Fraud victim identification method and system based on multi-modal feature fusion

Abstract

The application discloses a fraud victim identification method and system based on multi-modal feature fusion, and belongs to the technical field of natural language processing, financial risk control and anti-telecommunication network fraud. The method only takes short messages as the only data source, realizes the restoration of the resistant semantics through a Chinese character stroke order and pinyin double-channel algorithm, constructs a fraud abnormal dictionary to calculate the fraud semantic similarity, analyzes the structured account elements of transactional short messages, constructs a multi-scale fund account behavior feature vector, builds a dynamic fraud-related special knowledge base to complete the payment channel risk matching, quantifies the short message-transferring time sequence causal confidence and extracts the time sequence causal features, finally inputs the multi-modal fusion feature input vector into a random forest model, outputs the victim risk probability, and obtains the fraud fine classification. The method realizes high-precision and interpretable fraud victim identification, and significantly improves the recall rate of the anti-text recognition and the generalization ability of the new fraud mode.

Description

Technical Field

[0001] This invention relates to the fields of natural language processing, financial risk control, and anti-telecom fraud technology, and particularly to a method and system for identifying fraud victims based on multimodal feature fusion. Background Technology

[0002] Victims of telecommunications and online fraud typically go through multiple stages during the fraud process, including receiving misleading text messages, clicking links or downloading apps, receiving verification codes, activating payment systems, and transferring money to designated accounts. Existing anti-fraud technology systems suffer from the following technical deficiencies:

[0003] 1. Insufficient semantic recognition capability for adversarial text; fraudulent text messages commonly employ techniques such as homophone substitution, confusion of similar-looking characters, character splitting and recombination, insertion of interfering symbols, and letter substitution to circumvent keyword filtering. Traditional methods based on exact matching or edit distance lack the ability to deeply model the written structure and phonetic features of Chinese characters, resulting in difficulties in semantic restoration of deformed words and a high false negative rate.

[0004] 2. Lagging detection capabilities for new fraudulent channels; fraudulent funds have shifted from niche app in-app purchases, virtual currencies, and fourth-party payment channels. Traditional identification methods based on fixed blacklists struggle to infer the fraud risk of a channel based solely on a user receiving verification codes from unfamiliar apps and subsequent transfer behavior, lacking semantic-level generalization matching capabilities.

[0005] 3. Lack of temporal and causal logical correlation: Receiving a verification code SMS is a normal communication behavior, but if the verification code comes from an overseas social media app that has never been installed, and the user immediately transfers money to an unknown personal account shortly after receiving it, this strong temporal correlation of "SMS reception → immediate transfer" is core evidence for identifying that the victim has been remotely controlled. Current technology lacks effective means to align the SMS reception event and the transfer event with minute-level precision and to quantify the causal confidence between the two.

[0006] In summary, there is an urgent need for a victim identification method that can deeply integrate SMS semantic features and fund transaction behavior features, possess adversarial text reconstruction capabilities, minute-level temporal causal reasoning capabilities, and self-learning capabilities for new fraud-related channels. Summary of the Invention

[0007] To address the aforementioned problems, this invention proposes a method and system for identifying fraud victims based on multimodal feature fusion.

[0008] To achieve the above objectives, the present invention employs the following technical solution:

[0009] Fraud victim identification methods based on multimodal feature fusion include:

[0010] The raw SMS data to be processed is obtained and preprocessed. The preprocessed raw SMS data is then subjected to adversarial semantic restoration and noise filtering to obtain a standardized SMS event sequence.

[0011] A fraud anomaly dictionary is constructed, and a weighted matching distance is calculated for each SMS message in the SMS event sequence to obtain the fraud semantic similarity. After extracting the core summary of each SMS message, unsupervised clustering is performed to obtain the primary fraud category label.

[0012] Identify transactional SMS messages from SMS event sequences, parse the structured transaction elements of the transactional SMS messages, generate a fund transaction event sequence and an SMS behavior event sequence; and construct a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence.

[0013] A fraud-related knowledge base is constructed and dynamically updated. The knowledge base includes multiple fraud-related channel entries, and all fraud-related channel entries are managed by entering them into the database based on fraud confidence levels. Payment channels are extracted based on the transactional SMS and structured account activity elements, and the payment channels are matched with the fraud-related knowledge base to calculate the user's payment channel risk matching score.

[0014] Based on the fund transaction event sequence and SMS behavior event sequence, time-series causal association pairs are constructed and causal confidence is quantified. Based on the causal confidence, time-series causal association pairs are aggregated and time-series causal features are generated.

[0015] The fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score, and temporal causal features are multimodally fused to obtain a multimodal fusion input feature vector, which is then input into a random forest model to obtain the victim risk probability. If the victim risk probability is not lower than a preset warning threshold, the corresponding fraud sub-category is obtained based on the primary fraud category label.

[0016] As a preferred embodiment of the present invention, the adversarial semantic reconstruction includes dual-channel similarity matching based on the Chinese character stroke order encoding channel and the Pinyin encoding channel, wherein the similarity expression for the Chinese character stroke order encoding channel is:

[0017]

[0018] In the formula, For the similarity of Chinese character stroke order, It is a variant word. For standard terms, The length of the longest common substring. This is the stroke feature vector of the variant word. The stroke feature vector of the standard word;

[0019] If the pinyin of the variant word is the same as that of the standard word, the pinyin similarity is 1; otherwise, it is 0.

[0020] If the similarity of the stroke order of the Chinese characters is not less than 0.8 or the similarity of the pinyin is 1, then the transformed word will be restored to the standard word.

[0021] As a preferred embodiment of the present invention, the step of constructing a fraud anomaly dictionary and calculating a weighted matching distance for each SMS message in the SMS event sequence to obtain fraud semantic similarity includes:

[0022] Based on a historically verified corpus of fraudulent text messages, the suspicious value of all terms is calculated, and the average value of all suspicious values ​​is calculated. Terms with suspicious values ​​greater than the average value are selected to construct a fraud anomaly dictionary.

[0023] The expression for calculating the suspicious value of a single term is as follows:

[0024]

[0025] In the formula, For a single term suspicious values, For a single term Document frequency in the corpus of fraudulent text messages, This represents the total number of SMS documents in the fraudulent SMS corpus. To include terms in the fraudulent text message corpus The total number of text messages, To iterate through the corpus of fraudulent text messages, For terms Word2Vec word vectors, For including terms The The semantic vector of a fraudulent text message. The total number of documents in the corpus, including both fraudulent and legitimate text messages. The total corpus includes terms The total number of documents, This is a collection of fraudulent text message corpora.

[0026] The weighted matching distance of each SMS message in the SMS event sequence is calculated based on the constructed fraud anomaly dictionary, expressed as:

[0027]

[0028] In the formula, For weighted matching distance, The text message to be tested. For the fraud anomaly dictionary, the first The weight of each term, The semantic vector of the SMS message to be tested and the first element in the fraud anomaly dictionary. The cosine distance between the semantic vectors of each term. The semantic vector of the SMS message to be tested. For the fraud anomaly dictionary, the first The semantic vector of each term. This is the length balance factor;

[0029] The average of all weighted matching distances is taken as the semantic similarity for fraud.

[0030] As a preferred embodiment of the present invention, the step of extracting a core summary from each text message and then performing unsupervised clustering to obtain a primary fraud category label includes:

[0031] The overall fraud risk score for each text message is calculated using the following expression:

[0032]

[0033] In the formula, For the first The overall risk score of each text message involving fraud. and These are preset weight hyperparameters. The sum of term frequency-inverse document frequency scores for all terms. For the first A text message, SMS semantic vector The dictionary of fraud anomalies semantic vector of each term Cosine similarity between them This is a dictionary of fraudulent activities. This represents the total number of entries in the fraud anomaly dictionary.

[0034] All text messages were ranked based on their overall risk of being suspected of fraud, and the top-ranked messages were selected. The SMS messages corresponding to the comprehensive fraud risk scores are concatenated into a core summary and input into a Chinese pre-trained language model based on the BERT architecture to generate a core summary semantic vector. The core summary semantic vector is then used to obtain cluster labels through an unsupervised density clustering algorithm, and the cluster labels are mapped to primary fraud category labels.

[0035] As a preferred embodiment of the present invention, the step of identifying transactional SMS messages from the SMS event sequence, parsing the structured transaction elements of the transactional SMS messages, generating a fund transaction event sequence and an SMS behavior event sequence; and constructing a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence, including:

[0036] A hybrid rule engine and a Chinese Transformer distillation model are used to identify transactional SMS messages from SMS event sequences. After extracting structured transaction elements through regular expressions, noise is filtered to generate fund transaction event sequences and SMS behavior event sequences.

