A data processing method and related apparatus

Abstract

The application discloses a data processing method and related device, and relates to the technical field of artificial intelligence, comprising: listening to the transaction events output by the blockchain event bus, sequentially pushing each transaction event to the transaction buffer queue according to the position information of each transaction event, wherein the position information comprises the block height and the transaction index in the block; performing graph structure mapping according to the transaction events in the sliding window in the transaction buffer queue, constructing a multi-flow heterogeneous graph, wherein the multi-flow heterogeneous graph comprises a plurality of homogeneous sub-graphs divided according to transaction types; performing feature extraction on the multi-flow heterogeneous graph, determining the risk probability of each edge; and performing a risk control operation based on the risk probability.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a data processing method and related apparatus. Background Technology

[0002] In blockchain ledger scenarios, events such as top-ups, refunds, and ledger splits are typically merged into a single-layer weighted graph. Edge semantics are compressed into uniform weights, making it difficult to explicitly represent the closed-loop path involving bank escrow accounts within the graph structure. Node embedding relies on random walks or local aggregations, failing to simultaneously preserve the global continuity of cross-project migration links. Time-dimensional processing employs a topology-first, time-later stitching strategy, introducing alignment errors during window sliding. Therefore, it is difficult to achieve real-time identification and interception of cross-project fund transfers under conditions of scarce risk samples, multiple parallel transaction streams, and the need for sub-second response times for freezes. Summary of the Invention

[0003] In view of the above problems, this application provides a data processing method and related apparatus. The specific solution is as follows: A data processing method, comprising: Listen to the transaction events output by the blockchain event bus, and push each transaction event to the transaction buffer queue in sequence according to the location information of each transaction event, wherein the location information includes the block height and the transaction index within the block; A graph structure mapping is performed based on the transaction events within the sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph, which includes multiple homogeneous subgraphs divided according to transaction type. Feature extraction is performed on the multi-flow heterogeneous graph to determine the risk probability of each edge; Risk control operations are performed based on the aforementioned risk probability.

[0004] In one possible implementation, a graph structure mapping is performed based on transaction events within a sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph, including: When the length of the transaction buffer queue reaches a preset threshold for the number of transactions, an initial sliding window is generated; In response to the generation of the initial sliding window, based on the transaction information of each initial transaction event within the initial sliding window, the addresses involved in each transaction event are mapped to nodes of the corresponding type, and directed edges are generated according to the transaction type to construct the initial multi-flow heterogeneous graph.

[0005] In one possible implementation, the graph structure mapping based on transaction events within a sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph further includes: Whenever a new transaction event is added to the transaction buffer queue, the first transaction event in the sliding window is removed, and the newly added transaction event is added to the sliding window. In response to each update of the sliding window, the transaction information of the newly added target transaction event within the sliding window is obtained, nodes and edges corresponding to the target transaction event are generated, and added to the multi-flow heterogeneous graph to perform incremental updates to the multi-flow heterogeneous graph.

[0006] In one possible implementation, feature extraction is performed on the multi-flow heterogeneous graph to determine the risk probability of each edge, including: Read the set of subgraph edges of each homogeneous subgraph and the set of subgraph nodes corresponding to each set of subgraph edges from the multi-flow heterogeneous graph; For each set of nodes in a subgraph, the nodes are numbered according to the first-see key to obtain the node identifier of each node; For each node, generate a node vector based on the node's attributes; for each edge, generate an edge vector based on the edge's attributes. For each edge, the node vector of the payer node, the edge vector, and the node vector of the payee node are concatenated according to the direction of fund flow to obtain the triplet vector corresponding to the edge. For each homoprime subgraph, stack the triple vectors according to the edge position information to obtain the subgraph tensor of the homoprime subgraph; Based on the subgraph tensor of the homoprime subgraph, the risk probability of each edge is determined.

[0007] In one possible implementation, the risk probability of each edge is determined based on the subgraph tensor of the homoprime subgraph, including: Based on the subgraph tensors of each homomorphic subgraph, determine the relationships between nodes and edges in each homomorphic subgraph; For each homoprotic subgraph, the homoprotic subgraph feature vector of each node is determined based on the aforementioned association relationship; Based on the feature vectors of the homoprotic subgraph, the structural embedding of the nodes is determined; The structural embeddings and edge sequences of each node are input into the temporal attention model to obtain the temporal embeddings of each node. The structural embeddings and temporal embeddings are concatenated to obtain the joint representation of each node. Based on the joint representation of each node, the risk probability of each edge is determined.

[0008] In one possible implementation, determining the structural embedding of nodes based on the feature vectors of the homoprime subgraph includes: Retrieve two-hop adjacent paths. When the flow of resources in the two-hop adjacent paths meets the preset flow conservation condition, inject the feature vector of the transit node as a bridging memory vector into the feature vector of the homo-prime graph to obtain an enhanced feature vector. Based on the gating vectors of each homoprotic subgraph and the overlap rate of the nodes, the weight of each homoprotic subgraph is determined, and the enhanced feature vectors are weighted and aggregated based on the weights to obtain the structural embedding of the nodes.

[0009] One possible implementation also includes: Pair the temporal embedding vectors of all edges within the time window with the fraud trajectory set according to transaction type to construct condition vectors, and cluster the condition vectors to obtain a condition index set. The condition index set is sequentially input into the recursive state generator to construct a candidate fraud sequence; The candidate fraud sequence and the real fraud sequence are input into the dual-scale discriminator one by one to obtain the authenticity judgment result and the violation location feedback result; Based on the results of the authenticity assessment and the feedback results of the violation location, adversarial training is conducted; After the adversarial training converges, the generator weights are fixed, and synthetic fraud sequences are continuously sampled from the condition index set and generated in batches.

[0010] One possible implementation also includes: Each synthetic fraud sequence is broken down into several transaction entries, and the addresses in the transaction entries are mapped to nodes of the corresponding type. Directional edges with timestamps are created according to the order in which the transactions occur, and a temporary graph of the synthetic flow is constructed. Add a source field and risk label to each edge in the synthetic flow temporary graph, sort all edges in ascending order according to timestamp, and encapsulate the edge set into a synthetic window according to a fixed sliding window length; Align the synthetic stream buffer with the real-time transaction sliding window according to the time boundary, and inject the synthetic window sequentially into the running multi-stream heterogeneous graph to obtain a unified graph structure; Perform an amount conservation check on the unified graph structure edge by edge. If all checks pass, save the unified graph structure as a graph snapshot and write the graph snapshot, window number, and start and end block heights into the training set directory.

