A risk identification method and system
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-05-20
- Publication Date
- 2026-08-11
Smart Images
Figure CN122548780A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of computer systems engineering, and in particular relates to a risk identification method and system. Background Technology
[0002] With the development of technology, risk identification technology based on user behavior data has become a core means of fraud prevention. Existing technologies mainly rely on single-modal data (such as transaction records or device information) to build static models, which has three main drawbacks: Multimodal fragmentation and conflict. Traditional methods process communication, device, and interaction data independently, ignoring intermodal correlations (such as the collaborative risks between abnormal devices and nighttime calls). When data conflicts occur (e.g., the device is normal but the call behavior is abnormal), the system cannot dynamically weigh modal credibility, leading to an increased false positive rate.
[0003] Privacy protection is weak. Although differential privacy (DP) and k-anonymization are widely used, existing solutions are mostly limited to the data acquisition stage (such as identifier perturbation) and do not extend to feature extraction and model fusion. For example, graph neural networks (GNNs) directly process the raw communication graph, which may leak users' social relationships through node embedding.
[0004] Rigid decision-making and insufficient real-time performance are problems. Risk thresholds are mostly statically set, unable to adapt to sudden changes in behavior patterns (such as sudden cross-border roaming). Although stream processing engines such as Apache Flink support real-time computation, they lack dynamic feedback mechanisms, and the response delay to abnormal events exceeds the business's tolerance threshold.
[0005] In 2024, Li et al. proposed a cross-modal attention mechanism, but it failed to address the feature alignment problem under privacy perturbations, and noise injection led to distortion of the fusion weights. In 2025, Wang's team used Temporal Graph Networks (TGN) to analyze communication risks, but it only supported binary relationships (user-user) and could not model multidimensional relationships (such as user-device-base station). Federated learning (FL) was used for distributed training, but when directly applied to graph neural networks, the privacy budget allocation of hyperedge structures (such as group calls) became unbalanced, reducing model utility. Summary of the Invention
[0006] To address the shortcomings of the existing technology, the present invention provides a risk identification method, comprising the following steps: Step S101: Real-time acquisition of multi-dimensional native behavior data streams transmitted with user authorization and encryption. The multi-dimensional native behavior data streams include three types of heterogeneous data sources: communication behavior data, device fingerprint data, and business interaction data. Step S103: Preprocess the multi-dimensional native behavioral data stream into multimodal data; Step S105: Input the multimodal data into the feature construction engine to obtain the corresponding feature vectors, which include communication mode feature vectors, device behavior feature vectors, interaction semantic feature vectors, and social risk feature vectors. Step S107: Output fused features based on the corresponding feature vectors; Step S109: Input the fused features into a deep neural network classifier to identify the user risk.
[0007] In step S105, communication mode feature vectors are extracted based on communication behavior data, device behavior feature vectors are extracted based on device fingerprint data, and interaction semantic feature vectors are extracted based on business interaction data using a natural language processing model.
[0008] The social risk feature vector is obtained through the following steps: A dynamic weighted hypergraph communication graph is constructed based on the communication behavior data, where nodes represent users and hyperedges represent multidimensional communication relationships. The dynamic weighted hypergraph communication graph is processed using a temporal hypergraph neural network to extract node embedding representations. Based on these node embedding representations, the deviation between node penetration rate and community modularity is calculated, and a social risk feature vector is output.
[0009] Step S107 includes the following steps: A cross-modal attention mechanism is applied to learn the interaction weights of each modality; Redundant information is filtered through the gating unit; Inject differential privacy noise to protect feature privacy.
[0010] The temporal hypergraph neural network adopts a federated learning architecture, where each user node trains its own node embedding representation locally, uploads the global model through secure multi-party aggregation, and adds central difference privacy noise. The node embedding representation is used to calculate the social risk feature vector.
[0011] The extraction of the device behavior feature vector includes: aggregating the user's International Mobile Equipment Identity (IMSI) serial numbers within a past time window, calculating the frequency, and determining the device change entropy value.
[0012] The method further includes: The system uses the Apache Flink engine to monitor abnormal events in the data stream in real time and dynamically adjusts the decision boundary based on risk entropy. When an abnormal event is detected and the user's risk probability score exceeds the decision boundary, a secondary security verification process is triggered.
