Method and device for determining user transaction risk, storage medium and electronic device

Abstract

The application discloses a kind of determination methods, device, storage medium and electronic equipment of user transaction risk, it is related to artificial intelligence technical field.The method comprises: obtaining the dynamic information feature of user, dynamic information feature at least includes the information change feature of user in first historical period, the transaction operation feature of user and the non-transaction operation feature of user, information change feature characterizes whether the user information of user in first historical period is changed;Obtain the static information feature of user;At least the static information feature of user and the dynamic information feature of user are input into risk prediction model to carry out risk prediction, obtain the risk index value of user, and risk prediction model is obtained based on neural network model training.The method fuses dynamic feature and static feature multidimensional feature and carries out dynamic coupling analysis, and realizes active abnormal behavior risk prevention and control in user information modification scene by risk prediction model.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and more specifically, to a method for determining user transaction risk, a device for assessing user transaction risk, a computer-readable storage medium, and an electronic device. Background Technology

[0002] Related technologies employ rule-based detection methods, which detect potential abnormal behavior risks by defining a set of rules, such as password changes, unusual account openings, and login activity. This approach relies on post-transaction rule determination, missing critical window periods for intercepting information tampering, and analyzing isolated signals like identity changes, device fingerprints, and transaction behavior in isolation, ignoring the spatiotemporal correlation of multi-dimensional operations. Therefore, existing technologies have relatively low accuracy in identifying abnormal customer behavior risks.

[0003] There is currently no effective solution to the problem of low accuracy in identifying abnormal customer behavior risks in related technologies. Summary of the Invention

[0004] The main objective of this application is to provide a method for determining user transaction risk, a device for assessing user transaction risk, a computer-readable storage medium, and an electronic device, in order to solve the problem of low accuracy in identifying abnormal customer behavior risks in related technologies.

[0005] To achieve the above objectives, according to one aspect of this application, a method for determining user transaction risk is provided. The method includes: with user authorization, acquiring dynamic information features of the user, the dynamic information features including at least information change features of the user within a first historical period, transaction operation features of the user, and non-transaction operation features of the user, the information change features indicating whether the user's information has changed within the first historical period; acquiring static information features of the user, the static information features including the user's information at the current moment; inputting at least the user's static information features and the user's dynamic information features into a risk prediction model to perform risk prediction, obtaining a risk index value for the user, the risk prediction model being trained based on a neural network model, and the user's risk index value representing the user's transaction risk.

[0006] Optionally, obtaining the user's dynamic information features includes: obtaining change information of the user's information and extracting features from the change information to obtain the user's information change features, wherein the change information indicates whether the user's information has changed; obtaining the user's non-transaction operation information and extracting features from the non-transaction operation information to obtain the non-transaction operation features, wherein the non-transaction operation information includes at least one of the following: the user's device detection information, page interaction information, and verification login information, wherein the device detection information includes at least one of the following: the user's device login time period, the user's device sensor data, and the user's device touch trajectory, wherein the page interaction information includes at least one of the following: the page jump information when the user performs a transaction, and the verification login information includes the user's number of verification failures and verification delay time; obtaining the user's transaction operation information and extracting features from the transaction operation information to obtain the transaction operation features, wherein the transaction operation information includes the transaction amount, transaction channel, and transaction frequency of the user's transactions; and determining the user's dynamic information features based on at least one of the information change features, the non-transaction operation features, and the transaction operation features.

[0007] Optionally, at least the user's static information features and the user's dynamic information features are input into a risk prediction model to perform risk prediction and obtain the user's risk index value. This includes: obtaining the current modification duration and the historical average modification duration of the user information, where the current modification duration is the interval between the current modification and the previous modification, and the historical average modification duration is the average of the modification interval durations of the user information within a second historical period; obtaining a preset coefficient, and determining the urgency of modifying the user information based on the preset coefficient, the difference between the current modification duration and the historical average modification duration; and at least the user's static information features, the user's dynamic information features, and the urgency of modifying the user information are input into the risk prediction model to perform risk prediction and obtain the user's risk index value.

[0008] Optionally, at least the user's static information characteristics, the user's dynamic information characteristics, and the urgency of modifying the user's information are input into the risk prediction model to perform risk prediction and obtain the user's risk index value. This includes: obtaining the user's current movement distance and historical maximum movement distance, where the current movement distance is the distance between the Internet Protocol address of the user device's current login and the Internet Protocol address of the user device's last login, and the historical maximum movement distance is the maximum movement distance of the user device within a second historical period, where the movement distance is the distance between two adjacent Internet Protocol addresses of the user device's login within the second historical period; determining the ratio of the current movement distance to the historical maximum movement distance as the user's geographic jump index; and inputting the user's geographic jump index, the user's static information characteristics, the user's dynamic information characteristics, and the urgency of modifying the user's information into the risk prediction model to perform risk prediction and obtain the user's risk index value.

[0009] Optionally, the risk prediction model includes a node embedding layer, a temporal graph convolutional layer, and a risk prediction layer. The node embedding layer includes user nodes and event nodes. The user nodes are constructed based on a graph convolutional network model, and the event nodes are constructed based on a transformer model, a multi-head attention mechanism, and embedded timestamps. The transformer model is used to encode the dynamic operation sequence of the event nodes. The multi-head attention mechanism is used to parse the user's cross-channel transactions. The embedded timestamps are used to record the temporal information of the user's transactions. The temporal graph convolutional layer is used to construct a time slice graph based on the user's dynamic information features. The time slice graph includes the occurrence time of the user's transaction operations and the occurrence time of non-transaction operations. The risk prediction layer predicts the user's risk indicator value through a gating fusion module.

[0010] Optionally, at least the user's static information features and the user's dynamic information features are input into the risk prediction model to perform risk prediction and obtain the user's risk index value, including: obtaining the processing time corresponding to the dynamic information features; determining the weight of the dynamic information features based on the processing time, wherein the processing time is inversely correlated with the weight of the dynamic information features; at least the user's static information features, the user's dynamic information features, and the weights corresponding to the dynamic information features are input into the risk prediction model to perform risk prediction and obtain the user's risk index value.