[0011] One possible implementation also includes: The image snapshots are sent to the training scheduler in sequence according to the window number, forming batch index entries which are then written into the incremental fine-tuning input list. The node embedding layer parameters and cross-flow bridging operator parameters are fixed, and the weights of the open flow weight gating layer and the risk assessment head weights participate in the gradient update. The set of edges in the graph snapshot corresponding to the same batch of index entries is fed into the network inference to calculate the structural consistency loss and rhythm alignment loss. Based on the proportion of synthetic samples in each batch index entry, determine the target gradient cache, write the gradient of the batch index entry into the target gradient cache, and continue until all batches are processed. After training, the average values ​​of structural consistency loss and rhythm alignment loss in multiple consecutive batches are recorded in a rolling window. If all values ​​are lower than the preset threshold, the model is considered to have converged, the parameters of the current open layer are frozen, and a model version number is generated. Push the model version number to enable model version replacement.

[0012] One possible implementation also includes: Real-time monitoring of transaction events in the latest block production events of the platform's consortium blockchain; mapping transaction events as edges and appending them to a multi-stream heterogeneous graph; extracting the structural and temporal embeddings of affected nodes; calling the trained risk judgment model to perform local forward inference; and obtaining real-time risk probabilities. The real-time risk probability is compared side-by-side with the current threshold. If it is greater than the threshold, it is marked as a candidate for freezing. The list of frozen sub-accounts is then assembled by reverse tracing and a freezing instruction is sent to the bank's core system. If it is less than or equal to the threshold, a clearing confirmation signal is pushed to the clearing channel.

[0013] A data processing apparatus, comprising: The event listening unit is used to listen to the transaction events output by the blockchain event bus and push each transaction event to the transaction buffer queue in sequence according to the location information of each transaction event. The location information includes the block height and the transaction index within the block. The heterogeneous graph generation unit is used to perform graph structure mapping based on transaction events within a sliding window in the transaction buffer queue, and to construct a multi-stream heterogeneous graph, wherein the multi-stream heterogeneous graph includes multiple homogeneous subgraphs divided according to transaction type. The risk probability determination unit is used to extract features from the multi-flow heterogeneous graph and determine the risk probability of each edge. The risk control operation execution unit is used to perform risk control operations based on the risk probability.

[0014] An electronic device includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is configured to execute the computer program to enable the electronic device to implement the data processing method as described in any one of claims 1 to 10. By employing the above technical solutions, the data processing method and related apparatus provided in this application monitor transaction events output by the blockchain event bus, and sequentially push each transaction event to a transaction buffer queue based on its location information, including block height and transaction index within the block; perform graph structure mapping based on transaction events within a sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph, which includes multiple homogeneous subgraphs divided by transaction type; extract features from the multi-stream heterogeneous graph to determine the risk probability of each edge; and perform risk control operations based on the risk probabilities. In summary, this solution, by monitoring transaction events output by the blockchain event bus and sequentially pushing them to a transaction buffer queue, constructing a multi-stream heterogeneous graph based on transaction events within a sliding window, extracting features from the multi-stream heterogeneous graph to determine the risk probability of each edge, and performing risk control operations based on the risk probabilities, achieves real-time identification and interception of cross-project fund transfers. Attached Figure Description

[0015] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0016] Figure 1 A flowchart illustrating a data processing method provided in this application; Figure 2 A flowchart illustrating step S102 provided for this application; Figure 3 A flowchart illustrating step S103 provided for this application; Figure 4 This application provides a schematic diagram of a generative sample augmentation process; Figure 5 A schematic diagram of a synthetic sequence injection process provided in this application; Figure 6 A schematic diagram of an incremental fine-tuning process is provided for this application; Figure 7 A schematic diagram of an online reasoning process is provided for this application; Figure 8 A schematic diagram of the structure of a data processing device provided in this application; Figure 9 This is a schematic diagram of the structure of an electronic device provided in this application. Detailed Implementation

[0017] The embodiments of this application are described below with reference to the accompanying drawings. The terminology used in the implementation section of this application is for explaining specific embodiments only and is not intended to limit the scope of this application.

[0018] The embodiments of this application will now be described with reference to the accompanying drawings. Those skilled in the art will recognize that, with technological advancements and the emergence of new scenarios, the technical solutions provided in the embodiments of this application are equally applicable to similar technical problems.

[0019] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such terms are interchangeable where appropriate; this is merely a way of distinguishing objects with the same properties in the description of embodiments of this application. Furthermore, the terms "including" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion so that a process, method, system, product, or apparatus comprising a series of elements is not necessarily limited to those elements but may include other elements not explicitly listed or inherent to those processes, methods, products, or apparatuses.

[0020] This application provides a data processing method, which will be described in detail below with reference to the accompanying drawings.

[0021] Reference Figure 1 , Figure 1 This is a flowchart illustrating a data processing method provided in an embodiment of this application, such as... Figure 1 As shown in the embodiment of this application, a data processing method includes: S101: Listen to the transaction events output by the blockchain event bus, and push each transaction event to the transaction buffer queue in sequence according to the location information of each transaction event.

[0022] In this embodiment, the location information includes the block height and the transaction index within the block. Cross-block transactions are sorted in ascending order of block height, while transactions within the same block are sorted in ascending order of the transaction index within the block, to ensure the original time order.

[0023] S102. Based on the transaction events in the sliding window of the transaction buffer queue, perform graph structure mapping to construct a multi-stream heterogeneous graph.

[0024] In this embodiment, the multi-stream heterogeneous graph includes multiple homogeneous subgraphs divided according to transaction type. The sliding window is a fixed-length sequence of transaction events, used to extract consecutive transaction events from the transaction buffer queue for graph structure mapping.

[0025] S103. Extract features from the multi-flow heterogeneous graph and determine the risk probability of each edge.

[0026] In this embodiment, feature extraction is performed on the nodes and edges in the multi-flow heterogeneous graph to calculate the risk probability of each edge belonging to cross-project fund transfer.

[0027] S104. Perform risk control operations based on risk probability.

[0028] In this embodiment, the risk probability of each side is compared with a preset threshold, and corresponding risk control operations are performed based on the comparison results, including marking freeze candidates, sending freeze instructions, or pushing liquidation confirmation signals.