[0037] The structured transaction elements include transaction direction, transaction amount, counterparty account, payment channel, verification code identifier, loan identifier, and quick payment activation identifier;

[0038] The multi-scale fund movement behavior feature vector includes: the maximum transfer frequency within any 3 hours, the number and percentage of adjacent transfers with an interval of no more than 3 minutes, the number of SMS messages activated for quick payment within any 3 hours, the percentage of outgoing amounts from 10 PM to 6 AM the previous day, whether the last amount of a single day or case cycle is greater than the sum of all previous single amounts, the length of the longest monotonically increasing subsequence of transfer amounts, the number and percentage of outgoing amounts that are integers, the coefficient of variation of the maximum single outgoing amount for D consecutive days, the number of accounts that do not receive duplicate payments on a single day, and the cumulative number of accounts that do not receive duplicate payments across 3 days.

[0039] As a preferred embodiment of the present invention, the construction and dynamic updating of a fraud-related topic knowledge base includes multiple fraud-related channel entries. All fraud-related channel entries are managed for inclusion in the database based on fraud confidence levels, including:

[0040] A knowledge base on fraud is constructed based on historically verified fraud case data, including loan app databases, quick payment contract databases, and social app databases. Each database contains multiple fraud-related channel entries, and each fraud-related channel entry includes at least a standard channel name, semantic vector, and risk Gini coefficient. The database is managed based on fraud confidence levels, calculated using the following expression:

[0041]

[0042] In the formula, For indicator functions, For the level of confidence in the alleged fraud, For the purpose of mentioning the case, Score the comments.

[0043] As a preferred embodiment of the present invention, the step of extracting payment channels based on the transactional SMS and structured transaction elements, matching the payment channels with a fraud-related knowledge base, and calculating a user's payment channel risk matching score includes:

[0044] Based on the transactional SMS messages and structured transaction elements, payment channels are extracted. These payment channels are then mapped to the fraud-related knowledge base using semantic vectors, and a user's payment channel risk matching score is calculated. The expression is as follows:

[0045]

[0046] In the formula, Assign a risk score to the user's payment channel. This is a collection of all fraud-related channel entries in the fraud-related knowledge base. The index variable is used to iterate through the set of all fraudulent channel entries. and These are the semantic matching weight hyperparameter and the risk Gini coefficient weight hyperparameter, respectively. semantic vector for user payment channel The first in the fraud-related knowledge base Semantic vectors of each fraudulent channel entry The cosine distance between them The first in the fraud-related knowledge base The risk Gini coefficient of each fraudulent channel entry.

[0047] As a preferred embodiment of the present invention, the step of constructing time-series causal association pairs and quantifying causal confidence based on the fund transaction event sequence and SMS behavior event sequence, aggregating time-series causal association pairs based on causal confidence, and generating time-series causal features includes:

[0048] Based on the aforementioned fund transaction event sequence and SMS behavior event sequence, each fund transaction event in the fund transaction event sequence is traversed, and all SMS behavior events on the timeline that occur within 3 hours before the initiation time of each fund transaction event and whose reception time is earlier than the initiation time of the fund transaction event are located. If the sending code in the SMS behavior event does not match the whitelist, the fraud semantic similarity is greater than 0.3, or the content of the SMS behavior event includes at least one of verification code identifier, loan identifier, and quick payment activation identifier, then the fund transaction event and the corresponding SMS behavior event constitute a temporal causal association pair. The causal confidence of the temporal causal association pair is calculated, expressed as:

[0049]

[0050] In the formula, The causal confidence level of time-series causal relationships. For fund movement events in a time-series causal relationship pair. For SMS behavior events in a time-series causal relationship pair, The time interval sensitivity weight hyperparameter, For sensitive SMS gain weight hyperparameter, The baseline penalty weight hyperparameter for user behavior. This is the time interval between receiving the SMS message and initiating the transfer. This is a function that indicates fraud-related sensitive information in SMS behavior events. For users Historical baseline values ​​for fund movement statistics;

[0051] When the causal confidence of the time-series causal association pair is not less than 0.6, the time-series causal association pair is statistically aggregated to obtain the time-series causal features; the time-series causal features include: the total number of causal pairs, the average causal confidence, the minimum causal interval, the proportion of sensitive SMS triggers, and the causal chain complexity.

[0052] As a preferred embodiment of the present invention, the fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score, and temporal causal features are fused in a multimodal manner to obtain a multimodal fusion input feature vector, which is then input into a random forest model to obtain the victim risk probability. If the victim risk probability is not lower than a preset warning threshold, then based on the primary fraud category label, the corresponding fraud sub-category is obtained, including:

[0053] The expression for calculating the victim risk probability is:

[0054]

[0055] In the formula, For the probability of victim risk, This represents the total number of decision subtrees in the random forest model. In the random forest model, the first Decision subtree, The input feature vector is used for multimodal fusion.

[0056] The final fraud category confidence vector is calculated using a weighted voting mechanism, expressed as follows:

[0057]

[0058] In the formula, This is the confidence vector for the final fraud category judgment. It is a one-hot encoding function. This is a basic scam category tag. Fraud categories matched to the fraud-related knowledge base;

[0059] The maximum value of the final fraud category decision confidence vector is taken as the fraud sub-category.

[0060] A fraud victim identification system based on multimodal feature fusion includes:

[0061] The preprocessing and semantic restoration module is used to acquire the raw SMS data to be processed and preprocess it. It performs adversarial semantic restoration and noise filtering on the preprocessed raw SMS data to obtain a standardized SMS event sequence.

[0062] The fraud semantic computation and summary clustering module is used to construct a fraud anomaly dictionary and calculate the weighted matching distance for each SMS in the SMS event sequence to obtain fraud semantic similarity; after extracting the core summary of each SMS, unsupervised clustering is performed to obtain the primary fraud category label;

[0063] The transaction element parsing and extraction module is used to identify transactional SMS messages from the SMS event sequence, parse the structured transaction elements of the transactional SMS messages, generate a fund transaction event sequence and an SMS behavior event sequence; and construct a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence.

[0064] The fraud-related topic database matching module is used to build and dynamically update the fraud-related topic knowledge base. The fraud-related topic knowledge base includes multiple fraud-related channel entries. All fraud-related channel entries are managed by entering them into the database based on fraud confidence levels. The payment channel is extracted based on the transactional SMS and structured account activity elements. The payment channel is matched with the fraud-related topic knowledge base to calculate the user's payment channel risk matching score.

[0065] The temporal causal analysis module is used to construct temporal causal association pairs and quantify causal confidence based on the fund transaction event sequence and SMS behavior event sequence, aggregate temporal causal association pairs based on causal confidence, and generate temporal causal features.

[0066] The multimodal fusion identification and early warning output module is used to perform multimodal fusion of the fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score and temporal causal features to obtain a multimodal fusion input feature vector, and input it into the random forest model to obtain the victim risk probability; if the victim risk probability is not lower than the preset early warning threshold, the corresponding fraud sub-category is obtained based on the primary fraud category label.

[0067] The beneficial effects of this invention are as follows: First, it breaks through the bottleneck of adversarial text recognition for fraudulent activities. By employing a dual-channel similarity matching algorithm combining Chinese character stroke order encoding and Pinyin encoding, it completes adversarial semantic reconstruction, effectively cracking the identification evasion techniques used by fraudsters, such as homophone substitution and confusion of similar-looking characters. Combined with weighted matching distance calculation using a fraud anomaly dictionary, it significantly improves the recall and accuracy of semantic recognition for fraudulent text, addressing the core shortcomings of traditional keyword filtering methods. Second, it achieves generalized risk perception of new fraudulent channels by constructing a dynamically iterative fraud-related thematic knowledge base. Through semantic vector matching, it achieves zero-sample risk perception of new fraudulent channels, adapting to the rapid iteration of fraudulent methods without relying on a fixed blacklist. Simultaneously, it constructs multi-scale feature vectors of fund movement behavior, supplementing the full-dimensional quantitative characterization of fraudulent fund behavior. Finally, the temporal causal logic chain of fraudulent behavior is completed. By constructing and quantifying causal confidence through temporal causal association, the manipulation relationship between SMS inducement and abnormal transfer is accurately characterized, providing interpretable causal evidence for risk judgment. Finally, risk quantification is completed through multimodal feature fusion and an interpretable random forest model. With SMS data as the only data source, there is no need to connect to multiple external systems, which greatly reduces the deployment threshold and provides standardized decision-making basis for anti-fraud handling, adapting to various anti-fraud business scenarios. Attached Figure Description

[0068] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0069] Figure 1 This is a flowchart of a fraud victim identification method based on multimodal feature fusion in an embodiment of the present invention;

[0070] Figure 2 This is a structural diagram of a fraud victim identification system based on multimodal feature fusion in an embodiment of the present invention. Detailed Implementation

[0071] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0072] like Figure 1 As shown, this is an embodiment of the present invention, which provides a method for identifying fraud victims based on multimodal feature fusion, including:

[0073] S1. Obtain the raw SMS data to be processed and preprocess it. Perform adversarial semantic restoration and noise filtering on the preprocessed raw SMS data to obtain a standardized SMS event sequence.