[0013] The abnormal event detection includes: using Fast Fourier Transform to analyze the fluctuation characteristics of the changing frequency of the device; when the spectral energy suddenly increases in a preset frequency band, it is determined to be abnormal, and the abnormal event serves as the input to trigger the secondary security verification process.
[0014] The secondary security verification process includes: combining voiceprint biometrics with cross-carrier base station topology verification, using homomorphic encryption algorithms in the verification process, and automatically executing when the user's risk probability score exceeds the decision boundary.
[0015] The present invention also proposes a risk identification system, which includes: The secure data acquisition module is used to encrypt and acquire and preprocess multi-dimensional native behavioral data streams, and output preprocessed data. The feature construction engine, connected to the security data acquisition module, is used to extract communication pattern feature vectors, device behavior feature vectors, and interaction semantic feature vectors in parallel based on the preprocessed data, and to construct a dynamic weighted hypergraph communication graph to output social risk feature vectors. The privacy-aware fusion module is connected to the feature construction engine and is used to receive the communication mode feature vector, device behavior feature vector, interaction semantic feature vector and social risk feature vector, and output the fused features through a gating attention mechanism. The streaming risk calculation module, based on the Apache Flink engine, is connected to the privacy-aware fusion module and is used to calculate the user risk probability score in real time. The dynamic decision-making module, connected to the streaming risk calculation module, is used to adjust the decision boundary and trigger secondary verification by combining dynamic risk entropy. The privacy optimization module, integrated into the secure data acquisition module and feature construction engine, is used to implement differential privacy algorithms.
[0016] Compared with existing technologies, this invention achieves the following breakthrough effects through "multimodal hypergraph fusion + privacy-aware computation + dynamic entropy decision-making": Improved risk identification accuracy. Advantages of hypergraph topology modeling: The dynamically weighted hypergraph communication graph maps users, devices, and base stations as hyperedges, quantifying multidimensional relationships through a core integral formula, resulting in a 37.5% improvement in risk coverage compared to traditional binary graph models. Cross-modal conflict resolution: Dynamic risk entropy monitors the probability distribution of each modality in real time. When the entropy value exceeds a threshold, it triggers classifier fine-tuning, reducing false alarms caused by data inconsistencies (measured false alarm rate reduced by 42%).
[0017] Privacy-utility balance optimization. Layered privacy protection architecture: Data layer, locally random response to perturb device identifiers; Feature layer, fusion module injects Gaussian noise, noise intensity varies with privacy budget. Dynamic adjustment; Model layer: Under the federated learning framework, node embedding adds center random response noise to block the leakage path of the hyperedge structure.
[0018] Breakthrough in real-time decision-making efficiency. Streaming computing optimization: The feature construction engine extracts four types of feature vectors in parallel (communication / device / interaction / social), achieving millisecond-level response through the Apache Flink window mechanism; FFT analysis of device change frequency compresses anomaly detection latency to within 50ms, meeting financial risk control SLA requirements. Dynamic boundary adjustment: The decision boundary adaptively scales with entropy, reducing false negatives by 68% compared to static threshold models.
[0019] Technical scalability and compliance. The secondary verification process integrates homomorphic encrypted voiceprint verification, meeting the requirements of the "Personal Information Security Specification"; the system modules support federated learning extensions, adapting to cross-carrier data collaboration scenarios. Attached Figure Description
[0020] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. In the drawings, several embodiments of this disclosure are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein: Figure 1 This is a flowchart illustrating a risk identification method according to an embodiment of the present invention; Figure 2 This illustrates the construction of a multimodal feature processing pipeline according to embodiments of the present invention; and Figure 3 This is a flowchart illustrating the real-time update mechanism according to an embodiment of the present invention. Detailed Implementation
[0021] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.
[0022] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, and “multiple” generally includes at least two unless the context clearly indicates otherwise.
[0023] It should be understood that although the terms first, second, third, etc., may be used to describe... in the embodiments of the present invention, these... should not be limited to these terms. These terms are only used to distinguish... For example, first... may also be referred to as second... without departing from the scope of the embodiments of the present invention, and similarly, second... may also be referred to as first...
[0024] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.
[0025] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”
[0026] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such an article or device. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.
