Market penetration type abnormal group discovery method based on heterogeneous time sequence knowledge graph

Abstract

This invention discloses a market-penetrating abnormal group detection method based on heterogeneous temporal knowledge graphs. The method includes: constructing a multi-layered heterogeneous temporal knowledge graph comprising a subject layer, an event layer, and a feature layer; extracting subgraphs using violating subjects as seed nodes; constructing a representation learning model based on meta-relationships, generating node embeddings using a type-aware heterogeneous attention mechanism and a dynamic message passing mechanism incorporating relative temporal encoding; and applying a dynamic group evolution clustering algorithm to identify abnormal groups through core leader positioning, dynamic group assimilation, and risk assimilation iteration. This invention achieves joint modeling of heterogeneous relationships and the temporal dynamics of risk in the capital market, effectively penetrating complex relational networks and accurately detecting hidden abnormal groups.

Description

Technical Field

[0001] This invention relates to the fields of financial technology and artificial intelligence, specifically to a method for risk analysis, transmission path mining, and penetrating anomaly detection in the capital market by utilizing deep learning, natural language processing (NLP), and knowledge graph technologies, constructing a multi-layered heterogeneous temporal sequence knowledge graph, and applying a meta-relation representation learning model. Background Technology

[0002] The stable operation of the capital market is crucial to the healthy development of the national economy, and the effective identification and management of market risks are the core elements in maintaining its stability. Traditional risk analysis methods mainly rely on structured financial data (such as balance sheets and income statements) and statistical models (such as logistic regression and scoring card models). However, these traditional methods have significant limitations: on the one hand, they are difficult to comprehensively depict the complex relationships among various market participants (companies, individuals, and institutions) involving equity, guarantees, appointments, and transactions; on the other hand, they are difficult to capture the dynamic transmission process and temporal evolution of risk events among different participants and at different levels.

[0003] In recent years, knowledge graph technology has been introduced into the field of financial risk control. By constructing semantic networks of entities and relationships, it can intuitively display the overall picture of the market. However, existing knowledge graph applications in the capital market still face the following technical challenges when dealing with complex risk scenarios:

[0004] Limitations of a static perspective: Most knowledge graphs present a static network of connections at a specific point in time, capable of answering "who is related to whom," but struggling to simulate and predict how risks "evolve" and "transmit" over time. This prevents the system from understanding the temporal dependencies of risk events, such as the inability to identify causal chains where "event A occurred first, subsequently leading to event B."

[0005] Insufficient handling of data heterogeneity: The capital market comprises various types of entities, including listed companies, regulatory agencies, individual executives, laws and regulations, and risk events, as well as various types of relationships, such as equity, appointment, and violation triggers. Traditional graph computing models (such as standard GCN and GAT) typically treat all nodes and edges as homogeneous nodes and process them uniformly, ignoring the specific semantics of different types of entities and relationships. For example, the semantic weights and transmission patterns of edges between a company illegally lending funds to a subsidiary and a company issuing a positive announcement are completely different. Homogeneous processing will lose a lot of key information, leading to a decrease in model accuracy.

[0006] Model construction is complex and reliant on manual intervention: To simulate the dynamic evolution of risk, existing technologies often require domain experts to manually design complex meta-paths or rules. This is not only time-consuming and labor-intensive, relying on expert experience, but also difficult to adapt to the rapid changes in capital markets and novel, covert methods of violation.

[0007] Therefore, there is an urgent need for a new method that can learn automatically and simultaneously handle the heterogeneity and temporal dynamics of capital market networks, in order to achieve in-depth modeling and accurate prediction of risk evolution, and thus penetrate the surface to discover potential abnormally related groups. Summary of the Invention

[0008] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0009] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a penetrating method for detecting abnormal groups in the capital market based on heterogeneous temporal knowledge graphs. This invention constructs a multi-layered heterogeneous knowledge graph, combining the semantic understanding capabilities of Large Language Models (LLM) with the reasoning capabilities of Heterogeneous Graph Neural Networks (GNN), to achieve accurate characterization of the spatiotemporal features of risk events and to automatically identify hidden abnormal groups.

[0010] To achieve the above objectives, this invention provides the following technical solution: a market penetration-based abnormal group detection method based on heterogeneous temporal knowledge graphs, comprising the following steps: constructing a multi-layered heterogeneous temporal knowledge graph of the capital market: collecting multi-source heterogeneous data, and constructing a three-layered heterogeneous knowledge graph including a capital market subject layer, a risk event layer, and a risk feature layer through entity recognition, relation extraction, and time alignment techniques; risk feature extraction and group detection based on meta-relationships: extracting connected subgraphs from the knowledge graph using the violating subject as a seed node, constructing a meta-relationship heterogeneous graph model, generating node embeddings based on a type-aware heterogeneous attention mechanism and a dynamic message passing mechanism that integrates relative temporal coding, and clustering the node embeddings based on a dynamic group evolution clustering algorithm to identify abnormal groups.

[0011] As a preferred embodiment of the market penetration-based anomaly group detection method based on heterogeneous temporal knowledge graphs described in this invention, the method involves: constructing a multi-layered heterogeneous temporal knowledge graph of the capital market, specifically including: using a fine-tuned BERT-BiLSTM-CRF model in collaboration with a DeepSeek large model for entity extraction and relation extraction; specifically, for the risk event layer, candidate sub-events are first segmented based on a financial risk trigger word dictionary, and then the large model is called to perform semantic independence verification, implicit subject completion, and event boundary fine-tuning on the candidate sub-events according to a preset instruction set; relation extraction is performed by combining dependency syntax rules with the large model, and time-event precise alignment is performed based on character offsets and context inference from the large model, normalizing the time expression to the ISO8601 standard range to form an event chain with precise temporal sequence; the extracted nodes and edges are stored in a structured manner according to a unified schema to form a cross-layer fusion graph of the subject layer and the event layer.