[0074] In this embodiment, the adversarial semantic reconstruction includes dual-channel similarity matching based on the Chinese character stroke order encoding channel and the Pinyin encoding channel, wherein the similarity expression for the Chinese character stroke order encoding channel is:

[0075]

[0076] In the formula, For the similarity of Chinese character stroke order, It is a variant word. For standard terms, The length of the longest common substring. This is the stroke feature vector of the variant word. This is the stroke feature vector of the standard word.

[0077] If the pinyin of the variant word is the same as that of the standard word, the pinyin similarity is 1; otherwise, it is 0.

[0078] If the similarity of the stroke order of the Chinese characters is not less than 0.8 or the similarity of the pinyin is 1, then the transformed word will be restored to the standard word.

[0079] Specifically, the process involves acquiring all raw SMS data from the target user within a preset time window and validating core fields such as the user's unique identifier, SMS reception timestamp accurate to the second, sender's code, and SMS text content. Invalid SMS records with missing fields or garbled content are removed. All SMS text content is uniformly converted to UTF-8 encoding, standardizing full-width or half-width characters, such as numbers, letters, and punctuation. Leading and trailing whitespace, invisible control characters, and redundant line breaks are removed to eliminate processing interference caused by format differences. Meaningless repetitive and redundant characters and invalid interference symbols in the SMS text content are removed, preserving the original semantic order of the text. Sentence segmentation of the SMS text content is completed, providing a standardized text foundation for subsequent word segmentation and semantic restoration. Based on the user's unique identifier and SMS reception timestamp accurate to the second, the user's valid SMS records are sorted in ascending order by time to generate an initial ordered SMS event sequence, completing the basic preprocessing workflow.

[0080] Based on a historically verified corpus of fraudulent text messages, high-frequency fraudulent standard words are extracted to form a reconstruction benchmark lexicon. Following the basic rules of GB / T 16159 Hanyu Pinyin Orthography, toneless Pinyin encoding strings are generated for each standard word in the reconstruction benchmark lexicon, forming a standard word-Pinyin string mapping library. Based on the GB13000.1 character set Chinese character stroke order standard, the basic stroke encoding sequence Φ={1: horizontal, 2: vertical, 3: left-falling stroke, 4: dot / right-falling stroke, 5: turning stroke} is defined. For each standard word in the reconstruction benchmark lexicon, the individual characters are decomposed into corresponding basic stroke encoding sequences, generating single-character stroke feature vectors. These vectors are then concatenated according to word order to form the stroke feature vector of the standard word, ultimately forming a standard word-stroke feature vector mapping library.

[0081] The initial ordered sequence of SMS events is segmented into words; after filtering out general whitelist words, such as official terms of government affairs, banking, and telecom operators, as well as general words, the stroke feature vectors of the variant words to be matched are generated.

[0082] For a single variant word, a toneless pinyin string is generated and fully matched with the pinyin string of the standard word. If the two pinyin strings are completely identical, the pinyin similarity is 1; otherwise, the pinyin similarity is 0. The stroke order similarity is calculated using an expression for Chinese character stroke order similarity. If a variant word meets either the condition of a stroke order similarity of 0.8 or a pinyin similarity of 1, it is determined to be an adversarial variant of the corresponding standard word, and the variant word is restored to the standard word. Variant words that do not meet the conditions retain their original text. After restoring all variant words, a whitelist noise filter is used to remove normal SMS messages without fraud risk or transaction elements, ultimately generating a standardized SMS event sequence.

[0083] S2. Construct a fraud anomaly dictionary and calculate the weighted matching distance for each SMS message in the SMS event sequence to obtain the fraud semantic similarity; after extracting the core summary of each SMS message, perform unsupervised clustering to obtain the primary fraud category label.

[0084] In this embodiment, the construction of a fraud anomaly dictionary and the calculation of a weighted matching distance for each SMS message in the SMS event sequence to obtain fraud semantic similarity include:

[0085] Based on a historically verified corpus of fraudulent text messages, the suspicious value of all terms is calculated, and the average value of all suspicious values ​​is calculated. Terms with suspicious values ​​greater than the average value are selected to construct a fraud anomaly dictionary.

[0086] The expression for calculating the suspicious value of a single term is as follows:

[0087]

[0088] In the formula, For a single term suspicious values, For a single term Document frequency in the corpus of fraudulent text messages, This represents the total number of SMS documents in the fraudulent SMS corpus. To include terms in the fraudulent text message corpus The total number of text messages, To iterate through the corpus of fraudulent text messages, For terms Word2Vec word vectors, For including terms The The semantic vector of a fraudulent text message. The total number of documents in the corpus, including both fraudulent and legitimate text messages. The total corpus includes terms The total number of documents, This is a collection of fraudulent text message corpora.

[0089] The weighted matching distance of each SMS message in the SMS event sequence is calculated based on the constructed fraud anomaly dictionary, expressed as:

[0090]

[0091] In the formula, For weighted matching distance, The text message to be tested. For the fraud anomaly dictionary, the first The weight of each term, The semantic vector of the SMS message to be tested and the first element in the fraud anomaly dictionary. The cosine distance between the semantic vectors of each term. The semantic vector of the SMS message to be tested. For the fraud anomaly dictionary, the first The semantic vector of each term. This is the length balance factor.

[0092] The weighted matching distance is used to measure the semantic matching degree between the SMS message and the fraud anomaly dictionary. The SMS message to be tested is obtained from a standardized SMS event sequence, and the SMS message in the fraud anomaly dictionary is the first one. The weight of the term and the fraud anomaly dictionary in the first term The semantic vectors of each term were retrieved from the fraud anomaly dictionary.

[0093] The average of all weighted matching distances is taken as the semantic similarity for fraud.

[0094] Specifically, the historically verified fraudulent SMS corpus is a collection of verified real fraudulent SMS texts, with each SMS being an independent document; the total corpus includes a historically verified fraudulent SMS corpus by the anti-fraud department and a normal SMS corpus; standardized preprocessing is performed on the total corpus, including: word segmentation based on Chinese word segmentation tools, filtering stop words, meaningless special symbols, and noisy text.

[0095] Unsupervised pre-training was performed on the pre-processed corpus based on the Word2Vec model. Hyperparameters such as fixed vector dimension and sliding window were set to generate fixed-dimensional Word2Vec word vectors for each valid word. For each pre-processed SMS message, mean pooling was performed on the Word2Vec word vectors of all valid words in the message to generate fixed-dimensional semantic vectors for the corresponding SMS message, ensuring that subsequent calculations are performed in a unified vector space.

[0096] The length balance factor is used to eliminate the interference of SMS length differences on matching results. It is calculated by a normalization function of the length of the SMS to be tested and the length of the fraud anomaly dictionary entries, and outputs the normalized balance coefficient to avoid matching bias between long and short sentences. The length balance factor is obtained through... The expression is:

[0097]

[0098] In the formula, is the short text length gain coefficient, a preset hyperparameter used to adjust the weight of the influence of the minimum length of SMS messages or terms on the length balance factor. is the length difference penalty coefficient, a preset hyperparameter used to adjust the penalty force of the length difference between the SMS message under test and the fraud anomaly dictionary entries on the length balance factor. The effective length of the text message to be tested. Let be the effective length of the t-th term in the fraud anomaly dictionary. It is an exponential function.

[0099] In this embodiment, the step of extracting a core summary from each text message and then performing unsupervised clustering to obtain a primary fraud category label includes:

[0100] The overall fraud risk score for each text message is calculated using the following expression:

[0101]

[0102] In the formula, For the first The overall risk score of each text message involving fraud. and These are preset weight hyperparameters. The sum of term frequency-inverse document frequency scores for all terms. For the first A text message, SMS semantic vector The dictionary of fraud anomalies semantic vector of each term Cosine similarity between them This is a dictionary of fraudulent activities. This represents the total number of entries in the fraud anomaly dictionary.

[0103] Among them, the The comprehensive score of the fraud risk of each text message is the core quantitative indicator, which measures the importance of the fraud-related semantics of the text message. The higher the score, the higher the density of core fraud-related information. The weight hyperparameters are the weight coefficients of TF-IDF statistical features and fraud-related semantic similarity features, and the sum of the two is 1.

[0104] All text messages were ranked based on their overall risk of being suspected of fraud, and the top-ranked messages were selected. The SMS messages corresponding to the comprehensive fraud risk scores are concatenated into a core summary and input into a Chinese pre-trained language model based on the BERT architecture to generate a core summary semantic vector. The core summary semantic vector is then used to obtain cluster labels through an unsupervised density clustering algorithm, and the cluster labels are mapped to primary fraud category labels.