[0029] As can be seen from the above technical solutions, the data processing method provided in this application embodiment monitors the transaction events output by the blockchain event bus and pushes them sequentially to the transaction buffer queue. It constructs a multi-stream heterogeneous graph based on the transaction events in the sliding window, extracts features from the multi-stream heterogeneous graph to determine the risk probability of each side, and performs risk control operations based on the risk probability, thereby realizing the real-time identification and interception of cross-project fund transfers.

[0030] Reference Figure 2 , Figure 2 This is a flowchart illustrating step S102 provided in an embodiment of this application. Figure 2 Example S102 illustrates the specific implementation process of constructing a multi-stream heterogeneous graph by mapping the graph structure based on the transaction events within the sliding window in the transaction buffer queue, as follows: Figure 2 As shown, this method specifically includes: S201. Listen to the transaction events output by the blockchain event bus, extract the transaction information of the transaction events, and push the transaction events to the preset transaction buffer queue in sequence according to the location information.

[0031] In this embodiment, transaction events include top-ups, refunds, account splits, and receipts. Transaction information for each event includes transaction type, location information, and address information. Location information includes block height and intra-block transaction index, where the block height h is the height of the block containing the transaction event, and the intra-block transaction index k is determined based on the original block order. Address information includes payment address, contract address, and escrow account address.

[0032] In this embodiment, transaction events are represented by a binary key of the listening pointer p, i.e. In other words, the listening pointer p represents the position of the currently listened-to transaction event in the event stream.

[0033] In this embodiment, the method for pushing transactions to the transaction buffer queue in sequence according to location information is as follows: cross-block transactions are sorted in ascending order of block height, and transactions within the same block are sorted in ascending order of transaction index within the block. This ensures the original time order and does not depend on arrival time or memory pool order.

[0034] S202. When the length of the transaction buffer queue reaches the preset threshold for the number of transactions, a sliding window is generated. Whenever a new transaction event is added to the transaction buffer queue, the first transaction event in the sliding window is removed, and the newly added transaction event is included in the sliding window.

[0035] In this embodiment, the threshold for the number of transactions... This indicates the number of transactions that the sliding window can hold, which is also the fixed length of the sliding window.

[0036] In this embodiment, when the length of the transaction buffer queue first reaches... A sliding window is generated and its starting transaction number is locked. Whenever a transaction event enters the transaction buffer queue, the starting transaction of the sliding window is immediately released and the sliding window is shifted one position to the right. In this way, all transactions in the sliding window maintain their original time order. The strong sequential constraint ensures that the time information of cross-project fund transfer is not missing before entering the topology construction stage.

[0037] It should be noted that allowing only the initial transaction can prevent transactions within the sliding window from being disturbed by data that arrives later, ensuring that the edge sequence on which the topology is built is consistent with the final on-chain order. Especially in cross-project backflow detection, the rhythm depends on the anchor position of the first transaction. Allowing the first transaction first and then sliding the window can stabilize the rhythm characteristics.

[0038] Taking the current window as W1 as an example, W1=[ , ..., ( The initial transaction of W1 is... ,when Enter the transaction buffer queue and begin the transaction. Released, the rest The transaction is retained, and then the sliding window is moved one space to the right to update the sliding window. .

[0039] S203. In response to the generation of the initial sliding window, the initial transaction events are mapped to a graph structure based on the transaction information of each initial transaction event within the initial sliding window, so as to construct an initial multi-stream heterogeneous graph.

[0040] In this embodiment, the initial sliding window refers to the first sliding window generated after the length of the transaction buffer queue reaches the threshold of the number of transactions.

[0041] In this embodiment, the specific method for constructing an initial multi-stream heterogeneous graph by mapping the initial transaction events to a graph structure based on the transaction information of each initial transaction event within the initial sliding window is as follows: A1. According to the order of the initial transaction events in the initial sliding window, perform the following steps for each initial transaction event: map each address in the address information of the initial transaction event to different types of transaction nodes, and generate directed edges and their types between each transaction node according to the direction of fund flow indicated by the transaction type of the initial transaction event.

[0042] In this embodiment, different types of addresses are mapped to different types of preset node types. Optionally, payment addresses are mapped to investor nodes. Map the contract address to a project node Mapping the escrow account address to a bank node It should be noted that if a node corresponding to the initial transaction event already exists, it will be directly mapped to that node.

[0043] In this embodiment, the payer in the recharge transaction is the investor node. The recipient is a bank node. Then generate by point to Recharge side In the returned transaction, the payer is the bank node. The recipient is the investor node. , generated by point to The return edge In a split-payment transaction, the payer is the bank node. The recipient is the project node. , generated by point to Revenue sharing side In receipt transactions, the payer is the project node. The recipient is a bank node. , generated by point to receipt edge .

[0044] That is, the edge type of the recharge transaction is a recharge edge. The edge type for the returned transaction is a returned edge. The edge type of the revenue sharing transaction is revenue sharing edge. The edge type of a receipt transaction is a receipt edge. The direction of the edge indicates the direction of fund flow, that is, from the payer to the payee.

[0045] A2. Based on the transaction nodes mapped by all initial transaction events, construct a globally shared heterogeneous node set.

[0046] A3. For each target transaction type, generate a homoprotic subgraph of the target transaction type based on the set of directed edges corresponding to each target transaction type.

[0047] Among them, the homoprotic subgraphs of each transaction type share a global heterogeneous node set, and the homoprotic subgraph of the target transaction type only contains directed edges corresponding to the target transaction type.

[0048] A4. Aggregate the homogeneous subgraphs of all transaction types to obtain an initial multi-flow heterogeneous graph containing multiple homogeneous subgraphs and its graph information.

[0049] In this embodiment, the graph information includes the node attributes of each transaction node and the edge attributes of each side.

[0050] The node attributes include at least: node type identifier, node identifier, first-view key, node current balance, and cumulative inflow amount. The first-view key is the location information of the transaction event in which the node first participated; that is, the block height and transaction index within the block when the node is first referenced by a transaction, used to determine the order of node appearance in subsequent steps. Edge attributes include additional amount 'a', location information 'p' (i.e., p(h, k)), block timestamp 't', and transaction identifier 'γ'.

[0051] The node type identifier is used to characterize the type of a transaction node, which is either an investor node, a project node, or a bank node. The node identifier is used to uniquely identify a transaction node. The same address corresponds to the same node identifier in different instruction streams, but its node type identifier remains the role type corresponding to that address.