[0012] As a preferred embodiment of the market penetration-based abnormal group detection method based on heterogeneous temporal knowledge graphs described in this invention, the construction of the risk feature layer specifically includes: cleaning and segmenting the risk event text; extracting key phrases using a multi-statistic weighted algorithm that integrates point mutual information (PMI), left and right entropy, and word frequency; reconstructing event paragraphs using Top-K high-scoring phrases; inputting the reconstructed text into the BERTopic framework for topic extraction; generating topic clusters using HDBSCAN clustering; and calling a large model combined with expert knowledge to summarize the topic clusters into standardized risk factors; constructing semantic vectors of risk factors and regulatory clauses; calculating cosine similarity and constructing a bipartite network; running the Leiden algorithm on the bipartite network for community detection; generating higher-level risk features; and labeling the cascading, coupling, and symbiotic relationships between factors.

[0013] As a preferred embodiment of the market penetration-based abnormal group discovery method based on heterogeneous temporal knowledge graphs described in this invention, the risk feature extraction and group discovery based on meta-relationships specifically includes: using the business-confirmed violating entities as seed nodes, performing multi-order neighborhood searches, and extracting the largest weakly connected subgraph as the analysis object; constructing a meta-relationship heterogeneous graph model, defining the meta-relationship as R=(τ(s),ϕ(e),τ(t)), where τ is the node type and ϕ is the edge type; stacking multiple layers of heterogeneous graph neural networks, aggregating the heterogeneous information of multi-hop neighbors, and outputting the deep context embedding representation of the nodes.

[0014] As a preferred embodiment of the market penetration-based anomaly group detection method based on heterogeneous temporal knowledge graphs described in this invention, the computation process of the type-aware heterogeneous attention mechanism includes: utilizing a matrix M bound to the type τ(t) of the target node t. Q τ(t) Map the features of t to the query vector Q. t; Utilizing the matrix M bound to the type τ(s) of neighboring nodes s K τ(s) Map the features of s to the key vector K. s ;Utilizing the attention matrix M bound to the type ϕ(e) of edge e A ϕ(e) Calculate the interaction score between the query vector and the key vector; normalize the score using the Softmax function to obtain the attention weight α. st .

[0015] As a preferred embodiment of the market penetration-based anomaly group detection method based on heterogeneous temporal knowledge graphs described in this invention, the dynamic message passing process integrating relative temporal coding includes: calculating the time difference Δt for a neighbor node s with timestamps and a target node t; and generating a relative temporal coding vector T based on Δt using a sine or cosine position coding function. rel ; T rel The original eigenvector V of the source node s s The data is fused to generate a value vector V containing fused temporal information. s Based on attention weight α st V of neighboring nodes s Perform a weighted summation and update the feature representation of the target node t.

[0016] As a preferred embodiment of the market penetration-based abnormal group discovery method based on heterogeneous temporal knowledge graphs described in this invention, the specific steps of the dynamic group evolution clustering algorithm include: core leader localization: calculating the centrality of nodes and selecting the node with the greatest influence as the initial group center; dynamic group assimilation: the remaining nodes iteratively select to join the group with the smallest distance based on the distance between their own embedding vector and the centroid embedding vectors of each group; group risk assimilation: after assimilation is completed, the node embedding vector is updated according to the group structure, so that the nodes move closer to the features of their neighboring nodes in the group; repeat the above steps until the group partitioning and node embedding converge.

[0017] This invention provides a market penetration-based method for detecting abnormal groups based on heterogeneous temporal knowledge graphs, which has the following beneficial effects:

[0018] Accurately characterizes heterogeneity: Independent transformation matrices are designed for different types of nodes (companies, individuals, events) and edges (appointment, guarantee, trigger), which can accurately capture different interaction patterns (such as the difference between "actual controllers" and "ordinary senior executives" in risk transmission), significantly improving modeling accuracy.

[0019] Achieving dynamic evolution modeling: By introducing a relative temporal coding mechanism, the model is no longer limited to static snapshot analysis, but can capture the order, interval and causal relationship of risk events, realizing a leap from "static correlation" to "dynamic evolution".

[0020] Automated learning and strong generalization ability: Adopting an end-to-end deep learning framework, it can automatically learn important risk transmission patterns from data without the need for manual design of complex meta-paths or rules, and has stronger adaptability and generalization ability.

[0021] Penetrating detection capability: Combining large-scale model semantic enhancement and dynamic group evolution algorithm, it can penetrate multiple layers of equity and personnel disguise to identify hidden abnormal related groups, providing strong technical support for penetrating supervision. Attached Figure Description

[0022] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0023] Figure 1 This is a flowchart illustrating the overall process of constructing the knowledge graph of the main layer in an embodiment of the present invention.

[0024] Figure 2 This is a flowchart illustrating the construction process of a time-based risk event layer according to an embodiment of the present invention.

[0025] Figure 3 The overall flowchart for constructing the risk feature layer knowledge graph in this embodiment of the invention is shown below.

[0026] Figure 4 This is a partial illustration of the risk feature layer knowledge graph according to an embodiment of the present invention.

[0027] Figure 5 This is an example diagram of a meta-relation triplet in an embodiment of the present invention.

[0028] Figure 6 This is a schematic diagram of the representation model architecture based on meta-relationships in an embodiment of the present invention.

[0029] Figure 7 This is a schematic diagram illustrating the visualization effect of subgraph extraction in an embodiment of the present invention.

[0030] Figure 8 This is a schematic diagram illustrating the visualization effect of graph clustering in an embodiment of the present invention. Detailed Implementation

[0031] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0032] The purpose of this invention is to overcome the shortcomings of existing technologies and provide a penetrating method for detecting abnormal groups in the capital market based on heterogeneous temporal knowledge graphs. This invention constructs a multi-layered heterogeneous knowledge graph, combining the semantic understanding capabilities of Large Language Models (LLM) with the reasoning capabilities of Heterogeneous Graph Neural Networks (GNN), to achieve accurate characterization of the spatiotemporal features of risk events and to automatically identify hidden abnormal groups.