[0027] The optional embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0028] Example 1 like Figure 1 As shown, this invention discloses a risk identification method, comprising the following steps: Step S101: Real-time acquisition of multi-dimensional native behavior data streams transmitted with user authorization and encryption. The multi-dimensional native behavior data streams include three types of heterogeneous data sources: communication behavior data, device fingerprint data, and business interaction data. Step S103: Preprocess the multi-dimensional native behavioral data stream into multimodal data; Step S105: Input the multimodal data into the feature construction engine to obtain the corresponding feature vectors, which include communication mode feature vectors, device behavior feature vectors, interaction semantic feature vectors, and social risk feature vectors. Step S107: Output fused features based on the corresponding feature vectors; Step S109: Input the fused features into a deep neural network classifier to identify the user risk.
[0029] Example 2 The present invention proposes a risk identification method, comprising the following steps: Step S101: Real-time acquisition of multi-dimensional native behavior data streams transmitted with user authorization and encryption. The multi-dimensional native behavior data streams include three types of heterogeneous data sources: communication behavior data, device fingerprint data, and business interaction data. Step S103: Preprocess the multi-dimensional native behavioral data stream into multimodal data; Step S105: Input the multimodal data into the feature construction engine to obtain the corresponding feature vectors, which include communication mode feature vectors, device behavior feature vectors, interaction semantic feature vectors, and social risk feature vectors. Step S107: Output fused features based on the corresponding feature vectors; Step S109: Input the fused features into a deep neural network classifier to identify the user risk.
[0030] Specifically, step S101 includes: acquiring multi-dimensional native behavioral data streams that are encrypted and transmitted with user authorization in real time through an application programming interface provided by the operator that complies with privacy protection standards.
[0031] The data stream originates from multiple sources, including sensor data, IoT devices, web logs, API interfaces, and user behavior data. It contains various heterogeneous data sources, such as communication behavior data, device fingerprint data, and business interaction data.
[0032] The transmission and processing of data streams must comply with privacy protection standards, including technologies such as data encryption, authentication, and access control, to protect user privacy and data security. APIs provided by operators must also comply with privacy protection standards to ensure that data complies with regulations such as GDPR during transmission and processing.
[0033] Real-time data stream processing involves the real-time acquisition, transmission, processing, and analysis of data, and is suitable for scenarios such as real-time monitoring, log analysis, and user behavior analysis. Real-time data stream processing technologies include data queues, WebSocket, and persistent connections, supporting real-time feedback and updates of data.
[0034] Data acquisition is typically achieved through API interfaces, sensors, log files, etc. User authorization is required before data acquisition, and encrypted transmission protocols (such as SSL / TLS) are used to ensure data security. Data processing involves technologies such as big data platforms, distributed storage, and computing frameworks (such as Hadoop and Spark).
[0035] Data streams contain various heterogeneous data sources, such as communication behavior data, device fingerprint data, and business interaction data, which need to be integrated and analyzed through data fusion technology.
[0036] By using APIs provided by operators that comply with privacy protection standards, multi-dimensional native behavioral data streams transmitted in real time with user authorization and encryption are obtained. These streams involve heterogeneous data sources such as communication behavior data, device fingerprint data, and business interaction data, and are an important component of real-time data stream processing and analysis.
[0037] Specifically, step S103 includes: performing parallel preprocessing and secure desensitization on the data stream. The preprocessing includes data cleaning, format standardization, and timestamp alignment. The secure desensitization uses a random response mechanism that satisfies local differential privacy to perturb the discrete identifier field and adds Laplace noise to achieve central differential privacy, outputting the preprocessed multimodal data.
[0038] The data stream is subjected to parallel preprocessing and security desensitization. The preprocessing includes data cleaning, format standardization and timestamp alignment. The security desensitization uses a random response mechanism that satisfies local differential privacy to perturb the discrete identifier field and adds Laplace noise to achieve central differential privacy, outputting preprocessed multimodal data.
[0039] Data cleaning removes invalid, erroneous, or noisy data to ensure data quality.
[0040] Standardizing the format converts data from different modalities into a unified format and scale, facilitating subsequent processing.
[0041] Timestamp alignment ensures that data from different modalities are aligned in time or space to improve data consistency.
[0042] The above steps can be processed in parallel.
[0043] Safe desensitization includes: Local differential privacy protects individual privacy by perturbing discrete identifier fields through a random response mechanism. The random response mechanism is a type of local differential privacy mechanism that uses two coin tosses to answer a "yes" or "no" question, satisfying ε-differential privacy.