[0052] In other words, the initial multi-flow heterogeneous graph describes the transaction flow corresponding to the transaction type using a homoprime subgraph. Specifically, homoprime subgraphs Grc for recharge transaction flow, Grf for return transaction flow, Gps for split transaction flow, and Grt for receipt transaction flow are maintained according to the transaction type.

[0053] S204. In response to each update of the sliding window, obtain the transaction information of the newly added target transaction event in the sliding window, perform graph structure mapping on the transaction information of the target transaction event, and generate nodes and edges corresponding to the target transaction event.

[0054] In this embodiment, the target transaction event is the last transaction event in the sliding window, that is, the transaction event that has just entered the sliding window.

[0055] Specifically, the method for graph structure mapping of transaction information for a target transaction event includes: based on the transaction information, checking whether a node for the target transaction event exists in the current multi-flow heterogeneous graph; if it exists, directly mapping the target transaction event to that node; if it does not exist, generating a new node for the target transaction event. Based on the direction of fund flow indicated by the transaction type of the target transaction event, generating directed edges between the nodes of the target transaction event, and generating the attributes of the edges.

[0056] S205. Add the new node corresponding to the target transaction event, as well as the edge connecting the target transaction event and other nodes in the multi-flow heterogeneous graph, to the multi-flow heterogeneous graph to perform incremental updates to the multi-flow heterogeneous graph.

[0057] In this embodiment, new nodes are added to the homo-prime subgraph of the corresponding flow in the multi-flow heterogeneous graph according to transaction type, and each edge is added to the homo-prime subgraph of the corresponding flow in the multi-flow heterogeneous graph in sequence according to transaction type, so as to ensure that the parallel interaction between multiple projects, multiple investors and bank nodes is continuously presented in a single graph.

[0058] It should be noted that the node set of the multi-flow heterogeneous graph corresponds to all addresses on the chain. The same address corresponds to one node identifier in the multi-flow heterogeneous graph. Node types are not split according to transaction type, nor are nodes repeatedly constructed in different homogeneous subgraphs. Therefore, homogeneous subgraphs of different transaction types are shared at the node level.

[0059] Specifically, the listening pointer follows the position information. When a new transaction is approved, the payment address, contract address, and escrow account address are first searched in the node set based on the address information of the transaction. If the corresponding node already exists, it is reused directly.

[0060] If it does not exist, then create new investor nodes respectively. Project Nodes Bank nodes Add the nodes to the multi-flow heterogeneous graph. After node confirmation, based on the transaction type, generate a directed edge from the payment node to the receiving node in the corresponding homogeneous subgraph, transferring the amount... Location information Block timestamp Instruction identifier Write the attributes into the edge attributes, and then... The edges are appended to the edge set of the homomorphic subgraph in ascending order. If the same edge appears... Furthermore, for duplicate events with identical transaction hashes, only the first record is retained to avoid duplicate edge recording.

[0061] As can be seen from the above technical solutions, the data processing method provided in this application embodiment achieves efficient structured processing and real-time incremental updates of blockchain event streams by constructing a multi-stream heterogeneous graph based on a sliding window.

[0062] First, by using a transaction buffer queue with location indexes, transaction events are strictly ordered according to block height and transaction index within the block, thus solving the out-of-order problem that may be caused by asynchronous arrival of blockchain data.

[0063] Secondly, a sliding window mechanism with preset thresholds divides the continuous transaction flow into fixed-length analysis units. Local graph structure mapping is performed only on newly added single transactions as the window slides, avoiding full-scale redundant calculations and significantly improving the real-time performance and computational efficiency of streaming processing. The sequential sliding window, combined with the diversion of four transaction types—deposit, refund, split, and receipt—ensures that the same fund falls within the same window as a continuous edge sequence during the deposit, split, and receipt / refund round trips. The window length and the threshold for only allowing the first transaction of the window are set according to the service level agreement of the clearing system. This ensures that the total inflow and outflow amounts within the window are conserved, and the cumulative amount for the same document number does not exceed the limit, covering the complete rhythm of a fund from deposit to receipt / refund, while controlling the detection delay within one window step. Unreleased transactions are not lost but remain in the transaction buffer queue and slide into the next window, sacrificing at most one window length of latency to maintain the stability of the on-chain native order and rhythm characteristics.

[0064] The final constructed multi-flow heterogeneous graph adopts a composite structure of globally shared nodes and edge separation by type. This means that the same address corresponds to a unique node instance in different transaction flows, ensuring traceability of fund paths across transaction types (recharge, refund, splitting, receipt). Each transaction type's homoprotic subgraph maintains an independent edge set, preserving the semantic specificity of transaction flows while achieving deep fusion of multi-flow information through shared nodes. Most existing solutions compress multiple transaction edges into a single-layer weighted graph. This embodiment constructs a multi-flow heterogeneous graph using four layers of homoprotic subgraphs, providing a structural foundation for subsequent loop closure detection and risk identification.

[0065] In summary, this method, while ensuring strong sequential constraints on blockchain data, achieves efficient incremental construction of graph structures and visualization analysis of multi-dimensional fund flows, providing a reliable data foundation for on-chain fund tracking, risk identification, and cross-project interaction analysis.

[0066] Based on the above embodiments, each time the sliding window is updated, a forward calculation is performed on the current sliding window to obtain the latest node structure embedding, temporal embedding, and edge risk probability. Based on this, referring to... Figure 3 , Figure 3 This is a flowchart illustrating step S103 as provided in an embodiment of this application.Figure 3 This example illustrates S103, which is the specific implementation process for extracting features from a multi-flow heterogeneous graph and determining the risk probability of each edge. For instance... Figure 3 As shown, this method specifically includes: S301. Read the set of subgraph edges of each homogeneous subgraph and the set of subgraph nodes corresponding to each set of subgraph edges from the multi-flow heterogeneous graph.

[0067] In this embodiment, the subgraph edge set of a homogeneous subgraph refers to the set of edges belonging to that homogeneous subgraph. The subgraph edge set of a homogeneous subgraph includes all edges belonging to the edge type corresponding to the homogeneous subgraph. Specifically, the subgraph node sets are read from the recharge layer G_rc, the refund layer Grf, the revenue sharing layer Gps, and the receipt layer Grt, respectively, and these are the recharge edge sets. Back edge set Separate accounting edge collection and the set of return edges The set of nodes corresponding to each set of edges in a subgraph includes the set of nodes connected by all edges in the set of edges in the subgraph. For example, the set of nodes of the set of edges in a subgraph, Ex, is V(Ex) = {u, v; (u→v)∈Ex}.