[0033] In summary, the implementation process of this invention is as follows:

[0034] Step 1: Constructing a multi-layered heterogeneous temporal knowledge graph for the capital market. First, entity identification and relationship extraction are performed from multi-source heterogeneous data (such as financial news, company announcements, court documents, and regulatory documents). Three core layers are constructed: **Capital Market Entity Layer:** Nodes include regulatory agencies, listed companies, fund companies, and individual executives. Relationships include client relationships, guarantee relationships, control relationships, and advisory relationships. **Risk Event Layer:** Nodes include specific risk events (such as "Company XX violated disclosure regulations" or "Executives under investigation"), regulatory agencies, involved companies, and individuals. Relationships include participation, issuing penalties, control, and association. Each risk event node is associated with a timestamp. **Risk Feature Layer:** Nodes include risk events, risk factors, and laws and regulations. Relationships include cascading, coupling, symbiosis, and triggering. These three layers are coupled through entity association and feature mapping to form a large-scale, heterogeneous knowledge graph containing temporal information.

[0035] Specifically, this invention provides a market penetration-based abnormal group detection method based on heterogeneous temporal knowledge graphs, comprising the following steps:

[0036] Constructing a multi-layered heterogeneous time-series knowledge graph for the capital market: Collecting multi-source heterogeneous data and using entity recognition, relation extraction, and time alignment technologies, constructing a three-layered heterogeneous knowledge graph comprising a capital market entity layer, a risk event layer, and a risk characteristic layer;

[0037] Risk feature extraction and group discovery based on meta-relations: Connected subgraphs are extracted from the knowledge graph using violating entities as seed nodes to construct a meta-relation heterogeneous graph model. Node embeddings are generated based on a type-aware heterogeneous attention mechanism and a dynamic message passing mechanism that integrates relative temporal coding. The node embeddings are then clustered based on a dynamic group evolution clustering algorithm to identify abnormal groups.

[0038] Furthermore, a multi-layered heterogeneous temporal knowledge graph of the capital market is constructed, specifically including:

[0039] The fine-tuned BERT-BiLSTM-CRF model is used in conjunction with the DeepSeek large model for entity extraction and relation extraction. For the risk event layer, candidate sub-events are first segmented based on the financial risk trigger word dictionary, and then the large model is called to perform semantic independence verification, implicit subject completion and event boundary fine-tuning of the candidate sub-events according to the preset instruction set.

[0040] By combining dependency syntax rules with the large model to extract relations, and by performing precise time-event alignment based on character offsets and context inference from the large model, the time expression is normalized to the ISO8601 standard range, forming an event chain with precise time sequence.

[0041] The extracted nodes and edges are stored in a structured manner according to a unified schema, forming a cross-layer fusion graph of the main layer and the event layer.

[0042] Furthermore, the construction of the risk characteristic layer specifically includes:

[0043] The risk event text is cleaned and segmented. A multi-statistic weighted algorithm that combines Point Mutual Information (PMI), left and right entropy and word frequency is used to extract key phrases. The event paragraphs are then reconstructed using Top-K high-scoring phrases.

[0044] The reconstructed text is input into the BERTopic framework for topic extraction. HDBSCAN clustering is used to generate topic clusters. A large model is then called to combine expert knowledge to summarize the topic clusters into standardized risk factors.

[0045] Construct semantic vectors of risk factors and regulatory clauses, calculate cosine similarity, and build a bipartite network;

[0046] The Leiden algorithm is run on a bipartite network to perform community detection, generate hyper-risk features, and label the cascading, coupling, and symbiotic relationships between factors.

[0047] Furthermore, risk feature extraction and group discovery based on meta-relationships specifically include:

[0048] Using the confirmed non-compliant entities as seed nodes, a multi-order neighborhood search is performed to extract the largest weakly connected subgraph as the analysis object;

[0049] Construct a meta-relation heterogeneous graph model, defining the meta-relation as R=(τ(s),ϕ(e),τ(t)), where τ is the node type and ϕ is the edge type;

[0050] Stack multiple heterogeneous graph neural network layers, aggregate heterogeneous information from multi-hop neighbors, and output deep contextual embedding representations of nodes.

[0051] Furthermore, the computational process of the type-aware heterogeneous attention mechanism includes:

[0052] Using the matrix M bound to the type τ(t) of the target node t Q τ(t) Map the features of t to the query vector Q. t ;

[0053] Using the matrix M bound to the type τ(s) of neighboring nodes s K τ(s) Map the features of s to the key vector K. s ;

[0054] The attention matrix M is bound to the type ϕ(e) of edge e. A ϕ(e) Calculate the interaction score between the query vector and the key vector;

[0055] The attention weight α is obtained by normalizing the score using the Softmax function. st .

[0056] Furthermore, the dynamic message passing process that incorporates relative temporal coding includes:

[0057] For a neighbor node s with timestamps and a target node t, calculate the time difference Δt;

[0058] Generate a relative temporal coding vector T based on Δt using a sine or cosine position coding function. rel ;

[0059] T rel The original eigenvector V of the source node s s The data is fused to generate a value vector V containing fused temporal information. s ′;

[0060] Based on attention weight α st V of neighboring nodes s Perform a weighted summation and update the feature representation of the target node t.

[0061] Furthermore, the specific steps of the dynamic population evolution clustering algorithm include:

[0062] Core leader positioning: Calculate the centrality of nodes and select the node with the greatest influence as the initial group center;

[0063] Group dynamic assimilation: The remaining nodes iteratively select the group with the smallest distance to join based on the distance between their own embedding vector and the centroid embedding vector of each group;

[0064] Group risk assimilation: After the assimilation is completed, the node embedding vector is updated according to the group structure, so that the node moves closer to the features of its neighboring nodes in the group;

[0065] Repeat the above steps until the population partitioning and node embedding converge.

