensional scores are weighted and fused to generate a comprehensive risk score. Weight , , The macro risk status sensor dynamically adjusts its settings based on the current market environment.

[0074] Combination Figure 4Based on dynamic risk assessment, the multi-dimensional anomaly detection module leverages the unique advantages of graph-temporal joint representation to perform specialized detection on four types of anomaly scenarios. Topology loop detection directly executes a directed loop discovery algorithm on the global flow graph G to identify the set of entities forming closed loops in the endorsement link, elevating the fraud feature of circular holding of bills from "repeated occurrence of entities" at the temporal level to "topology loop structure" detection at the graph level, significantly reducing the false negative rate. Link anomaly density detection calculates the local subgraph density of the bill path in the graph in real time. When the edge insertion rate around a specific entity deviates significantly from the historical baseline within a certain time window, a link density anomaly alarm is triggered. Cross-link entity overlap detection identifies the convergence risk of multiple bills flowing through the same key intermediate entity simultaneously by calculating the proportion of shared nodes between different bill links, triggering an entity-level association alarm. Timeliness risk detection performs high-frequency scanning of bills about to mature and dynamically assesses the near-maturity payment risk by combining the current graph centrality index of the holding entity.

[0075] The intelligent alarm scheduling module is responsible for deduplicating, classifying, and distributing detection results. In terms of alarm deduplication, the module maintains an alarm status cache pool and performs merging processing on duplicate alarms within a short window for the same document. In terms of alarm classification, the alarm level is determined by the comprehensive risk score R and the anomaly detection results, and is divided into three levels: general concern, key monitoring, and emergency handling. Alarms at the emergency handling level automatically generate structured handling suggestions that include a summary of the risk cause, suggested handling measures, and references to regulatory rules. In terms of alarm distribution, alarms of different levels are distributed to the risk management system write interface, the business review personnel workbench push interface, and the regulatory reporting interface via routing rules.

[0076] Example 2:

[0077] This embodiment describes the dynamic risk assessment and intelligent alarm system from a hardware architecture perspective. The system consists of four hardware subsystems: a data access layer, a computing and processing layer, a storage layer, and an alarm output layer. These subsystems are interconnected through a high-speed internal network to collaboratively complete the real-time collection of invoice circulation events, joint encoding calculation, risk score storage, and alarm command distribution.

[0078] The data access layer includes a bill event acquisition server and a macro data subscription server. The bill event acquisition server deploys message queue middleware, which receives in real time transaction event messages such as endorsement, transfer, collection, and discounting from bill market participants through a standardized financial message interface. After parsing, validating fields, and standardizing the format of the messages, the structured event records are written to the message queue for consumption by the computing and processing layer. The macro data subscription server is responsible for periodically pulling external macro data sources, preprocessing them, and storing them in the macro feature cache for use by the macro risk status perceiver in the dynamic risk assessment module.

[0079] The computing processing layer is the core hardware unit of the system, consisting of two types of computing nodes: graph computing server clusters and inference acceleration server clusters. The graph computing server cluster is configured with large-memory CPU server nodes, with a single node having a memory capacity of no less than 512GB. This cluster is used to handle in-memory computation tasks of the global bill circulation graph G, including real-time updates of node features, message passing aggregation computation, topology loop detection, and link anomaly density calculation. Since the number of nodes and edges in the global circulation graph dynamically increases with the size of the bill market, the graph computing server cluster employs a distributed graph computing framework for sharded storage and parallel computation of graph data. Nodes synchronize messages between graph shards via a high-speed RDMA network to ensure consistency of message passing aggregation results across shards. The inference acceleration server cluster is configured with GPU accelerator cards to handle the neural network forward inference computation of the graph-temporal joint coding module, the three risk sub-models in the dynamic risk assessment module, and the macro-risk state perceptron. Each GPU card independently processes the joint coding and scoring computation task of one bill. Multiple GPU cards work in parallel to meet the real-time requirements of high-concurrency scenarios. The graph computing server cluster and the inference acceleration server cluster communicate via a shared memory mapping mechanism to transfer graph structure embedding vectors, avoiding latency introduced by cross-node network transmission and ensuring the graph structure embedding required by the gating fusion mechanism. It can complete the calculation and inject the timing coding process within a millisecond-level time window after the event arrives.