[0105] Specifically, the fraud risk scores of each SMS message in the standardized SMS event sequence are sorted in descending order, and the top-ranked messages are selected. The SMS messages corresponding to the comprehensive fraud risk scores are concatenated chronologically to generate core summaries, where Z is a preset fixed threshold. The core summaries are input into a pre-trained Chinese language model based on the BERT architecture to generate core summary semantic vectors of fixed dimensions. An unsupervised clustering input dataset with uniform dimensions and consistent semantic space is constructed based on the full set of core summary semantic vectors. The DBSCAN unsupervised density clustering algorithm is used to perform clustering processing on the core summary semantic vectors, and the cluster labels corresponding to each core summary semantic vector are output. Based on the mapping relationship between the pre-constructed cluster labels and the standardized fraud categories in the fraud SMS corpus historically confirmed by the anti-fraud department, the corresponding primary fraud category labels are generated for each cluster label.

[0106] S3. Identify transactional SMS messages from the SMS event sequence, parse the structured transaction elements of the transactional SMS messages, generate a fund transaction event sequence and an SMS behavior event sequence; and construct a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence.

[0107] In this embodiment, a hybrid rule engine and a Chinese Transformer distillation model are used to identify transactional SMS messages from the SMS event sequence. After extracting structured transaction elements through regular expressions, noise filtering is performed to generate a fund transaction event sequence and an SMS behavior event sequence.

[0108] The structured transaction elements include transaction direction, transaction amount, counterparty account, payment channel, verification code identifier, loan identifier, and quick payment activation identifier;

[0109] The multi-scale fund movement behavior feature vector includes: the maximum transfer frequency within any 3 hours, the number and percentage of adjacent transfers with an interval of no more than 3 minutes, the number of SMS messages activated for quick payment within any 3 hours, the percentage of outgoing amounts from 10 PM to 6 AM the previous day, whether the last amount of a single day or case cycle is greater than the sum of all previous single amounts, the length of the longest monotonically increasing subsequence of transfer amounts, the number and percentage of outgoing amounts that are integers, the coefficient of variation of the maximum single outgoing amount for D consecutive days, the number of accounts that do not receive duplicate payments on a single day, and the cumulative number of accounts that do not receive duplicate payments across 3 days.

[0110] Specifically, based on a pre-built regular expression rule library of transaction-related keywords, the system matches core transaction identifiers in SMS messages, including transaction-related trigger words such as income, deposit, expenditure, payment, transfer, and consumption; permission-related trigger words such as verification code, activation, contract signing, loan approval, and loan disbursement; and amount-related identifiers such as ¥, yuan, and RMB. When an SMS message simultaneously matches transaction-related trigger words, permission-related trigger words, and corresponding amount-related identifiers, it is determined to be a transaction-related SMS message, and the main path recall is completed.

[0111] The Chinese Transformer distillation model is used as an auxiliary recall channel. The input features include signal code segment features, text length features, keyword hit density features, and fraud-related semantic similarity features. The model performs secondary discrimination on edge samples that are not recalled on the main path, supplementing the recall of transactional SMS messages that were missed, solving the problem of incomplete rule coverage, and improving the overall recall rate.

[0112] For identified transactional SMS messages, a preliminary filtering is performed using official number whitelists, such as those for bank customer service, telecom operators, and government services. Only SMS messages with characteristics of billing transactions, authorization activation, and fraudulent semantics are retained, while normal notification SMS messages that are purely for incoming payments and have no risk are removed, thus reducing the processing load.

[0113] Regular expressions are used to capture groups to extract transactional SMS messages and parse seven core structured transaction elements, realizing the conversion of unstructured text into standardized transaction data. The specific extraction logic for each structured transaction element is as follows:

[0114] 1. Transaction Direction: The text content of transaction-type SMS messages is captured by regular expressions. "Expenditure, transfer out, payment, consumption" in the text content is marked as outgoing, and "income, deposit, receipt, transfer in" is marked as deposit. Ambiguous scenarios are combined with contextual semantics and counterparty information for secondary verification to ensure accurate direction determination.

[0115] 2. Transaction Amount: Extract the text content of transaction SMS messages using regular expressions, such as the number strings before and after "¥, yuan, RMB". Supports thousands separator format and two decimal places. Normalize to floating-point number in yuan. At the same time, verify the validity of the amount value and remove abnormal and invalid values.

[0116] 3. Recipient Account or Merchant: Combining regular expression capture group matching of transaction SMS text content with NER entity recognition, extract entity information such as "last digits, recipient, and merchant" from the text content. With the assistance of a pre-built surname dictionary and merchant name database, entity boundary recognition is completed to accurately extract the recipient or payer account subject.

[0117] 4. Payment Channels: By using regular expressions to capture and match the text content and semantic mapping of transactional SMS messages, the names of UnionPay, NetsUnion, third-party payment platforms, and various bank apps in the text content are extracted and mapped to a standardized channel name system.

[0118] 5. Verification code identifier: Specifically a Boolean field, it uses regular expressions to capture and match the text content of transactional SMS messages, matching keywords such as "verification code", "dynamic code", and "verification code" in the text content. If a match is found, the keyword is marked as 1; otherwise, it is marked as 0.

[0119] 6. Loan Identifier: Specifically a Boolean field, it uses regular expressions to capture and match the text content of transactional SMS messages. It matches loan-related keywords such as "loan successful," "loan funds received," "credit limit approved," and "loan disbursement notification" in the text content. If a match is found, the loan-related keyword is marked as 1; otherwise, it is marked as 0.

[0120] 7. Quick Pay Activation Identifier: This is a Boolean field that uses regular expressions to capture and match the text content of transactional SMS messages. It matches keywords such as "activate quick pay," "signature successful," "bind bank card," and "authorize password-free payment" in the text content. If a match is found, the keyword is marked as 1; otherwise, it is marked as 0.

[0121] After extracting the structured transaction elements, multi-layer noise filtering is performed to remove interference from normal transaction behavior, specifically including:

[0122] First layer of noise filtering: normal transaction filtering; based on a pre-built normal transaction semantic template library, normal transaction SMS messages such as salary disbursement, credit card repayment, utility bill payment, and social security and housing provident fund deductions are removed.

[0123] The second layer of noise filtering: small-amount daily consumption filtering; daily consumption transactions with a single amount not exceeding 50 yuan and the receiving account being a compliant supermarket or food delivery platform are marked as non-risk transactions and are not included in the calculation of abnormal features.

[0124] The third layer of noise filtering: invalid data filtering; removing invalid SMS records with incomplete feature extraction, abnormal transaction amounts, or indeterminate transaction directions.

[0125] The final result is a sequence of fund transaction events and a sequence of SMS behavior events. The fund transaction event sequence uses a single fund transaction event as the smallest unit, and completes user-level data grouping based on the user's unique identifier. All fund transaction events within a single user group are sorted in ascending order according to the event occurrence timestamp accurate to the second. A single fund transaction event includes all standardized structured elements, including the direction of fund transaction, transaction amount, counterparty account information, and transaction occurrence timestamp, ultimately forming a fund transaction event sequence at the user level.

[0126] The SMS behavior event sequence uses a single SMS behavior event as the smallest unit, and completes user-level data grouping based on the user's unique identifier. All SMS behavior events within a single user group are sorted in ascending order according to the SMS reception timestamp accurate to the second. A single SMS behavior event includes the SMS reception timestamp accurate to the second, the SMS sender's number, structured transaction elements, and the fraud-related semantic similarity corresponding to the single SMS, ultimately forming an SMS behavior event sequence with user granularity.

[0127] This invention, based on the behavioral model of fraudulent fund manipulation, constructs a multi-scale feature vector of fund movement behavior with five dimensions and ten core indicators, covering the dimensions of minute-level burst characteristics, cross-day cumulative characteristics, time period preference characteristics, amount pattern and psychological manipulation characteristics, and counterparty dispersion characteristics; specifically including:

[0128] Minute-level burst characteristics include: maximum transfer frequency within any 3-hour period: using a 3-hour sliding window and a 15-minute step, the number of user withdrawal transactions within the sliding window is counted, and the maximum value within the entire observation period is taken;

[0129] Number and percentage of adjacent transfers with an interval of no more than 3 minutes: Count the number of transactions with an interval of no more than 3 minutes between adjacent outgoing transactions, and calculate the proportion of the total number of outgoing transactions in the entire observation period.

[0130] Number of SMS messages activated for quick payment within any 3-hour period: Using a 3-hour sliding window, count the total number of SMS messages with the quick payment activation flag set to 1 within the sliding window.