[0066] Specifically, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0067] Example 1

[0068] This embodiment provides a market penetration-based anomaly detection method based on heterogeneous temporal knowledge graphs. The method mainly comprises two core stages: the first stage is constructing a high-quality, multi-layered heterogeneous temporal knowledge graph, and the second stage is graph-based deep representation learning and anomaly detection.

[0069] Phase 1: Constructing a multi-layered heterogeneous temporal knowledge graph for the capital market

[0070] This phase aims to extract structured knowledge from massive, multi-source data to form a three-layer coupled graph containing "subject-event-feature," providing a data foundation for subsequent in-depth analysis.

[0071] 1.1 Data Acquisition and Cleaning

[0072] (1) Multi-source data acquisition

[0073] Automated data collection is achieved through API integration (such as the China Securities Regulatory Commission's (CSRC) regulatory information disclosure platform V2.1 and exchange market data interfaces) and intelligent web crawling technology (such as using the Selenium framework combined with dynamic User-Agent strategies). Data sources are diverse, including but not limited to financial news, company announcements (annual reports, quarterly reports, and interim announcements), court judgments, regulatory agency penalty decisions, and business registration information. The collected data is managed through a three-tiered storage system:

[0074] Redis temporary cache: used for high-speed caching of raw data fetched in real time, relieving database pressure.

[0075] MySQL master-slave cluster: used to store cleaned and structured data, supporting efficient querying.

[0076] Alibaba Cloud OSS Archive: Used to store raw unstructured documents (such as PDF and Word documents) for easy backtracking.

[0077] (2) Deep cleaning and preprocessing of data

[0078] A uniform preprocessing procedure is performed on all collected data to ensure data quality:

[0079] Text cleaning: Remove HTML tags, special characters, and advertising links; unify full-width and half-width punctuation; and standardize to UTF-8 encoding format.

[0080] Structured data mapping: For tabular data in the database, D2R (Direct to RDF) mapping technology is used to directly convert it into Resource Description Frame (RDF) triple form.

[0081] Unstructured document parsing: For PDF format announcements and annual reports, coordinate-level text extraction technology combined with layout analysis algorithms is used to achieve in-depth reconstruction of table structure and correct restoration of text flow, avoiding garbled characters and misalignment.

[0082] Time expression normalization: A pre-built capital market professional dictionary is loaded synchronously to drive domain-adaptive word segmentation and part-of-speech tagging. Regular expressions and HanLP NLP tools combined with the Pendulum time processing library are used to identify and normalize time information in the text. For example, the vague "second quarter" is converted into the standard time interval "2025-04-01 / 2025-06-30" (see Table 3 for details), and "last year" is converted into a specific year, laying a solid foundation for subsequent time sequence alignment.

[0083] 1.2 Construction of the Subject Layer and Event Layer Based on BERT-BiLSTM-CRF and Large Model Collaboration

[0084] like Figure 1 and Figure 2 As shown, the main body layer and the event layer share the same underlying technical framework, but a large model is introduced in the event layer for more refined semantic processing.

[0085] (1) Entity extraction based on BERT-BiLSTM-CRF

[0086] This step uses a deep learning model for high-precision sequence labeling.

[0087] Model architecture: A fine-tuned BERT (Bidirectional Encoder Representations from Transformers) model is used as the encoder to extract the contextual semantic vectors of words; then a BiLSTM (Bidirectional Long Short-Term Memory) layer is connected to capture long-distance dependency features; finally, the optimal label sequence is output by the CRF (Conditional Random Field) layer.

[0088] Dictionary enhancement: In the BERT input layer, embed the domain dictionary vector into the BERT output vector h. i By splicing the data, the model's ability to recognize financial terminology is enhanced.

[0089] Entity linking and disambiguation: For the extracted entities, the FuzzyWuzzy fuzzy matching algorithm is used in conjunction with a pre-set alias library (such as company abbreviations and former names) to complete entity linking and disambiguation, forming standardized main nodes.

[0090] (2) Extraction of Event Layer Entities and Sub-events

[0091] Based on the extraction of the main body layer, the event layer is further refined using the large model DeepSeek:

[0092] Trigger word matching: Based on the pre-built financial risk trigger word dictionary (as shown in Table 1), the texts of three types of risks, namely information disclosure violations, major public opinion events, and market manipulation, are matched to initially segment candidate sub-events.

[0093] Large model semantic verification: The DeepSeek large model is invoked, and candidate sub-events are processed in depth according to a dedicated instruction set (as shown in Table 2).

[0094] Semantic independence verification: Determine whether the clause constitutes an independent and meaningful risk event, excluding negative sentences or non-risk descriptions.

[0095] Implicit Entity Completion: Adding implied responsible parties in the event. For example, completing the original phrase "illegally disclosed guarantee matters" to "XX Company illegally disclosed guarantee matters".

[0096] Event boundary fine-tuning: Precisely adjust the start and end boundaries and time range of events.

[0097] Output: The final output is a sequence of sub-events that is semantically complete, has a clear subject, and has well-defined boundaries.

[0098] Table 1. Dictionary of Trigger Terms in the Financial Sector

[0099] Event Type Trigger word dictionary Information disclosure violations "Failure to disclose", "false records", "material omissions", "misleading statements", "material omissions", "violations of disclosure procedures", "dereliction of duty by the responsible party", "selective disclosure", etc. Major public opinion events Negative reports, media exposure, public questioning, and public opinion crisis are some of the issues that may arise. Major public opinion events Insider trading, stock price manipulation, abnormal trading, market disruption, etc.