[0011] Optionally, after inputting at least the user's static information features and the user's dynamic information features into a risk prediction model to perform risk prediction and obtain the user's risk index value, the method further includes: if the user's risk index value is within a first preset range, controlling the user to be unable to conduct transactions; if the user's risk index value is within a second preset range, reducing the transaction amount of the user's account, where the maximum value of the second preset range is the minimum value of the first preset range.

[0012] To achieve the above objectives, according to another aspect of this application, a user transaction risk assessment device is provided. The device includes: a first acquisition unit, configured to acquire dynamic information features of a user, the dynamic information features including at least information change features of the user within a first historical period, transaction operation features of the user, and non-transaction operation features of the user, the information change features indicating whether the user's information has changed within the first historical period; a second acquisition unit, configured to acquire static information features of the user, the static information features including the user's information at the current moment; and a risk assessment unit, configured to input at least the user's static information features and the user's dynamic information features into a risk prediction model to perform risk prediction, obtaining a risk index value for the user, the risk prediction model being trained based on a neural network model, and the user's risk index value representing the user's transaction risk.

[0013] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform any of the aforementioned methods for determining user transaction risk.

[0014] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including methods for performing any of the aforementioned methods for determining user transaction risk.

[0015] According to the embodiments of this application, the above-mentioned method for determining user transaction risk first obtains the user's dynamic information features, which include at least the user's information change features, transaction operation features, and non-transaction operation features within a first historical period. The information change features indicate whether the user's information has changed within the first historical period. Then, the user's static information features are obtained, including the user's information at the current moment. Finally, at least the user's static and dynamic information features are input into a risk prediction model for risk prediction to obtain the user's risk index value. The risk prediction model is trained based on a neural network model, and the user's risk index value represents the user's transaction risk. This method integrates dynamic and static features for multi-dimensional feature dynamic coupling analysis, solving the pain points of traditional anti-abnormal behavior systems such as delayed response and feature fragmentation. This fundamentally changes the passive transaction monitoring defense mode and constructs a real-time security barrier against information tampering. Furthermore, by constructing a multimodal temporal graph neural network risk prediction model, proactive abnormal behavior risk prediction is achieved in user information modification scenarios, thereby solving the problem of low accuracy in identifying customer abnormal behavior risks in related technologies. Attached Figure Description

[0016] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0017] Figure 1 A hardware structure block diagram of a computer terminal for implementing a method for determining user transaction risk is shown.

[0018] Figure 2 This is a flowchart of a method for determining user transaction risk according to an embodiment of this application;

[0019] Figure 3 This is a schematic diagram of a user transaction risk assessment device provided according to an embodiment of this application;

[0020] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0021] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0022] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0023] It should be noted that the information collected in this application (including but not limited to user information, user transaction operation information, and user non-transaction operation information, etc.) and data (including but not limited to data used for display and analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with relevant laws, regulations, and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or institutions, providing users with corresponding operation entry points for them to choose to agree to or refuse automated decision results; if the user chooses to refuse, the process enters the expert decision-making process. Users can view the purpose of data use in real time through authorization decoding and have the right to withdraw authorization or delete data at any time. After authorization is withdrawn, the system will terminate the relevant data processing within 24 hours.

[0024] As introduced in the background section, traditional risk control relies on static rules and manual review. This results in slow and inefficient identification of abnormal behavior risks arising immediately after customers proactively request adjustments to key information, such as the terminal devices they use, user location data, and passwords. Therefore, there is an urgent need to build a real-time prevention and control system that uses information changes as the starting point for risk tracing. Through multi-dimensional operational chain temporal modeling, this system can proactively intercept abnormal behavior at the stage of key information tampering, thus blocking the path of abnormal behavior at its source.

[0025] Rule-based detection methods in related technical solutions detect potential abnormal behavior risks by defining a set of rules, such as customer password changes, abnormal account openings, and login activity. This approach relies on post-transaction rule determination, missing the critical window for intercepting information tampering, and analyzing isolated signals such as identity changes, device fingerprints, and transaction behavior, ignoring the spatiotemporal correlation of multi-dimensional operations. Therefore, existing technologies have low accuracy in identifying customer abnormal behavior risks and are insufficient for effectively identifying novel cross-channel combined attacks based solely on transaction-related information.

[0026] To address the issue of low accuracy in identifying abnormal customer behavior risks in related technologies, embodiments of this application provide a method for determining user transaction risks, a device for assessing user transaction risks, a computer-readable storage medium, and an electronic device.

[0027] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings.

[0028] Example 1

[0029] According to an embodiment of this application, an embodiment of a method for determining user transaction risk is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0030] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method to determine user transaction risk is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1The different configurations shown.

[0031] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0032] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the user transaction risk determination method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned user transaction risk determination method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0033] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0034] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0035] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for determining user transaction risk is shown. Figure 2 This is a flowchart of a method for determining user transaction risk according to Embodiment 1 of this application.

[0036] Step S201: With user authorization, obtain the user's dynamic information features. The dynamic information features include at least the user's information change features, the user's transaction operation features, and the user's non-transaction operation features within the first historical period. The information change features indicate whether the user's information has changed within the first historical period.

[0037] Specifically, the dynamic information characteristics of users include, but are not limited to, modifications to user information, recent transaction activities, and other non-transactional operations. For example, when a user changes the communication identifier of their terminal device, or their geographical location data changes, or their key information changes, the system records this change and its specific time. Furthermore, with user authorization, the system also detects user login and operational behavior on mobile banking, such as high-frequency operations during abnormal periods, changes in communication devices, abnormal IP address jumps, and transaction behaviors, such as high-value fund transfers and cross-regional fund activities. This dynamic information helps construct a time series of user behavior, providing real-time data for risk assessment. By capturing and analyzing users' dynamic behavioral characteristics in real time, the system can quickly respond to changes in user information, promptly assess the anomalies in behavioral patterns before and after changes, and effectively identify potential abnormal behavioral risks. This dynamic capture and analysis mechanism overcomes the limitations of traditional risk control systems based on static rules and post-transaction analysis, achieving proactive and real-time risk identification, thereby improving the timeliness and accuracy of risk prevention and control.

[0038] Step S202: Obtain the static information features of the user, including the user information of the user at the current time.