[0068] S302. For each subgraph node set, number the nodes in the subgraph node set sequentially according to the first-see key to obtain the node identifier of each node.

[0069] In this embodiment, the node identifier is used to uniquely identify a transaction node instance, facilitating the reuse of nodes corresponding to the same address and the completion of lookup and edge connection in a multi-flow heterogeneous graph. Specifically, the first-view key of each node refers to the location information of the transaction event in which the node first participated. For example, if the transaction event in which the first node first participated is the first rollback transaction, then the location information of the first rollback transaction is the first-view key of the first node.

[0070] It should be noted that when the node identifier is read sequentially along the edge set of the four types of instruction streams, all nodes are numbered once under the same numbering rule. The first appearance order of the node is determined by the first key of the node and the node identifier is assigned. When the same address appears in the subgraph node set of other homogeneous subgraphs in the future, the already assigned node identifier is directly reused, thereby ensuring that the same address shares the same node identifier across the four streams, and different addresses correspond to different node identifiers.

[0071] It should be further noted that if the first keys are the same, the transaction hashes are compared and numbered sequentially according to the size of the hash values.

[0072] S303. For each node in the subgraph node set, generate a node vector based on the node attributes, and for each edge, generate an edge vector based on the edge attributes.

[0073] In this embodiment, node attributes such as node type identifier, current node balance, and cumulative inflow amount of the project are merged into a node vector.

[0074] S304. For each edge in the subgraph edge set, concatenate the node vector of the payer node, the edge vector, and the node vector of the payee node according to the direction of fund flow to obtain the triplet vector corresponding to that edge.

[0075] In this embodiment, for each edge within the sliding window that is sorted by position information Take the starting node of the edge in sequence. The node vector, the edge vector of the edge, and the endpoint node. The node vectors are concatenated into a triplet vector in the order of node, edge, node.

[0076] S305. For each homogeneous subgraph, according to the position information of the edges in the subgraph edge set, stack the triple vectors corresponding to all edges in sequence to obtain the subgraph tensor of the homogeneous subgraph.

[0077] In this embodiment, the subgraph tensor of the homoprotic subgraph corresponds to the tensor representation of the instruction flow within the homoprotic subgraph in the current sliding window.

[0078] Furthermore, the subgraph tensor of each homogeneous subgraph is written into a tensor buffer. Specifically, the edge tensor of the subgraph edge set contains a triple vector for each edge, and each triple vector contains information about the payer node, the edge, and the payee node. This preserves both the structural differences of the four types of instruction flows and the rhythm of fund transfers determined by location information. The same node reuses the same node vector across multiple edges, and the repetition of this vector in different triple vectors naturally encodes topological adjacency relationships.

[0079] S306. Based on the set of subgraph nodes and the set of subgraph edges of each homogeneous subgraph, extract the starting node, transaction type, and ending node of each edge, and construct the set of triples for each homogeneous subgraph.

[0080] In this embodiment, the triple set includes multiple transaction triples, and each transaction triple includes a payer node, a transaction type, and a payee node.

[0081] In this embodiment, for the recharge subgraph G_rc, the refund subgraph G_rf, the revenue sharing subgraph G_ps, and the receipt subgraph G_rt, the starting node, the ending node, and the transaction type (recharge, refund, revenue sharing, or receipt) of each edge in the subgraph edge set are extracted from each edge based on the node information in their respective subgraph node sets. This yields a transaction triplet for each edge. Based on the transaction triplets of all edges, a triplet set is constructed.

[0082] S307. For each homoprotic subgraph, feature fusion based on the set of triples is performed to obtain the homoprotic subgraph feature vector of each node.

[0083] In this embodiment, for each homoprotic subgraph, the direct adjacencies (i.e., adjacent node pairs connected by an edge) are classified according to node type. Merge, receive domain messages The role domain channel weight matrix is ​​used. The messages within the domain are accumulated to complete the fusion of features of the same role within the same prescaler, and the final output is the feature vector of the node in the same prescaler. This is used for subsequent bridging memory injection and structural embedding calculations.

[0084] S308. When the flow of resources in two adjacent paths meets the preset flow conservation condition, the two adjacent paths are determined to be closed-loop paths, and the feature vector of the transit node is injected into the feature vector of the homoprotic subgraph as a bridging memory vector to obtain an enhanced feature vector.

[0085] In this embodiment, the flow conservation condition includes: and That is, paths exist within the same window. (The middle node is a bank node) And the amounts on both sides are equal. This indicates a suspicious two-hop transfer pattern where the amount of funds entering and leaving the bank is conserved.

[0086] Specifically, bridging memory vectors Satisfies: When there exists a set of transit nodes that conserves the amount of resources transferred. When the condition is met, the mean of the feature vectors of all transit nodes in the transit node set is taken; otherwise, the zero vector is used as follows: ; Taking node v as an example, the enhanced feature vector after injecting the bridging memory vector is: .

[0087] in, For nodes Bridge memory vector, To and A set of bank nodes forming a closed loop with equal amounts. For bank nodes in the revenue sharing flow Temporary characteristics; , The amount is for the corresponding side. It is a vector of all zeros, specifically, Address within the current window to the bank The amount of payment, For banks To address The withdrawal amount; when the same sum of money is split and transferred, it often happens that the two withdrawals have the same amount, take... The determination of conservation closure triggers bridging, which explicitly amplifies the cross-project transport features in the graph space.

[0088] In this step, within the multi-flow heterogeneous graph, centered on the bank node, two-hop adjacent paths are retrieved, and a conservation check is performed on the amounts along the paths: when the amounts of the preceding and following edges within the same window satisfy... And the cumulative amount associated with the document number does not exceed the upper limit. When a closed loop of monetary conservation is formed, bridging memory is triggered, and the characteristics of the bank node are injected into the starting and ending nodes to amplify the cross-project transfer characteristics.

[0089] S309. Based on the gating vectors of each homoprotic subgraph and the overlap rate of the nodes, determine the weight of each homoprotic subgraph, and perform weighted aggregation of the enhanced feature vectors based on the weight of each homoprotic subgraph to obtain the structural embedding of the nodes.