[0131] The cumulative feature dimension across days includes: calculating the coefficient of variation of the daily total amount paid out over D consecutive days, used to identify fraudulent order-brushing and cashback schemes. The expression is:

[0132]

[0133] In the formula, The coefficient of variation is a feature vector of multi-scale fund movement behavior. It is used to quantify the relative fluctuation of the daily outflow amount within the observation period and eliminate the interference of the difference in the magnitude of the amount on the fluctuation amplitude. The larger the value of the coefficient of variation, the more unstable the daily fund transfer behavior is and the higher the dispersion. This is the sample standard deviation function. The input is the set of daily outflow amounts within the observation period, and the output is the standard deviation of the daily amount, which measures the absolute fluctuation of the amount of funds transferred out. This is an arithmetic mean function. The input is the set of daily billing amounts within the observation period, and the output is the average of the daily amounts, which serves as a benchmark reference for the fluctuation range and is used to normalize the standard deviation into relative fluctuation. The cumulative outflow amount for the first day within the observation period is the sum of all outflow transactions on that day, which is obtained from the sequence of fund movement events. The cumulative outflow amount on day D within the observation period is the sum of all outflow transactions on that day, which is obtained from the sequence of fund movement events. The total number of days in the observation period, i.e., the length of the time window for calculating the daily billing amount, such as the case cycle, 7 days or 30 days, is preset by the business scenario.

[0134] The percentage of transfers that cannot be causally correlated with any non-whitelisted SMS message within the preceding 3 hours during the observation period is used to identify money laundering transfers that are completely unincentived by SMS messages and are solely controlled by the app.

[0135] The time period preference features include: the proportion of total billing amount that occurred between 10 PM the previous day and 6 AM the current day to the total billing amount for the whole day; and the number of days in which both verification code SMS messages were received and billing transactions occurred during the early morning hours.

[0136] The dimensions of monetary form and psychological manipulation characteristics include: Abnormal small amount identifier: Specifically, a Boolean value. If a user makes multiple outgoing transactions of the same amount to an unfamiliar account, the abnormal small amount identifier is marked as 1.

[0137] Whether the last amount of a single day or case cycle is greater than the sum of all previous single amounts: Specifically, it is a Boolean value. For a single day or case observation cycle, it determines whether the last amount of payment is greater than the sum of all previous single amounts of payment. If it is greater, the last amount of payment is marked as 1; otherwise, it is marked as 0.

[0138] Length of the longest monotonically increasing subsequence of transfer amount: For a time series of outgoing amounts on a single day or observation period, calculate the length of the longest monotonically increasing subsequence to quantify the behavioral characteristics of fraudsters' gradient-induced transfers.

[0139] Number and percentage of transactions with integer amounts: Count the number of transactions with integer amounts (tolerance ±0.01 yuan) and calculate the percentage of total transactions.

[0140] The dimensions of counterparty dispersion characteristics include: the number of unique receiving accounts in a single day or across 3 days: the total number of unique receiving accounts after deduplication by adding the last three digits of the mobile phone number to the account name in a single day or three consecutive days of transactions; used to identify money laundering behavior involving multiple accounts dispersing transfers.

[0141] S4. Construct and dynamically update a fraud-related topic knowledge base, which includes multiple fraud-related channel entries. All fraud-related channel entries are managed by entering them into the database based on fraud confidence levels. Based on the transactional SMS and structured transaction elements, payment channels are extracted and matched with the fraud-related topic knowledge base to calculate the user's payment channel risk matching score.

[0142] In this embodiment, a fraud-related knowledge base is constructed based on historically verified fraud case data, including a loan app database, a quick payment signing database, and a social app database. Each database includes multiple fraud-related channel entries, and each fraud-related channel entry includes at least a standard channel name, semantic vector, and risk Gini coefficient. The database is managed through fraud-related confidence levels, and the expression for calculating the fraud-related confidence level is as follows:

[0143]

[0144] In the formula, For indicator functions, For the level of confidence in the alleged fraud, For the purpose of mentioning the case, Score the comments.

[0145] Among them, the confidence level of fraud is in the range of [0,1]. The higher the value, the stronger the certainty of the fraud risk of the fraud channel entry. Case mention refers to whether the fraud channel entry appears in the victim's text messages and case files in the historical confirmed fraud case data. It is obtained by traversing and matching the entire historical case database. The comment score is the auxiliary soft evidence for the fraud risk determination. The value range is [0,1]. It is generated by calculating the proportion of fraud complaints and violation reports in user comment data crawled from the application market and then normalizing the data. The higher the proportion of fraud complaints, the higher the comment score.

[0146] Specifically, the fraud-related knowledge base adopts a vertical database architecture, including three sub-databases: a loan app database, a quick payment signing database, and a social app database. The loan app database corresponds to the fraud-induced download stage, the quick payment signing database corresponds to the illegal opening of payment permissions, and the social app database corresponds to the fraud-related traffic diversion and fund transfer stage.

[0147] The data sources for the fraud-related knowledge base are divided into two categories:

[0148] The first category is fraud identification data, which comes from historically confirmed fraud case data. Specifically, it includes the entity names of fraud-related channel entries extracted from the text messages of victims involved in the cases, as well as the judicial characterization information of the cases associated with the corresponding channels, fraud type distribution data, and historical case frequency information.

[0149] The second category is standardized public basic data, which is collected from the official disclosure channels of application platforms and payment institutions, including the full public information of the corresponding fraud-related channels. Specifically, it includes the standard official name of the fraud-related App or payment channel, application disclosure information, user reviews, and business registration information of the operating entity.

[0150] The two types of data are merged and verified to generate standardized fraud-related channel entries, which are then stored in the corresponding loan app database, quick payment signing database, and social app database.

[0151] Standardized attributes are generated for each fraudulent channel entry to achieve comprehensive risk characterization, specifically including:

[0152] Standard channel name: The original channel names are normalized, and adversarial deformation characters, homophone replacements and special interference symbols are removed to generate standard channel names;

[0153] Channel semantic vector: A Chinese pre-trained language model based on the BERT architecture is used to generate a fixed-dimensional channel semantic vector for the standard channel name. This is to ensure that the channel semantic vector is in the same vector space as the payment channel semantic vector extracted by the user later, and to provide a unified benchmark for cross-channel semantic matching.

[0154] The Gini coefficient is a core risk quantification attribute for fraud-related channel entries in the fraud-related knowledge base. It is calculated based on historically confirmed fraud case data associated with that channel entry. It quantifies the unevenness of the distribution of fraud case types associated with that channel entry, i.e., the purity and concentration of fraud risk. A Gini coefficient closer to 0 indicates a more even and dispersed distribution of fraud types associated with that channel entry, and a stronger generalized risk attribute. A Gini coefficient closer to 1 indicates a more concentrated distribution of fraud types associated with that channel entry, higher risk purity, and higher risk confidence. The expression is:

[0155]

[0156] In the formula, Let Gini coefficient be the risk factor for the kth fraudulent channel entry, with a value range of [0,1]. This refers to the total number of preset fraud types, such as the total number of identified fraud subcategories like fake loans, fake order rebates, and impersonating customer service. This fraudulent channel entry belongs to the category of [number] in historical fraud cases. The percentage of fraud cases of the same type.

[0157] Based on the confidence level of fraud, a tiered entry management mechanism is implemented. Specifically, for fraud-related channel entries with a confidence level greater than a preset threshold, they are automatically entered into the fraud-related knowledge base to complete the addition of fraud-related channel entries; for fraud-related channel entries with a confidence level in the critical range, they are manually reviewed, and a decision is made on whether to enter them into the fraud-related knowledge base after the manual review; fraud-related channel entries with low confidence levels are sent to a temporary observation database, and the confidence level of fraud is recalculated after updating the data according to a preset period.

[0158] Establish a fixed-cycle iterative update process. Based on the historically confirmed fraud case data and newly crawled user review data from app stores added synchronously in the preset cycle, recalculate the fraud confidence level and risk Gini coefficient of the existing fraud-related channel entries, complete the information update, risk level adjustment and removal of fraud-related channel entries, and continuously add new fraud-related channel entries to ensure the timeliness and coverage of the fraud-related knowledge base.

[0159] In this embodiment, the payment channel is extracted based on the transactional SMS and structured transaction elements. The payment channel is then mapped to the fraud-related knowledge base using semantic vectors, and a risk matching score for the user's payment channel is calculated. The expression is as follows:

[0160]

[0161] In the formula, Assign a risk score to the user's payment channel. This is a collection of all fraud-related channel entries in the fraud-related knowledge base. The index variable is used to iterate through the set of all fraudulent channel entries. and These are the semantic matching weight hyperparameter and the risk Gini coefficient weight hyperparameter, respectively. semantic vector for user payment channel The first in the fraud-related knowledge base Semantic vectors of each fraudulent channel entry The cosine distance between them The first in the fraud-related knowledge base The risk Gini coefficient of each fraudulent channel entry.