[0039] Specifically, static information features refer to a user's current attribute information, including but not limited to user attribute tags and historical risk tags. User attribute tags are a series of labels used to describe user characteristics. Historical risk tags can include records of historical abnormal behavior (within the last 5 years). Static information features also include user rights level, service access level, customer contribution analysis, etc. This information is considered an unchanging attribute, used to assist in the analysis of dynamic features and to construct a user's risk profile. Combining a user's static information features allows for a more comprehensive assessment of the user's risk level. For example, users in a certain age group may be more likely to be targets of fraud, while users in a specific profession may engage in cross-border transactions more frequently. By incorporating these static features into the risk prediction model, abnormal behavior can be identified more accurately, further improving the accuracy and coverage of risk identification.

[0040] Step S203: At least the static information features and dynamic information features of the user are input into the risk prediction model to make risk prediction and obtain the risk index value of the user. The risk prediction model is trained based on a neural network model, and the risk index value of the user represents the user's transaction risk.

[0041] Specifically, the pre-trained risk prediction model is built upon Graph Neural Networks (GNNs) and Transformer models. By analyzing the spatiotemporal correlations of user behavior, it can predict user behavioral risks in real time. The model's training data includes users' historical transaction records, operational behaviors, and anomaly labels. Training the model with this data ensures it can accurately capture abnormal patterns in user behavior, thus achieving better predictive results. Through a multimodal temporal graph neural network model, real-time and accurate prediction of user transaction risks is achieved. This model not only considers the temporal and spatial aspects of user behavior but also incorporates static user attributes, making risk assessment more comprehensive and accurate. The output of risk indicator values ​​can promptly reflect the degree of abnormality in user behavior, providing financial institutions with immediate risk warnings, effectively preventing abnormal behavior, and reducing financial and customer losses.

[0042] Graph Neural Networks (GNNs) are neural network models used to process graph-structured data, enabling them to learn and predict using information from nodes and edges in the graph. In the specific implementation of the real-time prevention and control system for abnormal behavior after adjustments to bank customer information based on multimodal temporal graph neural networks, the GNN model used combines LightGCN and Transformer models to handle the temporal and complex relationships of user behavior. The graph neural network model includes node embedding layers, temporal graph convolutional layers, and risk prediction layers.

[0043] Furthermore, the Transformer model is a neural network architecture for sequence-to-sequence (seq2seq) tasks, particularly suitable for Natural Language Processing (NLP) fields such as machine translation, text summarization, and semantic understanding. Its innovation lies in completely abandoning the reliance on Recurrent Neural Networks (RNNs) and Convolutional Neural Networks (CNNs), instead relying on a self-attention mechanism. This allows the model to compute in parallel while processing sequential data, significantly improving training speed and model performance. The Transformer model consists of an encoder, a decoder, and an output layer.

[0044] LightGCN is a simplified design within graph neural networks, specifically designed for recommendation systems to process user-item interaction data. The core idea of ​​the model is to capture the implicit relationships between users and items by propagating information through a message-passing mechanism in the graph. LightGCN embeds user and item nodes into a low-dimensional vector space using multiple layers of graph convolutions (without activation functions, performing direct linear transformations), and then makes recommendations by estimating user ratings for items. Compared to complex GNN models, LightGCN simplifies the structure, removes non-linear transformations, and retains only the information propagation mechanism, making the model more efficient and easier to train. LightGCN includes an initialization embedding layer, graph convolutional layers, embedding aggregation, and rating prediction.

[0045] In addition, it should be noted that during the information collection process, all sensitive fields (such as the user's original terminal device communication information, the user's updated terminal device communication information, and the device IDs (Identifiers) of the original and updated terminal devices) are generated into irreversible ciphertexts using SHA-256 and transmitted in encrypted form to ensure user privacy.

[0046] The method for determining user transaction risk described in this application first acquires the user's dynamic information features, which include at least the user's information change features, transaction operation features, and non-transaction operation features within a first historical period. The information change features indicate whether the user's information has changed within the first historical period. Next, the method acquires the user's static information features, which include the user's information at the current moment. At least the user's static and dynamic information features are input into a risk prediction model for risk prediction, yielding the user's risk index value. The risk prediction model is trained based on a neural network model, and the user's risk index value represents the user's transaction risk. This method integrates dynamic and static features for multi-dimensional dynamic coupling analysis, solving the pain points of traditional anti-abnormal behavior systems such as delayed response and fragmented features. This fundamentally changes the passive transaction monitoring defense mode and constructs a real-time security barrier against information tampering. Furthermore, by constructing a multimodal temporal graph neural network risk prediction model, it achieves proactive abnormal behavior risk prediction in user information modification scenarios, thereby solving the problem of low accuracy in identifying customer abnormal behavior risks in related technologies.

[0047] This embodiment proposes a method for determining user transaction risk. This method acquires dynamic information features of the user within a first historical time period, including user information change features, transaction operation features, and non-transaction operation features. Combined with the user's static information features, including the user's information at the current moment, a risk prediction model based on a neural network is used for risk prediction. The core of this method is that it not only considers the user's static information but also pays special attention to dynamic information features, especially information change features. This encompasses the urgency and spatial correlation of user information modifications, capturing the temporal and spatial changes in user behavior, thus providing a more comprehensive assessment of the user's transaction risk after information changes. Since the risk prediction model is trained on a neural network, it can automatically learn and adapt to complex feature relationships. Therefore, this method can effectively identify and predict abnormal behavior risks that may arise due to changes in user information, improving the accuracy and timeliness of risk identification. By detecting and analyzing user behavior patterns in real time, risk assessment can be quickly conducted after key information modifications, allowing for timely preventative measures to prevent losses caused by potential abnormal behavior.

[0048] In some embodiments, obtaining the user's dynamic information features includes the following steps:

[0049] Step S301: Obtain the change information of the above user information, and extract features from the change information of the above user to obtain the information change features of the above user. The change information indicates whether the above user information has changed.

[0050] Step S302: Obtain the non-transaction operation information of the user and extract features from the non-transaction operation information to obtain the non-transaction operation features. The non-transaction operation information includes at least one of the following: the user's device detection information, page interaction information, and verification login information. The device detection information includes at least one of the following: the user's device login time period, the user's device sensor data, and the user's device touch trajectory. The page interaction information includes at least one of the following: the page jump information when the user performs a transaction. The verification login information includes the user's number of verification failures and verification delay time.