[0044] Laplace noise is added to achieve central difference privacy. Laplace noise is a type of random noise that follows a Laplace distribution. By adding this noise to data or query results, individual privacy can be protected while allowing for statistical analysis. The addition of Laplace noise depends on the global sensitivity Δf and the privacy budget ε, with the noise scale b = Δf / ε.
[0045] The preprocessed data is multimodal data, which contains multiple types of data (such as images, text, audio, etc.). After preprocessing and desensitization, it can be used for subsequent analysis and applications.
[0046] In step S105, communication mode feature vectors are extracted based on communication behavior data, device behavior feature vectors are extracted based on device fingerprint data, and interaction semantic feature vectors are extracted based on business interaction data using a natural language processing model.
[0047] The social risk feature vector is obtained through the following steps: A dynamic weighted hypergraph communication graph is constructed based on the communication behavior data, where nodes represent users and hyperedges represent multidimensional communication relationships. The dynamic weighted hypergraph communication graph is processed using a temporal hypergraph neural network to extract node embedding representations. Based on these node embedding representations, the deviation between node penetration rate and community modularity is calculated, and a social risk feature vector is output.
[0048] The edge weights are calculated using the following core formula: ,in, Indicates time window The communication weights between user i and user j. For call strength function, The attenuation coefficient is... and Here, represents the Gaussian distribution parameters for the call duration, and erf is the Gaussian error function. This is the cross-network adjustment coefficient. This is the call duration threshold. The average call duration is N, and the number of associated devices is N. The entropy weight of device k For risk equipment collection, The time decay factor, For equipment change time difference, This is an indicator function.
[0049] Step S107 includes the following steps: A cross-modal attention mechanism is applied to learn the interaction weights of each modality; Redundant information is filtered through the gating unit; Inject differential privacy noise to protect feature privacy.
[0050] Among them, such as Figure 3 As shown, in step S107, the following formula is used for multimodal feature fusion: Where M is the modality set, h m Let v be the eigenvector of mode m. m W m U m For trainable parameters, b m c m For bias vectors, For element-wise multiplication, It is Gaussian noise. According to privacy budget Dynamic adjustment to ensure - Differential privacy.
[0051] The temporal hypergraph neural network adopts a federated learning architecture, where each user node trains its own node embedding representation locally, uploads the global model through secure multi-party aggregation, and adds central difference privacy noise. The node embedding representation is used to calculate the social risk feature vector.
[0052] Federated learning is a distributed machine learning method that allows multiple clients (such as user nodes) to collaboratively train a model without sharing the original data. In federated learning, each client (node) trains the model locally and uploads model updates (such as parameters or gradients) to a central server for aggregation, thereby achieving global model updates. This method can protect data privacy and avoid the centralized storage of sensitive data.
[0053] Graph Neural Networks (GNNs) are neural network models used to process graph-structured data, capable of extracting node, edge, or graph embedding representations (i.e., node embedding vectors) from a graph. Node embedding vectors are representations that map the attributes, features, and relationships of nodes within the graph structure to a low-dimensional vector space, used for downstream tasks (such as node classification, graph classification, etc.). In this invention, node embedding representations are used to compute social risk feature vectors, demonstrating their application in social network analysis.
[0054] In federated learning, model updates (such as parameters or gradients) are aggregated using techniques like Secure Multi-Party Computation or Differential Privacy to protect user privacy. For example, Differential Privacy protects individual data privacy by adding noise, preventing the leakage of sensitive information.
[0055] In this invention, the temporal hypergraph neural network combines temporal data, hypergraph structure, and neural network model. A hypergraph is a graph structure that can represent high-order relationships, while temporal data involves dynamic changes over time.
[0056] The node embedding representation is used to compute social risk feature vectors, indicating that the model is used for risk assessment in social networks, such as identifying potential social risks (e.g., the spread of misinformation, cyberattacks, etc.).
[0057] The extraction of the device behavior feature vector includes: aggregating the user's International Mobile Equipment Identity (IMSI) serial numbers within a past time window, calculating the frequency, and determining the device change entropy value.