[0162] Among them, the user payment channel risk matching score ranges from [0,1]. The higher the value, the higher the matching degree between the user's payment channel entity and the high-risk fraud-related channel entries in the fraud-related knowledge base, and the stronger the fraud risk attribute. The semantic matching weight hyperparameter is a preset fixed weight value used to adjust the contribution ratio of semantic similarity matching items in the risk-weighted distance calculation. The risk Gini coefficient weight hyperparameter is a preset fixed weight value used to adjust the contribution ratio of the fraud-related channel risk purity item in the risk-weighted distance calculation. The user payment channel semantic vector is a fixed-dimensional semantic vector generated by encoding the standard name text of the payment channel extracted from the user side through a Chinese pre-trained language model based on the BERT architecture. The fraud-related knowledge base contains the first... The semantic vector of each fraud-related channel entry is a fixed-dimensional semantic encoding vector pre-generated by a Chinese pre-trained language model based on the BERT architecture before a single fraud-related channel entry is added to the fraud-related knowledge base.

[0163] Specifically, from the structured transaction data, all payment channel entities involved by the user within a preset observation period are extracted. These payment channel entities include third-party payment platforms, loan applications, quick payment contracting entities, and social applications.

[0164] Perform standardized preprocessing on all extracted payment channel entities to remove interfering symbols, distorted characters, and homophonic substitutions from the name text of the payment channel entities, and generate standard name text for the payment channel.

[0165] A pre-trained Chinese language model based on the BERT architecture is used to perform semantic encoding on the standard name text of payment channels, generating fixed-dimensional semantic vectors for user payment channels. The semantic vectors of user payment channels are placed in the same semantic vector space as the semantic vectors of fraud-related channel entries in the fraud-related knowledge base, thus eliminating matching calculation errors caused by differences in semantic vector spaces.

[0166] The process iterates through all fraud-related channel entries in the fraud-related knowledge base, which includes all already-added fraud-related channel entries from the loan application library, quick payment signing library, and social application library. It then calculates the risk-weighted distance for all fraud-related channel entries in the fraud-related knowledge base. The expression for calculating the risk-weighted distance of a single fraud-related channel entry in the fraud-related knowledge base is as follows:

[0167]

[0168] In the formula, This calculates the risk-weighted distance for a single fraud-related channel entry in the fraud-related knowledge base. It then calculates the risk-weighted distance for all fraud-related channel entries within the knowledge base, generating a full set of risk-weighted distance results. Finally, it selects the lowest-valued risk-weighted distance from this set and inputs it into the user payment channel risk matching score calculation formula.

[0169] S5. Based on the fund transaction event sequence and SMS behavior event sequence, construct time-series causal association pairs and quantify causal confidence. Based on the causal confidence, aggregate the time-series causal association pairs and generate time-series causal features.

[0170] In this embodiment, based on the fund transaction event sequence and the SMS behavior event sequence, each fund transaction event in the fund transaction event sequence is traversed, and all SMS behavior events on the timeline that occur within 3 hours before the initiation time of each fund transaction event and whose reception time is earlier than the initiation time of the fund transaction event are located. If the sending code in the SMS behavior event does not match the whitelist, the fraud semantic similarity is greater than 0.3, or the content of the SMS behavior event includes at least one of verification code identifier, loan identifier, and quick payment activation identifier, then the fund transaction event and the corresponding SMS behavior event constitute a temporal causal association pair. The causal confidence of the temporal causal association pair is calculated, and the expression is:

[0171]

[0172] In the formula, The causal confidence level of time-series causal relationships. For fund movement events in a time-series causal relationship pair. For SMS behavior events in a time-series causal relationship pair, The time interval sensitivity weight hyperparameter, For sensitive SMS gain weight hyperparameter, The baseline penalty weight hyperparameter for user behavior. This is the time interval between receiving the SMS message and initiating the transfer. This is a function that indicates fraud-related sensitive information in SMS behavior events. For users The historical baseline value for fund movement statistics.

[0173] Among them, the causal confidence score of the time-series causal association pair ranges from (0,1). The higher the value, the stronger the causal influence of the SMS behavior event on the fund transaction event. The time interval sensitivity weight hyperparameter is a preset weight value used to adjust the contribution ratio of the time interval between the SMS behavior event and the fund transaction event to the causal confidence score. The larger the value, the stronger the impact of the time interval on the causal confidence score. The sensitive SMS gain weight hyperparameter is a preset weight value used to adjust the contribution ratio of fraudulent sensitive SMS to the causal confidence score. The larger the value, the stronger the increase in causal confidence score from fraudulent sensitive SMS. The user behavior baseline penalty weight hyperparameter is a preset weight value used to adjust the penalty attenuation ratio of the user's historical normal transfer behavior on the causal confidence score. The larger the value, the stronger the weakening effect of the user's daily normal transfer behavior on the causal confidence score. The time interval between the SMS reception time and the transfer initiation time is the difference between the SMS behavior event reception timestamp and the fund transaction event initiation timestamp in the time-series causal association pair, in minutes.

[0174] When the causal confidence of the time-series causal association pair is not less than 0.6, the time-series causal association pair is statistically aggregated to obtain the time-series causal features; the time-series causal features include: the total number of causal pairs, the average causal confidence, the minimum causal interval, the proportion of sensitive SMS triggers, and the causal chain complexity.

[0175] Specifically, after completing a full traversal of all fund transaction events, a candidate set of time-series causal relationship pairs is generated. Then, a causal confidence quantification for each single time-series causal relationship pair is performed using a Sigmoid-type nonlinear function; this includes:

[0176] The preset causal confidence threshold is 0.6. For each pair of time-series causal association pairs in the candidate set, a threshold judgment operation is performed: if the causal confidence of the time-series causal association pair is greater than or equal to 0.6, the time-series causal association pair is marked as a strong time-series causal association pair and included in the subsequent statistical aggregation range; if the causal confidence of the time-series causal association pair is less than 0.6, the time-series causal association pair is removed.

[0177] User-level statistical aggregation calculations are performed on all strong temporal causal pairs to generate 5-dimensional temporal causal features, specifically:

[0178] Total number of causal pairs: The total number of strong temporal causal relationships between the target user within the observation period;

[0179] Average Causal Confidence: The arithmetic mean of the causal confidence of all strong time-series causal association pairs for the target user;

[0180] Minimum causal interval: The minimum time interval between the SMS reception time and the transfer initiation time among all strong temporal causal pairs of the target user, in minutes;

[0181] Sensitive SMS Trigger Ratio: The proportion of strong temporal causal relationship pairs triggered by fraudulent sensitive SMS messages among all strong temporal causal relationship pairs of the target user;

[0182] Causal chain complexity: The maximum number of fund transaction events triggered by a single SMS event among all strong temporal causal relationships of the target user.

[0183] S6. Multimodal fusion of the fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score and temporal causal features is performed to obtain a multimodal fusion input feature vector, which is then input into a random forest model to obtain the victim risk probability. If the victim risk probability is not lower than a preset warning threshold, the corresponding fraud sub-category is obtained based on the primary fraud category label.

[0184] In this embodiment, the expression for calculating the victim's risk probability is:

[0185]

[0186] In the formula, For the probability of victim risk, This represents the total number of decision subtrees in the random forest model. In the random forest model, the first Decision subtree, This is the input feature vector for multimodal fusion.

[0187] The victim risk probability ranges from [0,1], with higher values ​​indicating a higher risk level for the target user to be a victim of fraud; the total number of decision subtrees in the random forest model is a fixed hyperparameter.

[0188] The final fraud category confidence vector is calculated using a weighted voting mechanism, expressed as follows:

[0189]

[0190] In the formula, This is the confidence vector for the final fraud category judgment. It is a one-hot encoding function. This is a basic scam category tag. Fraud categories matched to the fraud-related knowledge base.

[0191] The final fraud category judgment confidence vector is a one-dimensional vector with the same dimension as the total number of preset fraud types. The value at each position in the vector corresponds to the judgment confidence of the fraud category. The higher the value, the stronger the confidence that the fraud type corresponding to the target user belongs to that category. The fraud category matched by the fraud-related knowledge base is a discrete category label output by the fraud-related knowledge base matching process. It is also the mainstream fraud type in historical cases corresponding to the highest risk fraud channel entry matched by the target user.

[0192] The maximum value of the final fraud category decision confidence vector is taken as the fraud sub-category.

[0193] Specifically, the fraud semantic similarity, multi-scale fund transaction behavior feature vector, user payment channel risk matching score, and temporal causal features are subjected to min-max normalization processing, and all values ​​are uniformly mapped to the [0,1] interval to eliminate the interference of differences in the scale of different features and differences in the numerical intervals on subsequent calculations.

[0194] The normalized fraud semantic similarity, multi-scale fund transaction behavior feature vector, user payment channel risk matching score, and temporal causal features are concatenated in a preset fixed order to generate a multimodal fusion input feature vector.