[0051] Step S303: Obtain the transaction operation information of the user and extract features from the transaction operation information to obtain the transaction operation features. The transaction operation information includes the transaction amount, transaction channel and transaction frequency of the user's transaction.

[0052] Step S304: Determine the dynamic information characteristics of the user based on at least one of the above-mentioned information change characteristics, the above-mentioned non-transaction operation characteristics, and the above-mentioned transaction operation characteristics.

[0053] In the process of identifying dynamic information features of users, dynamic information of users is obtained by capturing the full-link operation behavior of customers on the mobile banking terminal in real time, and a dynamic weight feature library is constructed based on the time decay mechanism to obtain dynamic information features.

[0054] Among them, the user information change information includes changes to the user's core identity elements, such as modifications to the communication information of the user's terminal device, the information of the fund account, and the modification of the user's communication location data. At the same time, the operating device (i.e. the device on which the operation information is changed), the timestamp (i.e. the time of the information modification) and the complete information before and after the modification are recorded.

[0055] The user's non-trading operation information specifically includes the following three aspects:

[0056] 1. Device Usage Depth Detection Record: Distribution of device activation periods, such as abnormal activity in the early morning or abnormal sensor data. Sensor data refers to data collected by sensors on the device, such as sudden acceleration or gyroscope deviation, which indicates that the device is in motion. Dynamic information also includes: screen touch trajectory, such as high-frequency clicks by users on uncommon hot areas of the device, or sensitive operations within 24 hours after a new device is bound (e.g., dangerous operations such as large-amount transfers); dynamic information also includes: VPN on / off status switching, IP address cross-regional redirection, etc., such as switching to an overseas proxy within 5 minutes;

[0057] 2. Page interaction trajectory reconstruction: Completely track the jump path of functional modules, such as abnormal chaining of account page → quick transfer → modify payee → large amount transfer, and mark irregular rollback behavior, such as repeated entry and exit of identity authentication page, forced exit and other interruption events;

[0058] 3. Spatiotemporal behavioral feature extraction: detection of dwell time on key pages and dynamic analysis of biometric authentication, including: number of consecutive failed face verifications, changes in fingerprint recognition pressure values, and response delays for face verification or fingerprint detection.

[0059] In addition, dynamic information also includes: constructing characteristics such as high-frequency large-amount transfers, abnormal geographical jumps, and operations through uncommon channels based on recent customer transactions; and constructing characteristics such as transaction amount, method, frequency, and channel penetration analysis based on medium-term transactions to identify transaction trend distortions.

[0060] Finally, after collecting dynamic information, an exponential decay model is used to dynamically calculate the weight of each piece of dynamic information, that is, the weight value is determined based on a time coefficient, with the coefficient being larger for more recent data. In addition, all data is encrypted using AES-256 during transmission to ensure the confidentiality of information transmission. The storage layer employs segmented desensitization technology, that is, for stored device fingerprints, only the first 3 bytes are retained, and only the hash value is stored for facial recognition information; the original operation path is converted into a behavior encoding sequence.

[0061] In this embodiment, acquiring the dynamic information characteristics of users mainly includes three aspects. First, acquiring user information change information, specifically including changes in user identity information, changes in device environment, etc., and extracting features from these changes to obtain user information change characteristics, thereby quantifying the urgency of information changes and the potential risks. Second, capturing non-transaction operation information in real time, covering device usage depth detection records, page interaction trajectory reconstruction, and spatiotemporal behavioral feature extraction, etc., and obtaining non-transaction operation characteristics through feature extraction of this information to assess the abnormality and potential risks of operations. Finally, constructing a full-cycle transaction feature profile of customers through transaction flow, extracting multi-time series transaction features, including high-frequency large-amount transfers, geographical jump anomalies, etc., as well as the risk community network of counterparties, to form transaction operation characteristics, thereby capturing sudden changes in transaction patterns and the spread of risks. Based on the comprehensive analysis of information change characteristics, non-transaction operation characteristics, and transaction operation characteristics, this embodiment can determine the dynamic information characteristics of users, and realize the proactive identification and real-time prevention and control of abnormal behavior risks in scenarios involving modifications to key information of bank customers.

[0062] In some embodiments, at least the static information features and dynamic information features of the user are input into a risk prediction model to perform risk prediction and obtain the risk index value of the user, including the following steps:

[0063] Step S401: Obtain the current modification duration and the historical average modification duration of the above user information. The current modification duration is the interval between the current modification and the previous modification of the above user information. The historical average modification duration is the average of the modification interval duration of the above user information within the second historical time period.

[0064] Step S402: Obtain a preset coefficient, and determine the urgency of modifying the user information based on the preset coefficient, the difference between the current modification duration and the historical average modification duration.

[0065] Step S403: At least the static information characteristics of the user, the dynamic information characteristics of the user, and the urgency of modifying the user information are input into the risk prediction model to perform risk prediction and obtain the risk index value of the user.

[0066] Based on the aforementioned collected multi-source information, the urgency of information modification is calculated as shown in the formula: Where A represents the urgency of information modification, λ is a preset coefficient, λ=0.1, and Δt=current modification duration - historical average modification duration.

[0067] In this embodiment, the calculation of the urgency of user information modification first obtains the duration of the current modification and the historical average modification duration. The current modification duration is the time interval between the current modification and the previous modification, while the historical average modification duration is determined based on the average of the user information modification interval durations within a second historical time period. Then, using a preset coefficient and the difference between the current modification duration and the historical average modification duration, the urgency of user information modification is calculated. Finally, the user's static information characteristics, dynamic information characteristics, and urgency of information modification are integrated and input into a risk prediction model for risk assessment, generating a risk index value for the user. This process not only considers the frequency and pattern of user information modification but also fully integrates the user's static attributes and dynamic behavioral characteristics. Through analysis using a multimodal graph neural network model, it achieves comprehensive and dynamic prediction of user risk, thereby optimizing the formulation and execution of risk control strategies and improving the financial institution's ability to warn and respond to abnormal behavior.