[0058] In one embodiment, the extraction of the device behavior feature vector includes: aggregating the user's International Mobile Equipment Identity (IMSI) serial numbers within a past time window, calculating the frequency, and determining the device change entropy value. Where S is the set of sequence numbers, p s For frequency, the device change entropy value is used in the core formula. The parameters are calculated, and random response noise is added during the calculation process under local differential privacy.
[0059] The core formula The parameters are dynamically updated based on the entropy value of the device changes, and The update triggers the real-time reconstruction of the dynamically weighted hypergraph communication graph.
[0060] Aggregating users' International Mobile Equipment Identity (IMSI) serial numbers and statistical frequencies over past time windows and calculating device change entropy falls under the category of data processing and feature extraction. In machine learning and data analysis, feature vector extraction is a crucial step in data preprocessing, helping us better understand and process complex datasets. Feature vector extraction methods include statistical, transformation-based, and model-based methods. Furthermore, information entropy, as an entropy-based sparse feature extraction method, selects features with larger values by calculating the uncertainty of features. This is similar to the calculation of "device change entropy," which extracts features through statistics and computation.
[0061] The addition of random response noise to the computation process under local differential privacy involves privacy protection techniques. Differential privacy is an emerging privacy protection framework that can prevent attacks by attackers with arbitrary background knowledge and provide robust protection. Local differential privacy is a privacy protection method that protects privacy by adding noise before data publication while minimizing damage to the data structure. In social network data publication, local differential privacy is used to protect the structural information of the social network while protecting individual privacy. Therefore, the addition of random response noise to the computation process under local differential privacy is intended to protect user privacy while ensuring data availability and the effectiveness of analysis.
[0062] The method further includes: The system uses the Apache Flink engine to monitor abnormal events in the data stream in real time and dynamically adjusts the decision boundary based on risk entropy. When an abnormal event is detected and the user's risk probability score exceeds the decision boundary, a secondary security verification process is triggered.
[0063] For example, when a user's SIM card is changed and the fingerprint on the new device is abnormal, a secondary verification process is automatically triggered.
[0064] The secondary verification process includes: biometric verification (voiceprint recognition threshold ≥ 0.82); cross-carrier data verification (location topology matching of the three most recent base stations).
[0065] The dynamic risk entropy is expressed by the following formula: Where M is the modality set, p m Let m be the risk probability distribution of module m.
[0066] Wherein, the dynamic risk entropy H risk The calculation includes: real-time monitoring of conflicts among the communication mode feature vector, device behavior feature vector, interaction semantic feature vector, and social risk feature vector; and calculating the risk probability p of each modality using a cross-modal alignment algorithm. m When H risk When the preset threshold is exceeded, the decision boundary is automatically adjusted and the fine-tuning of the deep neural network classifier is triggered.
[0067] In one embodiment, dynamic risk control includes: (1) Event trigger: listen to the operator's data stream SIM card replacement incident ≥3 cities visited per day The frequency of calls suddenly increased in the early morning. (2) Incremental Calculation Engine: Real-time computation using Flink: ┌──────────────┐ ┌───────────┐ Event Flow -> Feature Window Aggregation -> Lightweight Model Inference └──────────────┘ └───────────┘ (3) Decision feedback closed loop: When the risk score change ΔS > 0.2, the manual review process is triggered. 3.4 Data Security Solution (1) Differential privacy processing: Add Laplace noise to the call log: f(x) = f(x) + Lap(Δf / ε) (2) Federated Feature Extraction: The feature extractor is deployed on the operator's side, and only the feature vector is output to the financial institution.
[0068] The abnormal event detection includes: using Fast Fourier Transform to analyze the fluctuation characteristics of the changing frequency of the device; when the spectral energy suddenly increases in a preset frequency band, it is determined to be abnormal, and the abnormal event serves as the input to trigger the secondary security verification process.
[0069] The secondary security verification process includes: combining voiceprint biometrics with cross-carrier base station topology verification, using homomorphic encryption algorithms in the verification process, and automatically executing when the user's risk probability score exceeds the decision boundary.
[0070] Voiceprint recognition is a biometric authentication method and a type of biometric technology. Biometric technologies verify identity through an individual's physiological or behavioral characteristics (such as fingerprints, facial features, and voiceprints). Voiceprint recognition identifies a user by analyzing characteristics of their voice (such as pitch, timbre, and speech rate). In security verification, voiceprint recognition can serve as an important means of identity verification.