[0080] The storage layer consists of three types of storage nodes: graph database server, time-series database server, and relational database server. The graph database server uses a native graph database to deploy the risk knowledge graph, storing multi-relationship graph data with bill entities, bill holder entities, guarantor entities, and accepting bank entities as nodes, and endorsement relationships, guarantee relationships, holding relationships, and historical default relationships as edges. It supports multi-hop path queries and subgraph retrieval operations, providing persistent storage support for risk path tracing and prior risk injection. The time-series database server stores the comprehensive risk score time series and three-dimensional sub-score series of each bill, which are used for online monitoring and reading by the CUSUM accumulation and control chart methods in the multi-dimensional anomaly detection module. At the same time, it retains historical score sequences for model training and backtesting. The relational database server stores basic bill information, market entity files, alarm records, and disposal result records. As the system's main business data database, it supports alarm status cache pool management and persistent writing of alarm records in the alarm scheduling module.

[0081] The alarm output layer consists of an alarm routing server and multiple interfaces with external systems. The alarm routing server receives structured alarm messages generated by the intelligent alarm scheduling module and distributes the alarms to the corresponding external system interfaces according to the alarm level and routing rules. These interfaces include the risk management system write interface, the business review personnel workbench push interface, and the regulatory reporting interface. The alarm routing server is configured with an alarm persistent queue to cache alarm messages when external system interfaces are temporarily unavailable. Once the interfaces are restored, the messages are resent in order to ensure that alarms are not lost.

[0082] The content disclosed above is only a preferred and feasible embodiment of the present invention, and is not intended to limit the scope of protection of the present invention. Therefore, all equivalent technical changes made based on the content of the present invention specification and drawings are included within the scope of protection of the present invention. Furthermore, the elements therein can be updated as technology develops.

Claims

1. A dynamic risk assessment and intelligent alarm system based on time-series modeling of bill circulation, characterized in that, It includes a link graph construction module, a graph-time series joint coding module, a dynamic risk assessment module, a multi-dimensional anomaly detection module, and an intelligent alarm scheduling module; The link graph construction module is used to transform the original circulation record of the bill into a directed heterogeneous graph representation. The bill holder is used as the node and the endorsement or transfer behavior is used as the directed edge. The global bill circulation graph is dynamically maintained. The node feature vector is composed of the static attributes and dynamic attributes of the subject. The edge feature vector includes the face value, circulation timestamp, remaining term of the bill, and the time interval between the current circulation and the previous circulation. In addition to the endorsement relationship edge, the directed heterogeneous graph also introduces the holding relationship edge and the historical cooperation relationship edge. The graph-temporal joint coding module is used to simultaneously capture the link topology features and temporal dynamic evolution features of the ticket circulation in a unified representation space. The graph-temporal joint coding module includes a graph structure coding layer, a temporal dynamic coding layer and a bidirectional cross-fusion layer. The dynamic risk assessment module is used to take the joint representation output by the graph-time series joint coding module as input, and output risk scores in parallel on three dimensions: credit risk, liquidity risk and operational risk, and generate a comprehensive risk score through weighted fusion. The multi-dimensional anomaly detection module is used to perform specialized detection on four types of anomaly scenarios: topology loops, link anomaly density, cross-link subject overlap, and timeliness risks. The intelligent alarm scheduling module is used to deduplicate, classify, and distribute the detection results.

2. The dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 1, characterized in that, The graph structure encoding layer performs message passing operations on the global bill flow graph. The aggregation function adopts an attention aggregation mechanism with edge feature weighting. The message contribution weight of the neighbor node to the target node is obtained by normalizing the concatenation of the edge feature and the node pair feature after linear transformation. After multiple layers of message passing, the graph structure embedding of each subject node is obtained. The graph structure embedding integrates the position feature of the subject in the endorsement link and the overall risk status of its neighboring subjects.