[0100] Table 2 Semantic Independence Verification and Fine-Grained Information Completion Instruction Set

[0101] Event Type instruction Information disclosure violations (1) "To determine whether a clause is a disclosure violation event (such as 'failure to disclose' or 'false record'), it must include the company, the violation, and the time element. Output format: {event_type: 'Information Disclosure Violation', trigger: 'Failure to Disclose', company: 'XX',time: 'YYYY-MM-DD'}." (2) "If a clause involves multiple violations (such as 'failure to disclose guarantees' and 'false statements'), it should be split into independent events, with each event's time and subject marked." Major public opinion events (1) "Identify whether the clause is a major public opinion event (such as 'negative reports' or 'media exposure'), and judge the severity of the event by combining the sentiment of the context. Output format: {event_type: 'major public opinion event', trigger: 'media exposure', sentiment: 'negative', time: 'YYYY-MM-DD'}." (2) "Infer the trigger time of the public opinion event, such as 'recent exposure' combined with the post publication date to estimate the year and month." Market manipulation (1) "Determine whether the clause involves market manipulation (such as 'insider trading' or 'stock price manipulation'), and extract the subject (such as company / executive) and behavior (such as transaction amount). Output format: {event_type: 'market manipulation', trigger: 'insider trading', company: 'XX', amount: 'XX million yuan'}." (2) "If the clause contains multi-stage manipulation behavior, split it in chronological order and mark the subject and time of each stage." General instructions (1) "Exclude negative sentences or non-risk events, such as 'no violation occurred' or 'clarification report'. If excluded, return {is_valid:false}." (2) "Infer the specific range of the ambiguous time (such as 'the period') based on the context and output in ISO8601 format."

[0102] Table 3. Temporal Expression Extraction and Normalized Pseudocode

[0103] Algorithm 1 Time-Event Alignment (TimeAlign Node) Input: doc: Document text

[0104] (3) Relationship extraction and time alignment based on predefined rules and large model collaboration

[0105] Relation extraction:

[0106] Coarse extraction: Using SpaCy for dependency parsing, based on 13 predefined core relationship rules (including holding, guarantee, concerted action, appointment, participation, etc.), candidate triples of "subject-action-object" are quickly extracted.

[0107] Refinement: Input the candidate triples into the relation classifier (also based on the BERT-BiLSTM-CRF architecture), combine oversampling and negative sampling techniques to solve the class imbalance problem, and output the final relation type.

[0108] Large model correction: For the event layer, the DeepSeek large model is called to correct errors in triples, complete implicit components (such as completing omitted prepositional objects), and standardize semantic roles to ensure the accuracy of relation extraction.

[0109] Time-event precise alignment (Algorithm 2):

[0110] Preliminary matching: Based on the nearest neighbor principle of character offset, the sub-event is initially matched with the time expression in the text.

[0111] Fuzzy resolution: For vague references such as "period," "subsequently," and "at that point in time," the system uses a large model to infer the specific time interval based on the context. For example, if the text mentions "a violation occurred during that period," the system will infer the specific year or quarter that "that period" refers to based on the context.

[0112] Standardization: The inferred time is uniformly normalized into the ISO8601 standard interval format (e.g., "2025-04-01 / 2025-06-30"), ultimately forming a sub-event sequence and time chain with precise start and end times, providing accurate time anchors for subsequent time series modeling, as shown in Table 4.

[0113] It should be noted that the subject layer and the event layer share the same fine-tuned BERT-BiLSTM-CRF entity recognition model. The dictionary embedding layer concatenates the terminology vectors with the BERT output and inputs them into the BiLSTM-CRF to achieve high-precision sequence labeling.

[0114] Let the input sequence be The BERT encoding layer computes the contextual representation of each word through multiple Transformer layers:

[0115]

[0116] in each Indicates the first The semantic vector of each word.

[0117] BiLSTM layer merges contextual information:

[0118]

[0119]

[0120]

[0121] The scoring function for the CRF layer is:

[0122]

[0123] in The label transition matrix, This is the emission probability matrix. The model uses the Viterbi algorithm to solve for the optimal tag path:

[0124]

[0125] Table 4. Time-Event Alignment Pseudocode

[0126] ctx_date: Reference date (ISO 8601) Input:sub_events: List of [event_id, trigger, offset]time_exprs: List of [time_id,start, end, offset]doc_context: StringOutput:event_time_map: List of [event_id, start,end, method, confidence]Begin:1: event_time_map ← []2: for each event e in sub_eventsdo3: t_best ← find nearest time expression by offset distance4: if distance(e, t_best)< threshold then5: append (e.id, t_best.start, t_best.end, "offset", 0.95) to event_time_map6: else7: t_llm ← LLMTimeInference(doc_context, e.trigger)8: append (e.id, t_llm.start, t_llm.end, "llm", t_llm.confidence) to event_time_map9: end if10: end for11:sort event_time_map by start date using pendulum;12: return event_time_map;

[0127] (4) Structured output and cross-layer fusion

[0128] All nodes (including companies, people, risk events, time, etc.) and edges (including relationships such as holding, guarantee, participation, occurrence, and time sequence) are structured according to a unified JSON Schema to generate standard graph files (such as .csv or .cypher formats that can be imported into the Neo4j graph database). The subject layer provides the entity foundation, the event layer is linked to the subject layer through entity IDs, and the feature layer is associated with the event layer through event text, forming a multi-layered, coupled, three-dimensional knowledge graph.

[0129] 1.3 Construction of a Risk Feature Layer Knowledge Graph Based on Topic Extraction and Community Clustering Analysis

[0130] like Output: time_list: List of [raw, start, end, normalized] As shown, this step aims to condense risk representations scattered in unstructured text into structured knowledge units.

[0131] (1) Event text preprocessing and key phrase mining

[0132] Cleaning: Remove tags and special symbols, and standardize punctuation. Combine jieba word segmentation with a stop word list for the financial field to filter meaningless words.