[0090] In this embodiment, a flow weight gating merger is used for dynamic weight adjustment. The flow weight gating merger maintains a gating vector for each instruction stream. and with nodes The overlap rate that occurs simultaneously in multiple flows As a control signal, the Sigmoid function is used to adjust the flow weights of each instruction stream.

[0091] ; in: For nodes structural embedding; For activation functions; Instruction stream indexes are used to sequentially assign values. ,return Revenue Sharing ,receipt ; For nodes In the flow Gating weights on; For nodes Cross-flow overlap rate (occurring in several flows / 4); For flow The learnable scaling factor.

[0092] Furthermore, the structure of all nodes is embedded and written back to the tensor buffer.

[0093] S310. Input the structural embedding and edge sequence of each node into the temporal attention model to obtain the temporal embedding of each node. Concatenate the structural embedding and the temporal embedding to obtain the joint representation of each node.

[0094] In this embodiment, the incoming and outgoing edges of node v on the four homogeneous subgraphs are collected and denoted as N(v). The edge sequence is obtained by sorting the position information in ascending order.

[0095] In this embodiment, the temporal attention model calculates the positional correlation coefficient for each edge sequence formed by the same node within a continuous window, and then performs a weighted summation according to attention weights to obtain a temporal embedding representing the rhythm of capital inflows and outflows. Subsequently, the structural embedding and the temporal embedding are concatenated as vectors to form a joint representation that simultaneously contains topological and rhythmic information. .

[0096] It should be noted that the node structure is embedded. It does not depend on the temporal order of edges, but is obtained by a multi-flow graph neural network through adjacency relationships on the topological structure of a multi-flow heterogeneous graph. It reflects the structural position of nodes within the current window and cross-flow closed-loop information. The temporal order is only embedded in the computation time sequence. It takes effect at that time.

[0097] S311. Based on the joint representation of each node, determine the risk probability of each edge.

[0098] In this embodiment, for each edge e, based on the joint representation of its starting node u and ending node v... and By combining the edge vectors of edge e, we can construct a joint representation of the edges. = [ , [, edge vector]. The input risk assessment layer, after mapping through a fully connected layer and passing through a Sigmoid activation function, yields the risk probability R(e) = σ(MLP( The larger R(e) is, the higher the risk of cross-project fund transfer.

[0099] At the same time, the temporal embedding of the edges Copy as a temporal embedded copy, and cache the temporal embedded copies of each edge in the copy cache area.

[0100] It should be noted that in a single forward inference operation, the system obtains two types of output results simultaneously. One type is the scalar risk probability of each edge. Another type is the temporal embedding corresponding to this edge. The copy, also known as the temporal embedded copy, does not participate in the risk probability calculation within the current window. It is only used for subsequent generative fraud sample injection as a priori feature describing the rhythm of fund inflows and outflows.

[0101] S312. Write the risk probability of each edge back to the edge attribute of the corresponding edge in the multi-flow heterogeneous graph. In response to the risk probability being no less than the preset freeze judgment threshold, add a freeze candidate marker.

[0102] In this embodiment, when R(e) ≥ θ_frz, the edge is marked as a freeze candidate to trigger a freeze operation before the splitting instruction is submitted; when R(e) < θ_frz, it is only recorded as a normal sample. Simultaneously, (tx-hash, account / project ID, path ID, R(e), H_tm(e), window number) is sent as an event to the risk control bus, synchronously calling the custodian bank's freeze determination microservice. The receiver compares R(e) with θ_frz and stores the data, without modifying the threshold.

[0103] As can be seen from the above technical solutions, the data processing method provided in this application vectorizes the nodes and edges of the multi-flow heterogeneous graph and stacks them into subgraph tensors, and completes the fusion of features of the same role according to node type within the same subgraph. On this basis, explicit feature injection is completed at the two-hop closed loop of the bank node through the cross-flow bridging aggregation operator, so that the cross-project transport link is captured in the structural space as a complete path rather than local similarity; at the same time, the flow weight gating mechanism is used to dynamically allocate weights according to the cross-flow overlap rate of the nodes to achieve synchronous strengthening of topological associations. After detecting the two-hop amount conservation closed loop and generating the bridging memory vector, the flow weight gating merger is used to add the bridging memory vector to the subgraph feature vector, and aggregates it according to the node overlap rate to output the structural embedding of the node.

[0104] Furthermore, by inputting structural embeddings and edge sequences into a temporal attention model, a joint representation encompassing both topological structure and temporal order is obtained. The common topology-temporal separation encoding in existing technologies is replaced by in-situ coupling of temporal attention and structural embedding. During window sliding, sequence realignment is no longer relied upon, thus maintaining consistency between rhythmic information and the global path under second-level update conditions. Amount conservation checks are performed on two-hop paths within the same window, making closed loops satisfying the conservation relationship explicitly marked in the graph. A receipt refers to an on-chain confirmation transaction after the completion of a revenue-sharing link. It shares the same group-id field as the corresponding revenue-sharing transaction, therefore, when inputting into the graph, a receipt edge is still generated according to the payment direction, forming a closed-loop link together with the recharge edge and revenue-sharing edge.

[0105] Furthermore, based on the joint representation, the risk probability of each edge is calculated, the temporal embedded copy is stored in the cache, and the risk probability is written back to the edge attributes and compared with the freezing threshold. Thus, this embodiment realizes a complete process of extracting node structural features and edge temporal features from a multi-stream heterogeneous graph, calculating edge-level risk probabilities, and marking and freezing candidate edges, providing a basis for edge-level risk judgment for real-time risk control.

[0106] Reference Figure 4 , Figure 4This is a schematic diagram of a generative sample augmentation process provided in an embodiment of this application. Figure 4 The specific implementation process of generative sample augmentation is illustrated, such as... Figure 4 As shown, this method specifically includes: S401. Pair the temporal embedding vectors of all edges within the time window with the fraud trajectory set according to transaction type to construct condition vectors. Cluster the condition vectors to obtain the condition index set.

[0107] In this embodiment, the edge attributes for each edge within the time window include edge identifier and transaction type. ), timestamp, and time-series embedding vector. This represents a matrix consisting of the temporal embedding vectors of all edges within the window. Represents a set of fraud trajectories. This represents the indexes for four types of transactions. Among them, the fraud trajectory set includes labeled cross-project transfer trajectories, and each trajectory contains an edge sequence, a transaction type sequence, a timestamp sequence, and a risk label.