3. The dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 2, characterized in that, When embedding each event in the sequence of events, the temporal dynamic coding layer injects the current graph structure embedding of the event's operation subject into the event embedding calculation process through a gating fusion mechanism. The gating coefficients are obtained by activating the concatenated vector of the original event attribute embedding and the graph structure embedding after linear transformation. The enhanced embedding is obtained by element-wise weighted fusion of the original event attribute embedding and the graph structure embedding using the gating coefficients. The enhanced event embedding sequence is then fed into the Transformer encoder with time position encoding to output the temporal context representation.

4. The dynamic risk assessment and intelligent alarm system for time-series modeling of bill circulation as described in claim 3, characterized in that: The first direction of the bidirectional cross-fusion layer is represented as a query vector in the temporal context. Attention-weighted aggregation is performed on the graph structure embedding of all main nodes involved in the target ticket to obtain a temporal-aware link graph summary vector. The second direction of the bidirectional cross-fusion layer uses a topology condition vector consisting of the path length of the target bill endorsement link, the number of nodes where the path branches, and the degree of node heterogeneity. This vector is then linearly transformed to generate a scaling factor vector, which is used to scale the temporal context representation element by element to obtain a graph-aware temporal summary vector. The link graph summary vector and the time sequence summary vector are concatenated and then linearly mapped to obtain a joint representation.

5. The dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 4, characterized in that, The dynamic risk assessment module includes a credit risk sub-model, a liquidity risk sub-model, and an operational risk sub-model. The credit risk sub-model uses cross-attention fusion of the historical behavior vector of the operating entity and the joint representation to quantitatively assess the positional risk and neighborhood risk transmission of the bill holder in the endorsement link and output a credit risk score. The liquidity risk sub-model overlays macro liquidity indicators on the joint representation and uses an LSTM structure to output the conditional probability that the bills cannot be redeemed normally within a future predetermined time window, which serves as the liquidity risk score. The operational risk sub-model is based on a hybrid mechanism of isolated forest and sequence pattern rules. It detects and scores the abnormal topological patterns reflected in the joint representation and outputs an operational risk score. The comprehensive risk score is obtained by dynamically weighting and integrating the credit risk score, liquidity risk score, and operational risk score. The weights of each dimension are dynamically adjusted by the macro risk status sensor according to the current market environment.

6. The dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 5, characterized in that, The macro risk status perceiver subscribes to external macro data sources, outputs current market risk tendency labels through a text classification model, and maps them to a preset set of weight vectors to achieve dynamic switching of the weights of each dimension in the comprehensive risk score.

7. The dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 6, characterized in that, The multi-dimensional anomaly detection module includes a topology loop detection unit, a link anomaly density detection unit, a cross-link main body overlap detection unit, and a timeliness risk detection unit; The topology loop detection unit executes a directed loop discovery algorithm on the global flow graph to identify the set of entities that form closed loops in the endorsement links; The link anomaly density detection unit calculates the local subgraph density of the ticket path in the graph in real time. When the edge insertion rate around a specific subject deviates significantly from the historical baseline, a link density anomaly alarm is triggered. The cross-link entity overlap detection unit identifies the convergence risk of multiple bills flowing through the same key intermediate entity simultaneously by calculating the proportion of shared nodes between different bill links. The timeliness risk detection unit performs high-frequency scanning of bills that are about to mature and dynamically assesses the risk of imminent redemption by combining the current graph centrality indicators of the bill holder.

8. The dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 7, characterized in that, The intelligent alarm scheduling module uses both the comprehensive risk score and the anomaly detection results as the basis for alarm classification, dividing them into three levels: general concern, key monitoring, and emergency response. For alarms at the emergency response level, it automatically generates structured response suggestions that include a summary of the risk causes, suggested response measures, and references to regulatory rules.

9. A dynamic risk assessment and intelligent alarm system for bill circulation time-series modeling as described in claim 8, characterized in that, The system also includes a risk knowledge graph module. The risk knowledge graph module maintains a multi-relationship knowledge graph with bill entities, bill holder entities, guarantor entities and accepting bank entities as nodes, and endorsement relationships, guarantee relationships, holding relationships and historical default relationships as edges. It supports multi-hop path queries for bills that have triggered alarms to restore the complete credit transmission path, and extracts first-order neighborhood features for sparse data entities as prior knowledge to inject into the credit risk sub-model.

Images