[0133] Key phrase mining: Employing fusion point mutual information (PMI) and left and right entropy (H) L (t), H R (t) and a multi-statistic algorithm based on word frequency to extract key phrases.

[0134] Calculation formula: Score(t) = α⋅PMI(t) + β⋅(H L (t)+H R (t)) / 2+γ⋅Freq(t), where α=0.45, β=0.35, γ=0.20.

[0135] By selecting Top-K high-scoring phrases to reconstruct event paragraphs, the semantic density of the text is improved, and the topic modeling effect is optimized.

[0136] (2) Topic extraction based on BERTopic

[0137] The text input BERTopic framework will be restructured.

[0138] High-quality sentence vectors are generated using the paraphrase-multilingual-MiniLM-L12-v2 model.

[0139] The UMAP (Uniform Manifold Approximation and Projection) algorithm is used to reduce the dimensionality of sentence vectors to 10 dimensions while preserving local structure.

[0140] The HDBSCAN (Hierarchical Density-Based Spatial Clustering of Applications with Noise) density clustering algorithm is used to automatically determine the optimal number of topics and effectively filter outouts (noise).

[0141] Large model naming: The representative documents of each cluster are generated by the DeepSeek large model according to the financial special instruction set to form a standardized set of risk factor candidates (such as "financial data fraud" and "insider trading").

[0142] (3) Expert-assisted risk factor summarization combines domain expert knowledge and financial regulatory terminology system to perform semantic abstraction and standardized naming of machine-generated topic clusters, ensuring that factor naming conforms to industry norms and has high interpretability.

[0143] (4) Semantic mapping between risk factors and regulatory provisions

[0144] Legal texts are divided into blocks at the "article-clause-item" granularity.

[0145] Risk factors and regulatory provisions are encoded as dense vectors, and the correlation strength between the two is calculated using cosine similarity.

[0146] A sliding window approach is used for local maximum matching to construct a weighted binary network of "risk factors - regulatory clauses". For low-confidence associations, a large model is used for secondary logical reasoning verification to ensure the accuracy of the mapping.

[0147] (5) Leiden community detection generates risk features

[0148] The Leiden algorithm (a community detection algorithm that optimizes modularity) is run on the constructed "risk factor-regulatory clause" binary network to automatically identify the higher-level risk characteristics.

[0149] This algorithm can identify six core risk characteristics as shown in Table 5 (such as "false records", "misleading statements", "material omissions", "disclosure procedure violations").

[0150] Large models help label the "cascade" (A leads to B), "coupling" (A and B occur together), and "symbiotic" (A and B frequently coexist) relationships between factors within the community.

[0151] This ultimately forms a structured risk feature layer knowledge graph containing risk characteristics, risk factors, regulatory provisions, and multiple types of relationships (see...). Begin: This achieves a structured upgrade of risk semantics.

[0152] Phase Two: Risk Feature Extraction and Population Discovery Model Based on Meta-Relationships

[0153] This step is the core of the invention, aiming to combine the static structure of knowledge graphs with the temporal dynamics of events to generate node embeddings with rich semantic and temporal information, and based on this, discover hidden abnormal groups. The technical framework includes three sub-stages: subgraph extraction, representation learning, and group discovery.

[0154] Table 5 Overview of Risk Characteristics

[0155]

[0156] 2.1 Phase 1: Subgraph Extraction

[0157] Faced with a complete industrial and commercial graph with millions of nodes, direct full-graph computation is not only extremely computationally complex but also introduces a large amount of irrelevant noise. This invention employs a dynamic graph construction strategy to reduce the dimensionality of the problem:

[0158] Seed node selection: The entities that have been confirmed to have violated regulations in business operations (such as "Inner Mongolia Yuanxing Energy") are selected as seed nodes.

[0159] Neighborhood Search: A business-focused subgraph extraction algorithm that performs a local neighborhood search centered on a seed node. Experiments have shown that it typically needs to be expanded to second- or third-order neighbors to capture meaningful associations.

[0160] Connected subgraph extraction: The largest weakly connected subgraph is extracted as the final analysis object. This process reduces the analysis scope from the entire graph of millions to subgraphs of thousands, which not only significantly reduces the computational cost, but more importantly, effectively filters out massive amounts of irrelevant background noise and fully preserves the hidden topological relationships between the violating entities.

[0161] 2.2 Phase Two: Representation Learning

[0162] For the extracted connected subgraphs, this invention proposes a meta-relational heterogeneous graph model for deep feature extraction.

[0163] (1) Definition of meta-relation

[0164] The meta-relation is defined as R=(τ(s),ϕ(e),τ(t)), where τ represents the node type (e.g., company, individual, event) and ϕ represents the edge type (e.g., employment, guarantee, trigger). Unlike traditional GNNs that share parameters for all types, this model configures a dedicated parameter matrix for each meta-relation, thereby achieving accurate modeling of heterogeneous interaction patterns.

[0165] (2) Type-aware heterogeneous attention mechanism

[0166] This mechanism is used to dynamically assign weights to different types of neighbors during information aggregation. The calculation process is as follows:

[0167] Vector generation: For a target node t and its neighbors s, a query vector Q and a key vector K are generated using a matrix M bound to the node type: Q t =M Q τ(t) h t K s =M K τ(s) h s , of which M Q τ(t) This represents the query transformation matrix that is specific to node type τ(t).

[0168] Attention calculation: The similarity between the query vector and the key vector is processed by an attention matrix M bound to the edge type ϕ(e). A ϕ(e) Regulation: e st =(Q t M A ϕ(e) K s T ) / d0.5 , where d is the vector dimension.

[0169] Normalization: The score is normalized using the Softmax function to obtain the final attention weight α. st α st =exp(e st ) / ∑ u∈N(t) exp(e ut )

[0170] This design enables the model to capture the differences in different interaction patterns. For example, during the learning process, the model can learn that "in the event of 'financial fraud,' neighbors of the 'individual' type are far more important if connected through the 'actual controller' relationship than if connected through the 'ordinary position' relationship."