[0068] In some embodiments, at least the static information characteristics of the user, the dynamic information characteristics of the user, and the urgency of modifying the user information are input into the risk prediction model to perform risk prediction and obtain the risk index value of the user, including the following steps:

[0069] Step S501: Obtain the current movement distance and the historical maximum movement distance of the user. The current movement distance is the distance between the Internet Protocol address of the user device's current login and the Internet Protocol address of the user device's last login. The historical maximum movement distance is the maximum movement distance of the user device within the second historical period. The movement distance is the distance between the Internet Protocol addresses of the user device's two adjacent logins within the second historical period.

[0070] Step S502: The ratio of the current moving distance to the historical maximum moving distance is determined as the user's geographic jump index.

[0071] Step S503: Input the user's geographic jump index, static information characteristics, dynamic information characteristics, and urgency of information modification into the risk prediction model to perform risk prediction and obtain the user's risk index value.

[0072] Among them, the spatial association feature is based on the geographical location of the customer's recent operation IP, and calculates the geographical jump index. The geographical jump index = distance between the current operation IP and the last login IP / historical maximum movement distance. Based on the device fingerprint information of the customer in the recent period, such as device IP, device name, number, and network, the diversity of BSSID associated with the device is calculated.

[0073] In this embodiment, to more comprehensively assess user risk, a geographic jump index is introduced. Specifically, firstly, the distance between the user device's current login address and its previous login address is calculated, i.e., the current movement distance. Simultaneously, all movement distances of the user device within a second historical time period are statistically analyzed, and the maximum value is taken as the historical maximum movement distance. Then, the ratio of the current movement distance to the historical maximum movement distance is determined as the user's geographic jump index. This index reflects whether the user has made significant geographical location changes in a short period and is an important component of spatiotemporal behavioral characteristics. Next, the user's geographic jump index, along with static information characteristics, dynamic information characteristics, and the urgency of information modification, are input into the risk prediction model for comprehensive analysis. In this way, the risk prediction model can more accurately capture abnormal changes in user behavior, especially within a short time window after information modification, thereby achieving real-time early warning and effective prevention of potential abnormal behavior. This dynamic feature engineering based on the geographic jump index greatly enhances the model's sensitivity to spatiotemporal correlations and improves the accuracy and real-time performance of risk identification.

[0074] In some embodiments, the risk prediction model includes a node embedding layer, a temporal graph convolutional layer, and a risk prediction layer. The node embedding layer includes user nodes and event nodes. The user nodes are constructed based on a graph convolutional network model, and the event nodes are constructed based on a transformer model, a multi-head attention mechanism, and embedded timestamps. The transformer model is used to encode the dynamic operation sequence of the event nodes. The multi-head attention mechanism is used to parse the user's cross-channel transactions. The embedded timestamps are used to record the temporal information of the user's transactions. The temporal graph convolutional layer is used to construct a time slice map based on the user's dynamic information features. The time slice map includes the occurrence time of the user's transaction operations and the occurrence time of non-transaction operations. The risk prediction layer predicts the user's risk indicator value through a gating fusion module.

[0075] In the multimodal graph neural network model, the framework adopts a three-layer heterogeneous time-series graph structure, integrating user static attributes and dynamic transaction behavior, including the following three aspects:

[0076] 1. Node Embedding Layer: User nodes aggregate de-identified profiles through LightGCN, such as age range / occupation codes and historical risk characteristics, to capture account correlation; event nodes encode dynamic operation sequences by Transformer, and use a multi-head attention mechanism to parse cross-channel transaction patterns, such as POS consumption → cross-border transfer, while embedding timestamp location codes to retain time sequence information;

[0077] 2. Temporal Graph Convolutional Layer (TGAT): Based on the dynamic transaction chain, a time slice graph is constructed, generating an evolutionary subgraph every 90 days. It includes the following three aspects: spatiotemporal encoding, which transforms the transaction time difference into a periodic spatiotemporal vector; heterogeneous edge weights, which adjust the information propagation intensity according to the proportion of transaction amount and the geographical cross-domain coefficient (e.g., cross-border transactions have a 180% weight increase); and real-time aggregation, which dynamically updates the user representation based on the occurrence time of neighboring node events.

[0078] 3. Risk Prediction Layer: This layer combines historical user status with the latest event characteristics, generating the risk probability for the current moment through a gating fusion module. The output layer uses residual connections, and the final score reflects the combined effect of short-term behavioral mutations and long-term risk accumulation, achieving penetrating risk perception.

[0079] In this embodiment, the risk prediction model includes a node embedding layer, a temporal graph convolutional layer, and a risk prediction layer. The node embedding layer encompasses user nodes and event nodes. User nodes are constructed based on the LightGCN model, aggregating user profiles and historical risk features to capture the correlation between accounts. Event nodes are constructed using the Transformer model, multi-head attention mechanism, and embedded timestamps to encode dynamic operation sequences, parse user cross-channel transaction patterns, and retain transaction temporal information. The temporal graph convolutional layer constructs a time slice graph based on the user's dynamic information features, generating an evolutionary subgraph every 90 days. This layer transforms transaction time differences into spatiotemporal vectors and adjusts the information propagation intensity according to transaction amount proportion and geographical cross-domain coefficient, achieving real-time aggregation of user representations and dynamically capturing risk features. The risk prediction layer uses a gating fusion module to concatenate the user's historical state with the latest event features, predicting the user's risk index value in real time. The output layer uses residual connections to ensure that the score reflects the combined effect of short-term behavioral mutations and long-term risk accumulation. Overall, through the design of a multimodal temporal graph neural network, this model can effectively integrate the temporal chain, spatial trajectory, and biological behavioral characteristics of user operations, enabling proactive real-time prevention and control of abnormal behavior risks in scenarios involving modification of key information of bank customers, thereby improving the accuracy and efficiency of risk identification.

[0080] In some embodiments, at least the static information features and dynamic information features of the user are input into the risk prediction model to perform risk prediction and obtain the risk index value of the user, including the following steps:

[0081] Step S601: Obtain the processing time corresponding to the above dynamic information features;

[0082] Step S602: Determine the weight of the dynamic information feature based on the processing time, wherein the processing time is inversely correlated with the weight of the dynamic information feature.

[0083] Step S603: At least the static information features of the user, the dynamic information features of the user, and the weights corresponding to the dynamic information features are input into the risk prediction model to perform risk prediction and obtain the risk index value of the user.