[0071] Cross-carrier base station topology verification involves the base station topology structure within a communication network. Base stations are critical nodes in mobile communication networks, responsible for transmitting and receiving wireless signals. Cross-carrier base station topology verification involves the communication network structure between multiple carriers and is used to verify the legitimacy of user identities or communication paths. This verification may be used to enhance communication security and prevent unauthorized access.
[0072] Homomorphic encryption is an encryption technique that allows computation to be performed on encrypted data, supporting addition or multiplication operations, with the result ultimately decrypted by the data holder. This technique protects data privacy, ensuring that data is not leaked during processing. In this invention, homomorphic encryption is used to protect the privacy and security of user data, ensuring that data is not accessed without authorization during the verification process.
[0073] User risk probability scoring and decision boundaries. In security verification, risk assessment is typically performed based on user behavior or characteristics. If a user's risk score exceeds a preset threshold (i.e., the decision boundary), the system will automatically perform further verification or take appropriate security measures. This mechanism can improve system security and prevent malicious behavior or unauthorized access.
[0074] Example 3 The present invention also proposes a risk identification system, which includes: The secure data acquisition module is used to encrypt and acquire and preprocess multi-dimensional native behavioral data streams, and output preprocessed data. The feature construction engine, connected to the security data acquisition module, is used to extract communication pattern feature vectors, device behavior feature vectors, and interaction semantic feature vectors in parallel based on the preprocessed data, and to construct a dynamic weighted hypergraph communication graph to output social risk feature vectors. The privacy-aware fusion module is connected to the feature construction engine and is used to receive the communication mode feature vector, device behavior feature vector, interaction semantic feature vector and social risk feature vector, and output the fused features through a gating attention mechanism. The streaming risk calculation module, based on the Apache Flink engine, is connected to the privacy-aware fusion module and is used to calculate the user risk probability score in real time. The dynamic decision-making module, connected to the streaming risk calculation module, is used to adjust the decision boundary and trigger secondary verification by combining dynamic risk entropy. The privacy optimization module, integrated into the secure data acquisition module and feature construction engine, is used to implement differential privacy algorithms.
[0075] The secure data acquisition module is used to encrypt and preprocess multi-dimensional raw behavioral data streams, outputting preprocessed data. This module involves data encryption and preprocessing to ensure data privacy protection during the acquisition phase.
[0076] The feature construction engine connects to the security data acquisition module to extract communication pattern feature vectors, device behavior feature vectors, and interaction semantic feature vectors in parallel based on preprocessed data, and constructs a dynamically weighted hypergraph communication graph to output social risk feature vectors. This module involves multimodal feature extraction and graph construction.
[0077] The privacy-aware fusion module connects to the feature construction engine, receiving communication pattern feature vectors, device behavior feature vectors, interaction semantic feature vectors, and social risk feature vectors, and outputting fused features through a gating attention mechanism. This module involves multimodal feature fusion and attention mechanisms.
[0078] The streaming risk computation module is implemented based on the Apache Flink engine and connects to the privacy-aware fusion module for real-time calculation of user risk probability scores. This module involves real-time streaming computation, and all related aspects involve Apache Flink's streaming computation technology, particularly highlighting Flink's application in streaming computation, supporting real-time data processing and low-latency computation.
[0079] The dynamic decision-making module connects to the streaming risk calculation module and is used to adjust the decision boundary and trigger secondary verification by combining dynamic risk entropy. This module involves dynamic risk adjustment and decision-making mechanisms.
[0080] The privacy optimization module is integrated into the secure data acquisition module and the feature construction engine to implement differential privacy algorithms.
[0081] As can be seen, this system combines multimodal feature extraction, privacy protection, real-time streaming computing, dynamic risk adjustment, and privacy protection technologies to achieve financial risk identification. It utilizes Apache Flink for real-time streaming computing, combined with multimodal feature fusion and privacy protection technologies, to achieve efficient and secure financial risk identification.
[0082] Specifically, the privacy optimization module is used to: apply a random response mechanism to the device identifier at the data acquisition end, add Laplacian noise to the hypergraph query in the feature construction engine, and add Gaussian noise at the federated learning aggregation end.
[0083] Example 4 This disclosure provides a non-volatile computer storage medium storing computer-executable instructions that can perform the steps described in the above embodiments.
[0084] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.
[0085] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.