[0195] The random forest model employed is a supervised learning binary classification model built upon positive samples of fraud victims confirmed by anti-fraud departments over a consecutive three-month period and negative samples of normal users during the same period. The training dataset for this model has a 1:4 ratio of positive to negative fraud victim samples, exhibiting an imbalance problem. Therefore, a synthetic minority oversampling technique is used to oversample the minority class of positive fraud victim samples to balance the sample distribution and eliminate decision bias caused by the imbalance. The trained random forest model consists of a fixed number of decision subtrees and outputs the Gini feature importance index for each feature dimension in the multimodal fusion input feature vector, quantifying the contribution of each feature dimension in the multimodal fusion input feature vector to the risk judgment of fraud victims.

[0196] The multimodal fusion input feature vector is fed into the trained random forest model, and the victim risk probability of the target user is calculated based on the voting results of all decision subtrees within the random forest model.

[0197] Based on the fraud category matching between the primary fraud category tags and the fraud-related knowledge base, a weighted voting mechanism is used to calculate the fraud category decision confidence vector. The fraud category corresponding to the maximum value in the fraud category decision confidence vector is taken as the fraud sub-category for the target user.

[0198] The preset warning threshold is used to determine the risk probability of the victim: if the risk probability of the victim is greater than or equal to the preset warning threshold, an anti-fraud warning is triggered; if the risk probability of the victim is less than the preset warning threshold, the target user is determined to be a normal user and no anti-fraud warning is triggered.

[0199] Once an anti-fraud alert is triggered, structured alert information is output. This information includes the target user's unique identifier, the victim's risk probability, the specific category of fraud, the level of fraud risk, and evidence of core risk characteristics, providing standardized and interpretable decision-making basis for anti-fraud handling.

[0200] like Figure 2 As shown, this is the second embodiment of the present invention, which provides a fraud victim identification system based on multimodal feature fusion, including:

[0201] The preprocessing and semantic restoration module is used to acquire the raw SMS data to be processed and preprocess it. It performs adversarial semantic restoration and noise filtering on the preprocessed raw SMS data to obtain a standardized SMS event sequence.

[0202] The fraud semantic computation and summary clustering module is used to construct a fraud anomaly dictionary and calculate the weighted matching distance for each SMS in the SMS event sequence to obtain fraud semantic similarity; after extracting the core summary of each SMS, unsupervised clustering is performed to obtain the primary fraud category label;

[0203] The transaction element parsing and extraction module is used to identify transactional SMS messages from SMS event sequences, parse the structured transaction elements of transactional SMS messages, generate a fund transaction event sequence and an SMS behavior event sequence; and construct a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence.

[0204] The fraud-related topic database matching module is used to build and dynamically update the fraud-related topic knowledge base. The fraud-related topic knowledge base includes multiple fraud-related channel entries. All fraud-related channel entries are managed by entering them into the database based on fraud confidence levels. The payment channel is extracted based on the transactional SMS and structured account activity elements. The payment channel is matched with the fraud-related topic knowledge base to calculate the user's payment channel risk matching score.

[0205] The temporal causal analysis module is used to construct temporal causal association pairs and quantify causal confidence based on the fund transaction event sequence and SMS behavior event sequence, aggregate temporal causal association pairs based on causal confidence, and generate temporal causal features.

[0206] The multimodal fusion identification and early warning output module is used to perform multimodal fusion of the fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score and temporal causal features to obtain a multimodal fusion input feature vector, and input it into the random forest model to obtain the victim risk probability; if the victim risk probability is not lower than the preset early warning threshold, the corresponding fraud sub-category is obtained based on the primary fraud category label.

[0207] In summary, this invention firstly overcomes the bottleneck of adversarial text recognition by employing a dual-channel similarity matching algorithm based on Chinese character stroke order encoding and pinyin encoding. This accurately reconstructs adversarial variants such as homophone substitution and homonym confusion, effectively overcoming the shortcomings of traditional keyword filtering methods in modeling Chinese character features. This significantly improves the recall rate of fraudulent SMS identification and significantly reduces the false negative rate. Secondly, it achieves zero-sample risk perception of new fraudulent channels by constructing a dynamically updated fraud-related knowledge base. Through semantic vector matching, it quantifies the risk of payment channels, identifying variant and new fraudulent channels without relying on a fixed blacklist, greatly improving the generalization ability to unknown fraud patterns. Thirdly, it completes the temporal causal logic chain of fraudulent behavior, aligning SMS behavior events and fund transfer events with minute-level precision. This quantifies causal confidence and accurately identifies abnormal transfer behavior where victims are remotely controlled, providing core causal evidence for risk assessment. Finally, using SMS as the sole data source eliminates the need to connect to multiple external interfaces, significantly reducing system deployment costs. An interpretable random forest model is employed to fuse multimodal features, ensuring high recognition accuracy while providing traceable quantitative evidence for anti-fraud measures, making it suitable for various application scenarios such as telecom operators and anti-fraud centers.

[0208] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any other combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0209] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0210] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for identifying fraud victims based on multimodal feature fusion, characterized in that, include: The raw SMS data to be processed is obtained and preprocessed. The preprocessed raw SMS data is then subjected to adversarial semantic restoration and noise filtering to obtain a standardized SMS event sequence. A fraud anomaly dictionary is constructed, and a weighted matching distance is calculated for each SMS message in the SMS event sequence to obtain the fraud semantic similarity. After extracting the core summary of each SMS message, unsupervised clustering is performed to obtain the primary fraud category label. Identify transactional SMS messages from SMS event sequences, parse the structured transaction elements of the transactional SMS messages, generate a fund transaction event sequence and an SMS behavior event sequence; and construct a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence. A fraud-related knowledge base is constructed and dynamically updated. The knowledge base includes multiple fraud-related channel entries, and all fraud-related channel entries are managed by entering them into the database based on fraud confidence levels. Payment channels are extracted based on the transactional SMS and structured account activity elements, and the payment channels are matched with the fraud-related knowledge base to calculate the user's payment channel risk matching score. Based on the fund transaction event sequence and SMS behavior event sequence, time-series causal association pairs are constructed and causal confidence is quantified. Based on the causal confidence, time-series causal association pairs are aggregated and time-series causal features are generated. The fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score, and temporal causal features are multimodally fused to obtain a multimodal fusion input feature vector, which is then input into a random forest model to obtain the victim risk probability. If the victim risk probability is not lower than a preset warning threshold, the corresponding fraud sub-category is obtained based on the primary fraud category label.

2. The fraud victim identification method based on multimodal feature fusion according to claim 1, characterized in that, The adversarial semantic reconstruction includes dual-channel similarity matching based on the Chinese character stroke order encoding channel and the Pinyin encoding channel, wherein the similarity expression for the Chinese character stroke order encoding channel is: ； In the formula, For the similarity of Chinese character stroke order, It is a variant word. For standard terms, The length of the longest common substring. This is the stroke feature vector of the variant word. The stroke feature vector of the standard word; If the pinyin of the variant word is the same as that of the standard word, the pinyin similarity is 1; otherwise, it is 0. If the similarity of the stroke order of the Chinese characters is not less than 0.8 or the similarity of the pinyin is 1, then the transformed word will be restored to the standard word.

3. The fraud victim identification method based on multimodal feature fusion according to claim 1, characterized in that, The process of constructing a fraud anomaly dictionary and calculating a weighted matching distance for each SMS message in the SMS event sequence to obtain fraud semantic similarity includes: Based on a historically verified corpus of fraudulent text messages, the suspicious value of all terms is calculated, and the average value of all suspicious values ​​is calculated. Terms with suspicious values ​​greater than the average value are selected to construct a fraud anomaly dictionary. The expression for calculating the suspicious value of a single term is as follows: ； In the formula, For a single term suspicious values, For a single term Document frequency in the corpus of fraudulent text messages, This represents the total number of SMS documents in the fraudulent SMS corpus. To include terms in the fraudulent text message corpus The total number of text messages, To iterate through the corpus of fraudulent text messages, For terms Word2Vec word vectors, For including terms The The semantic vector of a fraudulent text message. The total number of documents in the corpus, including both fraudulent and legitimate text messages. The total corpus includes terms The total number of documents, This is a collection of fraudulent text message corpora. The weighted matching distance of each SMS message in the SMS event sequence is calculated based on the constructed fraud anomaly dictionary, expressed as: ； In the formula, For weighted matching distance, The text message to be tested. For the fraud anomaly dictionary, the first The weight of each term, The semantic vector of the SMS message to be tested. For the fraud anomaly dictionary, the first The semantic vector of each term. For length balance factor, The semantic vector of the SMS message to be tested and the first element in the fraud anomaly dictionary. The cosine distance between the semantic vectors of each term; The average of all weighted matching distances is taken as the semantic similarity for fraud.