[0108] In this embodiment, the matched... Its tags / track identifiers (and stream types) The sample entries, i.e., the condition vectors, are obtained by concatenating the data. .

[0109] In this embodiment, for each Extract three discriminative features: number of cross-project jumps Rhythm fluctuation amplitude Participating in role combinations Furthermore, based on cosine similarity, the condition vectors are progressively clustered to obtain a set of condition indexes covering various copying methods. .in, This includes: storing the cluster center vector, cluster radius, list of representative path IDs, and flow class for each index. Statistical thresholds (such as...) , ), Role Mode With window number and quota rules; used for generator startup and online matching.

[0110] In this embodiment, for each labeled trajectory and the high-risk trajectory of a classmate, the time embedding of their edges is taken in their original order. Weighted average to form path vector Then classify the streams One-hot, cross-project jump count Rhythm fluctuation Character fingerprints Quota ratio spliced ​​as Hierarchical clustering is performed using cosine similarity, with cluster centers representing the conditional index set. .

[0111] S402. Input the condition index set into the recursive state generator in sequence. In a single recursive loop, complete the five stages of rhythm evolution, project selection, amount allocation, role mapping and memory update to gradually construct the candidate fraud sequence.

[0112] In this embodiment, the method for progressively constructing candidate fraud sequences includes: A1. Initialize the book memory matrix Where row index i∈{INV,PROJ,BANK} corresponds to node type, column index j corresponds to address, and matrix elements Stores the current available balance or cumulative inflow. Synchronously establishes a document quota mapping. Vector elements Record ID number Amount already spent.

[0113] Specifically, initialization involves writing the three types of accounting entries for each node at the window's starting point into the matrix. (Row: INV / PROJ / BANK; Column: Address). Subsequently, each time a triple is generated or written back, the corresponding column is... of By amount Add or remove items in real time and record them in the database for use in the next round.

[0114] A2. Extract historical time interval sequences from node-associated edges. Invoke rhythm-driven gating Calculate the next time increment To maintain a trigger frequency that matches the actual transport rhythm.

[0115] A3. Construct a transition probability vector based on the closed-loop probability of bank nodes across different projects. Introducing a penalty function for document limits Suppress targets that are close to their limits and calculate the final sampling distribution. And extract target projects .

[0116] In this embodiment, ; in, For sampling distribution of items The probability of; This represents the original cross-project jump probability; For the quota penalty function, as Monotonically increasing; For ID number Amount already spent; This is the maximum limit for the amount of the document.

[0117] The following embedding and tag concatenation, memory matrix, explicit probability sampling and trigger rhythm control are all used to illustrate how the condition index set generated by S401 serves as the input constraint for the S402 recursive state generator. The purpose is to unify the temporal embedding, business role, amount limit and risk tag into a decodable conditional state.

[0118] Specifically, the data embedded with labels refers to: for each labeled training edge Take its temporal embedding vector It is then concatenated with the edge's metadata by dimension. The metadata includes: transaction direction (starting and ending node identifiers) and time sequence key. Amount Document ID, Account Role (one-hot encoding of INV / PROJ / BANK), and Command Stream Category Credit limit and the edge in the interbank distance matrix Wait; then add a supervision label to the last dimension. (0 represents normal samples, 1 represents samples moved across projects), forming a training sample vector, which is used as input to the discriminator or classification head.

[0119] Memory Matrix Defined as a A real matrix, where elements Indicates from node Flow to Node The cumulative historical amount of money transferred. Before the first window begins, All edges are initialized to 0; subsequently, whenever an edge... When the model determines that the data is being moved across projects and passes the threshold screening, then... Update the corresponding element. The generator reads the current element during the decoding phase. As long-term memory, it is used to constrain the role mapping and quota allocation of virtual samples. Therefore, "initialization" only means that all elements are 0 at the initial moment, and the updated values ​​will be continuously brought in as the window scrolls. It is not reset to zero every time.

[0120] The random sampling mentioned in the steps does not involve arbitrarily selecting accounts, but rather sampling according to an explicit probability distribution. For each candidate item... Based on the number of cross-project jumps Node rhythm fluctuations Character combination and the proportion of quota Calculate sampling probability Press again The constructed multinomial distribution performs one roulette wheel sampling, selecting one or more items to inject into the generated sample; when If the value is below a set threshold, it will not participate in the sampling, thus ensuring that the sampling process closely corresponds to the conditional features, rather than being purely random.

[0121] The trigger frequency in the next time interval is determined by the time decay coefficient. With discrete time step Joint control. Based on block height difference. or the time difference between adjacent transactions Discretized into time steps and set These are hyperparameters or learnable parameters that ensure the generated trajectory's expected number of hops within a unit window is close to the average number of hops of a real cross-project transport trajectory, as follows: ; This controls the triggering rhythm of the same account across consecutive time steps, matching the jump frequency statistics observed in the training set. Among these, the project node set... Investor Node Set Bank node set ,in For a certain project Calculated This represents the probability that the project will be selected for generative injection. (Based on historical freeze records.) Read the complete path Based on its conditional characteristics, construct a conditional index set. Used for decoder training and condition matching.

[0122] A4. For the selected items Search A pool of funds that meets the condition of amount conservation And use concealment scoring Distribute transfer amount Then, the role mapping module is called to output the transaction triples. ,in , Addresses are taken from investor, project, or bank addresses respectively to ensure the authenticity and feasibility of the entire transfer chain in terms of roles.

[0123] In this embodiment, the roles are first determined. The role is determined by the current instruction flow / generation step (e.g., INV→BANK, BANK→PROJ, PROJ→BANK, etc.), ensuring the feasibility of the link role.

[0124] In this embodiment, if the role is INV / PROJ: from the selected item The corresponding set of investor / project addresses is used, and the role is BANK: taken from the set of bank addresses (can be across projects).

[0125] In this embodiment, in bookkeeping The fund pool is filtered, retaining only source addresses that meet the payment requirements. : (or use first) Decide again Hiddenness scoring Sampling / sorting selection points, for candidates according to (Multiply by remaining credit limit, etc.) Take the maximum or sample by weight. Extract the amount under constraints. When conservation is required, directly set Equal to the amount corresponding to the previous jump; otherwise: from Internal sampling / allocation based on strategy.

[0126] A5. Real-time updates of the book memory matrix B and the document limit mapping Q.