[0084] In this embodiment, the processing time corresponding to the user's dynamic information features is obtained, and then the weight of the dynamic information features is determined based on the processing time, wherein the processing time and the weight of the dynamic information features are inversely correlated. Recent actions are assigned higher weights to reflect their greater impact on the current risk assessment. Subsequently, the user's static information features, dynamic information features, and their corresponding weights are input into the risk prediction model to perform risk prediction and derive the user's risk index value. Through this dynamic weight adjustment mechanism, the system can more sensitively capture the potential risks of immediate behaviors, enhancing the real-time nature and accuracy of risk prediction. This method not only quickly responds to the user's latest actions but also comprehensively considers historical behaviors and static attributes, thereby achieving a better balance in risk identification and prevention, and reducing the probability of abnormal behavior risks.

[0085] In some embodiments, after inputting at least the static information features and dynamic information features of the user into the risk prediction model to perform risk prediction and obtain the risk index value of the user, the method further includes the following steps:

[0086] Step S701: If the risk index value of the aforementioned user is within the first preset range, control the aforementioned user to prevent them from making transactions;

[0087] Step S702: If the risk index value of the user is within the second preset range, the transaction amount of the user's account is reduced. The maximum value of the second preset range is the minimum value of the first preset range.

[0088] In the above embodiment, a decision logic matrix is ​​used to manage and control customer risk scores at different levels. When the risk score (i.e., the risk indicator value) is within a first preset range, the account is frozen and payment is stopped; when the risk score (i.e., the risk indicator value) is within a second preset range, the account limit is reduced. The range of the first preset range is [0.95, 1), and the range of the second preset range is [0.85, 0.95].

[0089] In this embodiment, after the user's static and dynamic information features are processed by the multimodal graph neural network model, the system will make corresponding real-time decisions based on the user's risk indicator value. Specifically, if the user's risk indicator value is within a first preset range, the system will automatically implement transaction blocking measures, preventing the user from performing any transactions and ensuring fund security under high-risk conditions. When the user's risk indicator value is within a second preset range, the system adopts a more flexible response strategy, namely, reducing the transaction amount of the user's account. The upper limit of the second preset range is set as the lower limit of the first preset range. This range division aims to effectively control medium-risk behaviors, avoiding user inconvenience caused by excessive restrictions, and allowing for timely adjustment of strategies within a controllable risk range, thereby enhancing the system's responsiveness and risk prevention effectiveness. This risk indicator-based hierarchical control mechanism not only improves the accuracy of risk identification but also effectively balances the relationship between user experience and security, providing a more intelligent and refined risk management method.

[0090] In addition, this embodiment can also construct a risk community network, that is, extract the counterparties who have financial dealings with high-risk customers, form a secondary propagation network, calculate the community risk concentration, and construct a dynamic risk superposition mechanism.

[0091] The user transaction risk determination method provided in this application, through the construction of a multimodal temporal graph neural network, achieves proactive abnormal behavior risk prevention and control in scenarios involving the modification of key bank customer information. It integrates dynamic and static features for dynamic coupling analysis, solving the pain points of traditional anti-abnormal behavior systems such as delayed response and fragmented features. It also addresses the low accuracy of identifying abnormal customer behavior risks in related technologies, fundamentally changing the passive transaction monitoring defense model, constructing a real-time security barrier against information tampering, and significantly reducing financial losses and social harm.

[0092] This application overcomes the limitations of related technologies that mainly rely on transaction characteristics for identifying abnormal behavior risks. In particular, it addresses the problem that when bank customers proactively request to adjust key information, such as contact information, address, and password, it is impossible to identify the abnormal behavior risks that may immediately arise from this in a timely and effective manner, thereby improving the accuracy, timeliness, and coverage of risk identification.

[0093] This application utilizes a multimodal temporal graph neural network to achieve proactive anomaly risk prevention in scenarios involving the modification of critical customer information. The system innovatively uses information adjustment events as the starting point for risk identification, integrating multi-dimensional features such as operational time-series chains, spatial trajectories, and biological behavior for dynamic coupling analysis. This addresses the pain points of traditional anti-anomaly systems, such as delayed response and fragmented features. This solution fundamentally changes the passive transaction monitoring defense model, constructing a real-time security barrier against information tampering, and significantly reducing financial losses and social harm.

[0094] Example 2

[0095] This application also provides a user transaction risk assessment device. It should be noted that this user transaction risk assessment device can be used to execute the user transaction risk determination method provided in this application. The user transaction risk assessment device provided in this application is described below.

[0096] According to an embodiment of this application, an apparatus for implementing the above-described method for determining user transaction risk is also provided, such as... Figure 3 As shown, the device includes: a first acquisition unit 20, a second acquisition unit 30, and a risk assessment unit 40. The first acquisition unit 20 is used to acquire the dynamic information features of the user, which include at least the user's information change features, the user's transaction operation features, and the user's non-transaction operation features within a first historical period. The information change features indicate whether the user's information has changed within the first historical period. The second acquisition unit 30 is used to acquire the user's static information features, which include the user's information at the current moment. The risk assessment unit 40 is used to input at least the user's static information features and the user's dynamic information features into a risk prediction model to perform risk prediction and obtain the user's risk index value. The risk prediction model is trained based on a neural network model, and the user's risk index value represents the user's transaction risk.

[0097] The aforementioned user transaction risk assessment device of this application includes a first acquisition unit, a second acquisition unit, and a risk assessment unit. The first acquisition unit is used to acquire the user's dynamic information features, which include at least the user's information change features, transaction operation features, and non-transaction operation features within a first historical period. The information change features indicate whether the user's information has changed within the first historical period. The second acquisition unit is used to acquire the user's static information features, which include the user's information at the current moment. The risk assessment unit is used to input at least the user's static and dynamic information features into a risk prediction model to perform risk prediction and obtain the user's risk index value. The risk prediction model is trained based on a neural network model, and the user's risk index value represents the user's transaction risk. This device, by constructing a multimodal temporal graph neural network, realizes proactive abnormal behavior risk prevention and control in scenarios involving modification of key information of bank customers. It integrates dynamic and static features for multidimensional feature dynamic coupling analysis, solving the pain points of slow response and fragmented features in traditional anti-abnormal behavior systems, and addressing the problem of low accuracy in identifying abnormal customer behavior risks in related technologies.