[0171] (3) Dynamic message passing with relative timing coding

[0172] This mechanism is responsible for deeply integrating time-series information into the feature transmission process, which is crucial for understanding risk transmission.

[0173] Relative temporal coding: For event nodes s and t with timestamps, calculate the time difference Δt = Time(s) − Time(t). Using a sine / cosine positional coding function (refer to Transformer positional coding), generate a relative temporal coding vector T based on Δt. rel .

[0174] Value vector fusion: merging time series vector T rel The original eigenvector V of the source node s s To perform a fusion operation (such as a splicing operation ⊕ or an addition operation): V s =V s ⊕T rel

[0175] Message passing and aggregation: The update information of the target node t is the weighted sum of the value vectors of all its neighbors, which incorporate time-series information: h t ′=σ(∑ s∈N(t) α st V s Through this mechanism, if a group of subjects interact frequently or trigger a series of risk events within a short period of time, their feature representations will be similar due to the similarity of T. rel The influence caused them to become closer together, providing a signaling basis for subsequent clustering discoveries.

[0176] (4) Multi-layer aggregation and dynamic embedding generation

[0177] The above "attention computation -> message passing -> aggregation update" process is stacked into L layers. After passing through L layers, a node can aggregate the heterogeneous temporal information of its L-hop neighbors to generate the final deep context embedding representation. This embedding vector not only includes the node's own attributes, but also integrates the structural features, semantic type features, and dynamic temporal features of its local network.

[0178] 2.3 Phase Three: Group Discovery

[0179] Based on the generated node embeddings, this invention proposes a dynamic population evolution clustering algorithm for community division.

[0180] (1) Core Leader Positioning

[0181] This stage aims to identify the "core" entities in the network. The algorithm first calculates the centrality (such as PageRank, Degree Centrality) or "reputation" score of nodes, selecting the node with the highest score as the "leader" of the initial group. In capital market scenarios, this typically corresponds to the actual controller or core holding platform of a capital group.

[0182] (2) Group dynamic affiliation

[0183] This stage models the formation process of the community as a dynamic game process.

[0184] The remaining "follower" nodes will iteratively select their joining strategy based on the principle of maximizing their own interests.

[0185] The decision is based on the attribution utility function U(s,j), and its objective is to minimize its own embedding h. s Centroid embedding of target group j j Euclidean distance between them: U(s,j)=−∣∣h s -c j || 2

[0186] Node selection is based on the group that provides the greatest utility (i.e., the minimum distance) for joining.

[0187] (3) Group risk assimilation

[0188] This is the core difference between this algorithm and traditional clustering algorithms such as K-Means. After the clustering is completed, the model assumes that entities within the same group will influence each other, and their risk characteristics will be assimilated.

[0189] The algorithm updates the node embedding vector to make it more similar to the features of the "trusted neighbors" (i.e., neighbors within the same group) of its community.

[0190] Updated formula example: h s new =hs old +λ∑ u∈N(s)∩Cj (h u -h s old ), where λ is the learning rate.

[0191] This process simulates the "risk contagion" effect within an anomalous group, making the node characteristics of the same group more distinct and cohesive.

[0192] (4) Iterative convergence

[0193] The system repeats the three stages of "core leader identification - dynamic group assimilation - group risk assimilation" to form a complete iterative cycle. This cycle continues until the group division no longer changes significantly (Delta convergence) and the node embedding vectors reach a stable state, at which point the final discovery of the anomalous group is complete.

[0194] In addition, the present invention experimentally verified the above framework to evaluate its effectiveness.

[0195] 3.1 Experimental Setup

[0196] Data source: Documents of illegal disclosure; business knowledge graph containing millions of nodes and edges.

[0197] Seed nodes: Inner Mongolia Yuanxing Energy Co., Ltd., Xinjiang Tianshun Supply Chain Co., Ltd., and Shaanxi Broadcasting Network Media (Group) Co., Ltd.

[0198] 3.2 Experimental Results

[0199] Subgraph extraction: Second-order / third-order subgraph extraction was performed on the seed node, successfully extracting the largest connected subgraph containing 3865 nodes and 4291 relations (see...). 1 time_list ← ∅ ).

[0200] Clustering results: The model proposed in this invention successfully identified 10 major communities (groups). 2 InitializeTimeExtractor() / / load HanLP & regex patterns It demonstrates clear cluster boundaries.

[0201] Recall rate statistics:

[0202] Inner Mongolia Yuanxing Energy Co., Ltd.: The model classifies it and 5 known involved entities (out of 6) into the same community (number #7), achieving a recall rate of 5 / 6.

[0203] Shaanxi Broadcasting Network Media (Group) Co., Ltd.: The model recalled 3 / 4 of the known entities.

[0204] Xinjiang Tianshun Supply Chain Co., Ltd.: The model recalled 4 / 9 of the known entities. Although the recall rate was moderate, the visualization results (see...) 3 entities ← HanLP_ExtractTime(doc) / / NER for DATE / TIME 4 FOR each pattern p ∈ TIME_PATTERNS DO / / regex matching 5 FOR each match m ∈ p.FindIter(doc) DO 6 AppendMatch(time_list, m) 7 FOR each kw k ∈ FUZZY_TIME_KEYWORDS DO / / fuzzy keywords 8 FOR each match m ∈ k.FindIter(doc) DO 9 AppendFuzzy(time_list, m, ctx_date) 10 FilterBookTitleTimes(time_list) / / remove false positives 11 unique ← RemoveDuplicatesAndSort(time_list) 12 FOR each t ∈ unique DO 13 IF t.IsFuzzy THEN 14 norm ← NormalizeFuzzy(t, ctx_date) 15 ELSE 16 norm ← PendulumNormalize(t) 17 AppendFinal(time_list, t.raw, norm.start, norm.end, norm.iso) 18 RETURN time_list Algorithm 2 Time-Event Alignment (TimeAlign Node) Figure 3 Figure 4 Figure 7 Figure 8 Figure 8 The data clearly shows that this community (number #1) is closely adjacent to the seed node, indicating that the model has indeed captured the most core relationships. Unrecalled entities may belong to more peripheral stakeholders or exhibit different temporal and semantic interactions compared to the core group.