[0086] Computer program code for performing the operations of this disclosure can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, and conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (AN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0087] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0088] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not, in some cases, intended to limit the specific unit.
[0089] The preferred embodiments of the present invention have been described above to make the spirit of the present invention clearer and easier to understand, and are not intended to limit the present invention. All modifications, substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope summarized by the appended claims.
Claims
1. A risk identification method, comprising the following steps: Step S101: Real-time acquisition of multi-dimensional native behavior data streams transmitted with user authorization and encryption. The multi-dimensional native behavior data streams include three types of heterogeneous data sources: communication behavior data, device fingerprint data, and business interaction data. Step S103: Preprocess the multi-dimensional native behavioral data stream into multimodal data; Step S105: Input the multimodal data into the feature construction engine to obtain the corresponding feature vectors, which include communication mode feature vectors, device behavior feature vectors, interaction semantic feature vectors, and social risk feature vectors. Step S107: Output fused features based on the corresponding feature vectors; Step S109: Input the fused features into a deep neural network classifier to identify the user risk.
2. The method as described in claim 1, wherein in step S105, communication mode feature vectors are extracted based on communication behavior data, device behavior feature vectors are extracted based on device fingerprint data, and interaction semantic feature vectors are extracted based on business interaction data using a natural language processing model.
3. The method of claim 1, wherein the social risk feature vector is obtained by the following steps: A dynamic weighted hypergraph communication graph is constructed based on the communication behavior data, where nodes represent users and hyperedges represent multidimensional communication relationships. The dynamic weighted hypergraph communication graph is processed using a temporal hypergraph neural network to extract node embedding representations. Based on these node embedding representations, the deviation between node penetration rate and community modularity is calculated, and a social risk feature vector is output.
4. The method of claim 1, wherein step S107 comprises the following steps: A cross-modal attention mechanism is applied to learn the interaction weights of each modality; Redundant information is filtered through the gating unit; Inject differential privacy noise to protect feature privacy.
5. The method of claim 1, wherein the temporal hypergraph neural network adopts a federated learning architecture, each user node trains its own node embedding representation locally, uploads the global model through secure multi-party aggregation, and adds center difference privacy noise, and the node embedding representation is used to calculate the social risk feature vector.
6. The method of claim 5, wherein the extracting of the device behavior feature vector comprises: It aggregates the International Mobile Equipment Identity (IMEI) serial numbers of users within past time windows, calculates the frequency, and determines the device change entropy value.
7. The method of claim 1, wherein the method further comprises: The system uses the Apache Flink engine to monitor abnormal events in the data stream in real time and dynamically adjusts the decision boundary based on risk entropy. When an abnormal event is detected and the user's risk probability score exceeds the decision boundary, a secondary security verification process is triggered.
8. The method of claim 1, wherein the anomaly event detection comprises: The fluctuation characteristics of the frequency change device are analyzed using Fast Fourier Transform. When the spectral energy suddenly increases in the preset frequency band, it is determined to be abnormal. The abnormal event serves as the input to trigger the secondary security verification process.
9. The method of claim 7, wherein the two-factor security verification process comprises: Combining voiceprint biometrics with cross-carrier base station topology verification, the verification process uses a homomorphic encryption algorithm and is automatically executed when the user's risk probability score exceeds the decision boundary.
10. A risk identification system, comprising: The secure data acquisition module is used to encrypt and acquire and preprocess multi-dimensional native behavioral data streams, and output preprocessed data. The feature construction engine, connected to the security data acquisition module, is used to extract communication pattern feature vectors, device behavior feature vectors, and interaction semantic feature vectors in parallel based on the preprocessed data, and to construct a dynamic weighted hypergraph communication graph to output social risk feature vectors. The privacy-aware fusion module is connected to the feature construction engine and is used to receive the communication mode feature vector, device behavior feature vector, interaction semantic feature vector and social risk feature vector, and output the fused features through a gating attention mechanism. The streaming risk calculation module, based on the Apache Flink engine, is connected to the privacy-aware fusion module and is used to calculate the user risk probability score in real time. The dynamic decision-making module, connected to the streaming risk calculation module, is used to adjust the decision boundary and trigger secondary verification by combining dynamic risk entropy. The privacy optimization module, integrated into the secure data acquisition module and feature construction engine, is used to implement differential privacy algorithms.