[0098] In some embodiments, the dynamic information features of the user are acquired. The first acquisition unit includes a first acquisition module, a second acquisition module, a third acquisition module, and a first risk assessment module. The first acquisition module is used to acquire the change information of the user information and extract features from the change information to obtain the information change features of the user. The change information indicates whether the user information has changed. The second acquisition module is used to acquire the non-transaction operation information of the user and extract features from the non-transaction operation information to obtain the non-transaction operation features. The non-transaction operation information includes at least one of the following: the user's device detection information, page interaction information, and login verification information. The device detection information includes at least one of the following: the user's device login period. The sensor data and touch trajectory of the aforementioned user device, and the page interaction information, include at least one of the following: page redirection information when the user executes a transaction, and the verification login information includes the number of verification failures and verification delay time of the user; the third acquisition module is used to acquire the transaction operation information of the aforementioned user, and to extract features from the aforementioned transaction operation information to obtain the aforementioned transaction operation features, including the transaction amount, transaction channel, and transaction frequency of the user's transaction; the first risk assessment module is used to determine the dynamic information features of the aforementioned user based on at least one of the aforementioned information change features, the aforementioned non-transaction operation features, and the aforementioned transaction operation features, thus solving the pain points of slow response and fragmented features in traditional anti-abnormal behavior systems.

[0099] In some embodiments, at least the static information characteristics and dynamic information characteristics of the user are input into the risk prediction model for risk prediction to obtain the user's risk index value. The risk assessment unit further includes a fourth acquisition module, a fifth acquisition module, and a second risk assessment module. The fourth acquisition module is used to acquire the current modification duration and the historical average modification duration of the user information. The current modification duration is the interval between the current modification and the previous modification of the user information, and the historical average modification duration is the average of the modification interval durations of the user information within a second historical period. The fifth acquisition module is used to acquire a preset coefficient and determine the urgency of modifying the user information based on the preset coefficient, the difference between the current modification duration and the historical average modification duration. The second risk assessment module is used to input at least the user's static information characteristics, the user's dynamic information characteristics, and the urgency of modifying the user information into the risk prediction model for risk prediction to obtain the user's risk index value. By introducing the urgency of information modification, the model can immediately react to changes in user information and assess whether the change implies potential risks.

[0100] In some embodiments, the second risk assessment module further includes a sixth acquisition module, a seventh acquisition module, and a third risk assessment module. The sixth acquisition module acquires the user's current movement distance and historical maximum movement distance. The current movement distance is the distance between the Internet Protocol address used for the user device's current login and the Internet Protocol address used for the user device's last login. The historical maximum movement distance is the maximum movement distance of the user device within a second historical time period, and the movement distance is the distance between two adjacent Internet Protocol addresses used for the user device's login within the second historical time period. The seventh acquisition module determines the ratio of the current movement distance to the historical maximum movement distance as the user's geographic jump index. The third risk assessment module inputs the user's geographic jump index, the user's static information characteristics, the user's dynamic information characteristics, and the urgency of modifying the user's information into the risk prediction model for risk prediction, obtaining the user's risk index value. The geographic jump index reflects sudden changes in the user's operating location, which is particularly significant for identifying short-term cross-regional or cross-border operations, especially login attempts switching from one country to another in a short period. Such abnormal movement patterns may be signs that unauthorized operators are attempting to circumvent regulations.

[0101] In some embodiments, the risk assessment unit further includes the aforementioned risk prediction model comprising a node embedding layer, a temporal graph convolutional layer, and a risk prediction layer. The node embedding layer includes user nodes and event nodes. The user nodes are constructed based on a graph convolutional network model, and the event nodes are constructed based on a transformer model, a multi-head attention mechanism, and embedded timestamps. The transformer model is used to encode the dynamic operation sequence of the event nodes. The multi-head attention mechanism is used to parse the user's cross-channel transactions. The embedded timestamps are used to record the temporal information of the user's transactions. The temporal graph convolutional layer is used to construct a time slice graph based on the user's dynamic information features. The time slice graph includes the occurrence times of the user's transaction operations and non-transaction operations. The risk prediction layer predicts the user's risk indicator value through a gating fusion module. This risk assessment model based on a multimodal temporal graph neural network, through heterogeneous node design, spatiotemporal encoding, and dynamic fusion mechanism, greatly improves the ability to identify abnormal behavior risks of bank customers.

[0102] In some embodiments, the static and dynamic information features of the user are input into the risk prediction model for risk prediction to obtain the user's risk index value. The risk assessment unit further includes an eighth acquisition module, a fourth risk assessment module, and a fifth risk assessment module. The eighth acquisition module is used to acquire the processing time corresponding to the dynamic information features; the third risk assessment module is used to determine the weight of the dynamic information features based on the processing time, wherein the processing time is inversely correlated with the weight of the dynamic information features; and the fourth risk assessment module is used to input at least the user's static information features, the user's dynamic information features, and the weights corresponding to the dynamic information features into the risk prediction model for risk prediction to obtain the user's risk index value. By introducing a dynamic feature weight adjustment mechanism based on processing time, the timeliness and accuracy of the risk assessment model are significantly improved, and the model's flexibility and efficiency are enhanced.

[0103] In some embodiments, the device further includes a fifth risk assessment module and a sixth risk assessment module. The fifth risk assessment module is used to control the user to prevent transactions when the user's risk indicator value is within a first preset range, after inputting at least the user's static information characteristics and dynamic information characteristics into a risk prediction model to perform risk prediction and obtain the user's risk indicator value. The sixth risk assessment module is used to reduce the transaction amount of the user's account when the user's risk indicator value is within a second preset range, where the maximum value of the second preset range is the minimum value of the first preset range. By introducing a multi-level risk response mechanism, more refined and dynamic management of user risk is achieved, which not only improves the risk control capabilities of financial institutions but also enhances user experience and the rationality of resource utilization.

[0104] The user transaction risk assessment device provided in this application, through the construction of a multimodal temporal graph neural network, achieves proactive abnormal behavior risk prevention and control in scenarios involving the modification of key bank customer information. It integrates dynamic and static features for multidimensional feature coupling analysis, solving the pain points of traditional anti-abnormal behavior systems such as delayed response and fragmented features, and addressing the low accuracy of identifying abnormal customer behavior risks in related technologies. This fundamentally changes the passive transaction monitoring defense model, constructs a real-time security barrier against information tampering, and significantly reduces financial losses and social harm.