[0205] Conclusion: Experimental results show that the embeddings generated by the meta-relation-based representation learning model proposed in this invention have good spatial separability and can accurately identify entity groups highly correlated with risk events. Combined with the dynamic group evolution algorithm, this system can effectively penetrate complex capital networks and discover hidden abnormally correlated groups, demonstrating the technical advancement and practical value of this solution.

[0206] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A market penetration abnormal group discovery method based on heterogeneous timing knowledge graph, characterized in that, Includes the following steps: Constructing a multi-layered heterogeneous time-series knowledge graph for the capital market: Collecting multi-source heterogeneous data and using entity recognition, relation extraction, and time alignment technologies, constructing a three-layered heterogeneous knowledge graph comprising a capital market entity layer, a risk event layer, and a risk characteristic layer; Risk feature extraction and group discovery based on meta-relations: Connected subgraphs are extracted from the knowledge graph using violating entities as seed nodes to construct a meta-relation heterogeneous graph model. Node embeddings are generated based on a type-aware heterogeneous attention mechanism and a dynamic message passing mechanism that integrates relative temporal coding. The node embeddings are then clustered based on a dynamic group evolution clustering algorithm to identify abnormal groups.

2. The market penetration based abnormal group finding method using heterogeneous time-series knowledge graph according to claim 1, characterized in that, Constructing a multi-layered, heterogeneous temporal knowledge graph for the capital market, specifically including: The fine-tuned BERT-BiLSTM-CRF model is used in conjunction with the DeepSeek large model for entity extraction and relation extraction. For the risk event layer, candidate sub-events are first segmented based on the financial risk trigger word dictionary, and then the large model is called to perform semantic independence verification, implicit subject completion and event boundary fine-tuning of the candidate sub-events according to the preset instruction set. By combining dependency syntax rules with the large model to extract relations, and by performing precise time-event alignment based on character offsets and context inference from the large model, the time expression is normalized to the ISO8601 standard range, forming an event chain with precise time sequence. The extracted nodes and edges are stored in a structured manner according to a unified schema, forming a cross-layer fusion graph of the main layer and the event layer. 3.The market-penetration anomaly group finding method based on heterogeneous timing knowledge graph according to claim 2, characterized in that, The construction of the risk feature layer specifically includes: The risk event text is cleaned and segmented. A multi-statistic weighted algorithm that combines Point Mutual Information (PMI), left and right entropy and word frequency is used to extract key phrases. The event paragraphs are then reconstructed using Top-K high-scoring phrases. The reconstructed text is input into the BERTopic framework for topic extraction. HDBSCAN clustering is used to generate topic clusters. A large model is then called to combine expert knowledge to summarize the topic clusters into standardized risk factors. Construct semantic vectors of risk factors and regulatory clauses, calculate cosine similarity, and build a bipartite network; The Leiden algorithm is run on a bipartite network to perform community detection, generate hyper-risk features, and label the cascading, coupling, and symbiotic relationships between factors.

4. The market penetration anomaly group finding method based on heterogeneous timing knowledge graph according to claim 3, characterized in that, Risk feature extraction and group discovery based on meta-relationships specifically include: Using the confirmed non-compliant entities as seed nodes, a multi-order neighborhood search is performed to extract the largest weakly connected subgraph as the analysis object; Construct a meta-relation heterogeneous graph model, defining the meta-relation as R=(τ(s),ϕ(e),τ(t)), where τ is the node type and ϕ is the edge type; Stack multiple heterogeneous graph neural network layers, aggregate heterogeneous information from multi-hop neighbors, and output deep contextual embedding representations of nodes.

5. The market penetration based abnormal group finding method using heterogeneous time-series knowledge graph according to claim 4, characterized in that, The computational process of type-aware heterogeneous attention mechanisms includes: Utilizing a matrix M bound to the type τ(t) of the target node t Q τ(t) Mapping the features of t into a query vector Q t ; Utilizing a matrix M bound to the type τ(s) of the neighbor node s K τ(s) Mapping the features of s into a key vector K s ; utilizing an attention matrix M bound to the type of edge e A ϕ(e) computing an interaction score of the query vector and the key vector; The scores are normalized using a Softmax function to obtain attention weights a st .

6. The market penetration based abnormal group finding method using heterogeneous time-series knowledge graph according to claim 5, characterized in that, The dynamic message passing process incorporating relative timing coding includes: For a neighbor node s with timestamps and a target node t, calculate the time difference Δt; Generating a relative timing encoding vector T based on Δt using a sine or cosine position encoding function rel ; T rel The original eigenvector V of the source node s s The data is fused to generate a value vector V containing fused temporal information. s ′; Based on attention weight α st V of neighboring nodes s Perform a weighted summation and update the feature representation of the target node t.

7. The market penetration based abnormal group finding method using heterogeneous time-series knowledge graph according to claim 6, characterized in that, The specific steps of the dynamic population evolution clustering algorithm include: Core leader positioning: Calculate the centrality of nodes and select the node with the greatest influence as the initial group center; Group dynamic assimilation: The remaining nodes iteratively select the group with the smallest distance to join based on the distance between their own embedding vector and the centroid embedding vector of each group; Group risk assimilation: After the assimilation is completed, the node embedding vector is updated according to the group structure, so that the node moves closer to the features of its neighboring nodes in the group; Repeat the above steps until the population partitioning and node embedding converge.

Images