4. The fraud victim identification method based on multimodal feature fusion according to claim 3, characterized in that, The process involves extracting a core summary from each text message and then performing unsupervised clustering to obtain primary fraud category labels, including: The overall fraud risk score for each text message is calculated using the following expression: ； In the formula, For the first The overall risk score of each text message involving fraud. and These are preset weight hyperparameters. The sum of term frequency-inverse document frequency scores for all terms. For the first A text message, SMS semantic vector The dictionary of fraud anomalies semantic vector of each term Cosine similarity between them This is a dictionary of fraudulent activities. This represents the total number of entries in the fraud anomaly dictionary. All text messages were ranked based on their overall risk of being suspected of fraud, and the top-ranked messages were selected. The SMS messages corresponding to the comprehensive fraud risk scores are concatenated into a core summary and input into a Chinese pre-trained language model based on the BERT architecture to generate a core summary semantic vector. The core summary semantic vector is then used to obtain cluster labels through an unsupervised density clustering algorithm, and the cluster labels are mapped to primary fraud category labels.

5. The fraud victim identification method based on multimodal feature fusion according to claim 4, characterized in that, The process involves identifying transactional SMS messages from SMS event sequences, parsing the structured transaction elements of the transactional SMS messages, and generating a fund transaction event sequence and an SMS behavior event sequence. Based on the aforementioned sequence of fund movement events, a multi-scale feature vector of fund movement behavior is constructed, including: A hybrid rule engine and a Chinese Transformer distillation model are used to identify transactional SMS messages from SMS event sequences. After extracting structured transaction elements through regular expressions, noise is filtered to generate fund transaction event sequences and SMS behavior event sequences. The structured transaction elements include transaction direction, transaction amount, counterparty account, payment channel, verification code identifier, loan identifier, and quick payment activation identifier; The multi-scale fund movement behavior feature vector includes: the maximum transfer frequency within any 3 hours, the number and percentage of adjacent transfers with an interval of no more than 3 minutes, the number of SMS messages activated for quick payment within any 3 hours, the percentage of outgoing amounts from 10 PM to 6 AM the previous day, whether the last amount of a single day or case cycle is greater than the sum of all previous single amounts, the length of the longest monotonically increasing subsequence of transfer amounts, the number and percentage of outgoing amounts that are integers, the coefficient of variation of the maximum single outgoing amount for D consecutive days, the number of accounts that do not receive duplicate payments on a single day, and the cumulative number of accounts that do not receive duplicate payments across 3 days.

6. The fraud victim identification method based on multimodal feature fusion according to claim 5, characterized in that, The aforementioned construction and dynamic updating of a fraud-related topic knowledge base includes multiple fraud-related channel entries. All fraud-related channel entries are managed and added to the database based on fraud confidence levels, including: A knowledge base on fraud is constructed based on historically verified fraud case data, including loan app databases, quick payment contract databases, and social app databases. Each database contains multiple fraud-related channel entries, and each fraud-related channel entry includes at least a standard channel name, semantic vector, and risk Gini coefficient. The database is managed based on fraud confidence levels, calculated using the following expression: ； In the formula, For indicator functions, For the level of confidence in the alleged fraud, For the purpose of mentioning the case, Score the comments.

7. The fraud victim identification method based on multimodal feature fusion according to claim 6, characterized in that, The process of extracting payment channels based on the transactional SMS messages and structured transaction data, matching these payment channels with a fraud-related knowledge base, and calculating a user's payment channel risk matching score includes: Based on the transactional SMS messages and structured transaction elements, payment channels are extracted. These payment channels are then mapped to the fraud-related knowledge base using semantic vectors, and a user's payment channel risk matching score is calculated. The expression is as follows: ； In the formula, Assign a risk score to the user's payment channel. This is a collection of all fraud-related channel entries in the fraud-related knowledge base. The index variable is used to iterate through the set of all fraudulent channel entries. and These are the semantic matching weight hyperparameter and the risk Gini coefficient weight hyperparameter, respectively. semantic vector for user payment channel The first in the fraud-related knowledge base Semantic vectors of each fraudulent channel entry The cosine distance between them The first in the fraud-related knowledge base The risk Gini coefficient of each fraudulent channel entry.

8. The fraud victim identification method based on multimodal feature fusion according to claim 7, characterized in that, Based on the sequence of fund transaction events and the sequence of SMS behavior events, a time-series causal relationship pair is constructed and the causal confidence level is quantified. Based on the causal confidence level, the time-series causal relationship pairs are aggregated, and time-series causal features are generated, including: Based on the aforementioned fund transaction event sequence and SMS behavior event sequence, each fund transaction event in the fund transaction event sequence is traversed, and all SMS behavior events on the timeline that occur within 3 hours before the initiation time of each fund transaction event and whose reception time is earlier than the initiation time of the fund transaction event are located. If the sending code in the SMS behavior event does not match the whitelist, the fraud semantic similarity is greater than 0.3, or the content of the SMS behavior event includes at least one of verification code identifier, loan identifier, and quick payment activation identifier, then the fund transaction event and the corresponding SMS behavior event constitute a temporal causal association pair. The causal confidence of the temporal causal association pair is calculated, expressed as: ； In the formula, The causal confidence level of time-series causal relationships. For fund movement events in a time-series causal relationship pair. For SMS behavior events in a time-series causal relationship pair, The time interval sensitivity weight hyperparameter, For sensitive SMS gain weight hyperparameter, The baseline penalty weight hyperparameter for user behavior. This is the time interval between receiving the SMS message and initiating the transfer. This is a function that indicates fraud-related sensitive information in SMS behavior events. For users Historical baseline values ​​for fund movement statistics; When the causal confidence of the time-series causal association pair is not less than 0.6, the time-series causal association pair is statistically aggregated to obtain the time-series causal features; the time-series causal features include: the total number of causal pairs, the average causal confidence, the minimum causal interval, the proportion of sensitive SMS triggers, and the causal chain complexity.

9. The fraud victim identification method based on multimodal feature fusion according to claim 8, characterized in that, The fraud semantic similarity, multi-scale fund transaction behavior feature vector, user payment channel risk matching score, and temporal causal features are fused in a multimodal manner to obtain a multimodal fusion input feature vector, which is then input into a random forest model to obtain the victim risk probability. If the victim's risk probability is not lower than a preset warning threshold, then based on the primary fraud category label, the corresponding fraud subcategories are obtained, including: The expression for calculating the victim risk probability is: ； In the formula, For the probability of victim risk, This represents the total number of decision subtrees in the random forest model. In the random forest model, the first Decision subtree, The input feature vector is used for multimodal fusion. The final fraud category confidence vector is calculated using a weighted voting mechanism, expressed as follows: ； In the formula, This is the confidence vector for the final fraud category judgment. It is a one-hot encoding function. This is a basic scam category tag. Fraud categories matched to the fraud-related knowledge base; The maximum value of the final fraud category decision confidence vector is taken as the fraud sub-category.

10. A fraud victim identification system based on multimodal feature fusion, employing the fraud victim identification method based on multimodal feature fusion as described in any one of claims 1 to 9, characterized in that, include: The preprocessing and semantic restoration module is used to acquire the raw SMS data to be processed and preprocess it. It performs adversarial semantic restoration and noise filtering on the preprocessed raw SMS data to obtain a standardized SMS event sequence. The fraud semantic computation and summary clustering module is used to construct a fraud anomaly dictionary and calculate the weighted matching distance for each SMS in the SMS event sequence to obtain fraud semantic similarity; after extracting the core summary of each SMS, unsupervised clustering is performed to obtain the primary fraud category label; The transaction element parsing and extraction module is used to identify transactional SMS messages from SMS event sequences, parse the structured transaction elements of transactional SMS messages, generate a fund transaction event sequence and an SMS behavior event sequence; and construct a multi-scale fund transaction behavior feature vector based on the fund transaction event sequence. The fraud-related topic database matching module is used to build and dynamically update the fraud-related topic knowledge base. The fraud-related topic knowledge base includes multiple fraud-related channel entries. All fraud-related channel entries are managed by entering them into the database based on fraud confidence levels. The payment channel is extracted based on the transactional SMS and structured account activity elements. The payment channel is matched with the fraud-related topic knowledge base to calculate the user's payment channel risk matching score. The temporal causal analysis module is used to construct temporal causal association pairs and quantify causal confidence based on the fund transaction event sequence and SMS behavior event sequence, aggregate temporal causal association pairs based on causal confidence, and generate temporal causal features. The multimodal fusion identification and early warning output module is used to perform multimodal fusion of the fraud semantic similarity, multi-scale fund flow behavior feature vector, user payment channel risk matching score and time-series causal features to obtain a multimodal fusion input feature vector, and input it into the random forest model to obtain the victim risk probability; If the risk probability of the victim is not lower than the preset warning threshold, then the corresponding fraud sub-category is obtained based on the primary fraud category label.

Images