[0105] It should be noted that the first acquisition module, the fourth acquisition module, and the first risk assessment module mentioned above correspond to steps S201 to S203. The instances and application scenarios implemented by the two modules and their corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and can run in the computer terminal 10 provided in Embodiment 1.

[0106] Example 3

[0107] Embodiments of this application may provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) processor 102, memory 104, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0108] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0109] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0110] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0111] Example 4

[0112] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the user transaction risk determination method provided in Embodiment 1.

[0113] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0114] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a method for determining user transaction risk.

[0115] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0116] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0117] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0118] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0119] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0120] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to related technologies, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0121] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining user transaction risk, characterized in that, include: With user authorization, the user's dynamic information features are obtained. The dynamic information features include at least the user's information change features, the user's transaction operation features, and the user's non-transaction operation features within a first historical period. The information change features indicate whether the user's information has changed within the first historical period. Obtain the static information features of the user, the static information features including the user information of the user at the current moment; At least the user's static information features and the user's dynamic information features are input into the risk prediction model to perform risk prediction, and the risk index value of the user is obtained. The risk prediction model is trained based on a neural network model, and the user's risk index value represents the user's transaction risk.

2. The method according to claim 1, characterized in that, Obtain user dynamic information characteristics, including: Obtain the change information of the user information, and extract features from the change information of the user to obtain the information change features of the user, wherein the change information indicates whether the user information has changed; Obtain the user's non-transaction operation information and extract features from the non-transaction operation information to obtain the non-transaction operation features. The non-transaction operation information includes at least one of the following: the user's device detection information, page interaction information, and verification login information. The device detection information includes at least one of the following: the user's device login time period, the user's device sensor data, and the user's device touch trajectory. The page interaction information includes at least one of the following: the page jump information when the user performs a transaction. The verification login information includes the user's number of verification failures and verification delay time. The user's transaction operation information is obtained, and features are extracted from the transaction operation information to obtain the transaction operation features. The transaction operation information includes the transaction amount, transaction channel, and transaction frequency of the user's transactions. The user's dynamic information characteristics are determined based on at least one of the information change characteristics, the non-transaction operation characteristics, and the transaction operation characteristics.

3. The method according to claim 1, characterized in that, At least the user's static information features and the user's dynamic information features are input into the risk prediction model to perform risk prediction, and the user's risk index value is obtained, including: The current modification duration and the historical average modification duration of the user information are obtained. The current modification duration is the interval between the current modification and the previous modification of the user information. The historical average modification duration is the average of the modification interval duration of the user information within the second historical time period. Obtain a preset coefficient, and determine the urgency of modifying the user information based on the preset coefficient, the difference between the current modification duration and the historical average modification duration; At least the user's static information characteristics, the user's dynamic information characteristics, and the urgency of modifying the user's information are input into the risk prediction model to perform risk prediction and obtain the user's risk index value.

4. The method according to claim 3, characterized in that, At least the user's static information characteristics, the user's dynamic information characteristics, and the urgency of modifying the user's information are input into the risk prediction model to perform risk prediction, thereby obtaining the user's risk index value, including: The user's current movement distance and historical maximum movement distance are obtained. The current movement distance is the distance between the Internet Protocol address of the user device's current login and the Internet Protocol address of the user device's last login. The historical maximum movement distance is the maximum movement distance of the user device within a second historical period. The movement distance is the distance between the Internet Protocol addresses of the user device's two adjacent logins within the second historical period. The ratio of the current travel distance to the historical maximum travel distance is determined as the user's geographic jump index; The user's geographic jump index, static information characteristics, dynamic information characteristics, and urgency of information modification are input into the risk prediction model to predict the risk and obtain the user's risk index value.

5. The method according to claim 1, characterized in that, The risk prediction model includes a node embedding layer, a temporal graph convolutional layer, and a risk prediction layer. The node embedding layer includes user nodes and event nodes. The user nodes are constructed based on a graph convolutional network model, and the event nodes are constructed based on a transformer model, a multi-head attention mechanism, and embedded timestamps. The transformer model is used to encode the dynamic operation sequence of the event nodes. The multi-head attention mechanism is used to parse the user's cross-channel transactions. The embedded timestamps are used to record the temporal information of the user's transactions. The temporal graph convolutional layer is used to construct a time slice graph based on the user's dynamic information features. The time slice graph includes the occurrence time of the user's transaction operations and the occurrence time of non-transaction operations. The risk prediction layer predicts the user's risk indicator value through a gating fusion module.

6. The method according to claim 1, characterized in that, At least the user's static information features and the user's dynamic information features are input into the risk prediction model to perform risk prediction, and the user's risk index value is obtained, including: Obtain the processing time corresponding to the dynamic information features; The weight of the dynamic information feature is determined based on the processing time, and the processing time is inversely correlated with the weight of the dynamic information feature. At least the user's static information features, the user's dynamic information features, and the weights corresponding to the dynamic information features are input into the risk prediction model to perform risk prediction and obtain the user's risk index value.

7. The method according to any one of claims 1 to 6, characterized in that, After inputting at least the user's static information features and the user's dynamic information features into a risk prediction model to perform risk prediction and obtain the user's risk index value, the method further includes: If the user's risk index value is within a first preset range, the user will be prevented from making transactions. If the user's risk index value is within a second preset range, the user's account will have its transaction amount reduced. The maximum value of the second preset range is the minimum value of the first preset range.

8. A device for assessing user transaction risk, characterized in that, include: The first acquisition unit is used to acquire the dynamic information features of the user. The dynamic information features include at least the information change features of the user in the first historical period, the transaction operation features of the user, and the non-transaction operation features of the user. The information change features indicate whether the user information of the user has changed in the first historical period. The second acquisition unit is used to acquire the static information features of the user, the static information features including the user information of the user at the current moment; The risk assessment unit is used to input at least the user's static information features and the user's dynamic information features into the risk prediction model to perform risk prediction and obtain the user's risk index value. The risk prediction model is trained based on a neural network model, and the user's risk index value represents the user's transaction risk.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the user transaction risk determination method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs including a method for performing the determination of user transaction risk as described in any one of claims 1 to 7.

Images