[0127] In this embodiment, for and Real-time write-back of balance and credit limit consumption, as follows: , , When all investors' balances are exhausted or the generated sequence length reaches the window limit. The recursion terminates when the time is right, and the output contains Candidate fraud sequences for triples and amount fields .

[0128] In this embodiment, the investor's balance is stored in the book memory matrix. The INV line, that is, the line for a specific investor's address. The balance is During initialization Get the "Available Balance".

[0129] It should be noted that, and It is not arbitrary; it can be selected from the corresponding set of nodes in the following way: For the selected target projects First, in the memory matrix Filter out all matching Connected investor nodes with a balance greater than 0 yield a candidate set:

[0130] Then score the concealment level. Normalized to a probability distribution, in The starting node of this transaction is obtained by sampling based on probability. Payment Node This is determined by the type of instruction stream to be simulated: if a "revenue sharing" transaction is generated, then let If a "receipt" or "return" transaction is generated, it will be recorded in the bank node set. or investor node set Similarly, filter by balance greater than 0 and... Nodes with historical connections are then sampled based on concealment scores. .

[0131] The investor's balance is determined by the matrix. With quota vector Joint representation. For any investor node. ,remember for The remaining amount that the investor can move, as recorded in the document. Its ID number The remaining amount. When for an investor... Generate an amount When considering candidate transactions, first order Then write back in real time using the following formula. and : .

[0132] Based on this, "all investor balances exhausted" refers to the situation where all investor nodes are exhausted. All or its certificate limit At this point, the recursion terminates and the candidate fraud sequence is output. This clearly shows the location and update method of the investor's balance.

[0133] S403. Input the generated sequence and the real fraud sequence one by one into the dual-scale transport graph discrimination operator proposed in this application to obtain the authenticity judgment result and the violation location feedback result.

[0134] In this embodiment, the generated sequence will With real fraud sequence Input the dual-scale transport graph discrimination operator proposed in this application one by one. The method for obtaining the authenticity determination result and the feedback result of the violation location is as follows: First, the sequence By time increment Write the edges onto the disk sequentially to generate an ordered edge list. ;in , These represent the starting and ending addresses, respectively. Indicates the amount transferred. For cumulative timestamps. Divide into time slices In each time slice Built-in dynamic interaction graph and node type , , Write the three types of tags into the node attributes.

[0135] Second, to Cross-aggregation of execution roles: First at the investor node , , Accumulate the in-degree and out-degree in three directions, and then combine them with the amount. Calculate the single-hop anomaly score vector The vector captures potential abnormal flow directions in this time slice.

[0136] Third, at the local level for all Learnable weighted summation is performed to obtain local scores for the sequence. The operation emphasizes instantaneous capital anomalies rather than excessive attention to long-term accumulation.

[0137] Fourth, extract the images from each time period. Treat them as supernodes and construct a macroscopic link view according to the original time sequence. In the view, the depth of cross-project navigation is... And the number of closed loops for the conservation of amount Count and combine them into a macroscopic feature vector Simultaneous calculation In the window The kurtosis of the distribution within the macro range is used to characterize whether the capital inflow is concentrated. The macro score is defined as... .

[0138] Fifth, real-time monitoring of amount conservation and limit restrictions: If any occurrence appears at any position in the sequence... Or the total amount of the certificate Immediately issue a violation instruction It also records the earliest violation edge number for the generator to correct.

[0139] Sixth, introduce dynamic gating based on macro-level depth between local and macro-level scoring. And complete the probability calculation of authenticity: ; in: The probability of sequence authenticity; Activated for Sigmoid; As a gating weight, it varies with the depth of cross-project navigation. Monotonically increasing; For local scoring; For macro-level scoring; This represents the penalty coefficient for violations. This is a violation of regulations; This is the gated slope hyperparameter; To determine the depth of cross-project jumps; This is the Sigmoid function.

[0140] when When the value is below the system threshold, the discriminator The sequence is labeled as a negative sample, and the violation edge number and the local highest anomaly segment are returned to the generator. The generator adjusts the rhythm and amount allocation accordingly, thereby continuously improving the stealth of cross-project transfers in subsequent adversarial iterations and ensuring that the generated samples always closely approximate real risk scenarios.

[0141] S404. Insert a compliant projection layer between the generator output and the discriminator input. The system accumulates all transfer amounts within the sequence and verifies the amount conservation. For the same document number, the accumulated amount is compared with the bank's limit. If it does not comply with the rules, the minimum adjustment algorithm is used to roll back part of the transaction amount or insert a delay segment. .

[0142] S405. An adversarial iterative strategy is adopted to alternately update the generator and the discriminator. During the generator update phase, the failure signal of the discriminator is transmitted in reverse to the role gating unit and the amount state memory unit. During the discriminator update phase, the generator weight is fixed, and only the discriminator's ability to identify the amount conservation break and the limit over-limit sequence is improved.

[0143] In this embodiment, an adversarial iterative strategy is used to alternately update the generator. With discriminator During the generator update phase, The failure signal is transmitted in reverse to the role gating unit and the amount status memory unit, causing... Enhance the concealment of cross-project transfer patterns; during the discriminator update phase, fix... Weighting, only increase The ability to identify breaks in the balance of amounts and sequences of exceeding limits. Through multiple rounds of alternating training, the coverage of available fraud patterns is gradually expanded while maintaining strict constraints on business rules.

[0144] S406. After the adversarial training converges, fix the generator. Weights, continuously derived from the set of conditional indices Sample and batch generate synthetic fraud sequences ,right Randomly extract time slices of different lengths and re-encode the slices into time-series embeddings. It is then tagged with a synthetic fraud label and stored in a synthetic fraud time-segment set. .

[0145] As can be seen from the above technical solution, a generative sample expansion process is achieved: conditional vectors are constructed from temporal embeddings and fraud trajectories; candidate fraud sequences are generated through a recursive state generator; after authenticity determination by a dual-scale discriminator and verification by a compliance projection layer, a synthesized fraud sequence is output; and the generator and discriminator are continuously optimized through an adversarial iterative strategy. Compared to feature space interpolation or amount scaling, this embodiment directly synthesizes samples with a complete on-chain executable form at the transaction level, providing a training scenario covering a larger hidden space for model training.

[0146] Furthermore, by combining the layered freezing and segmented gradient accumulation strategies, the network absorbs new gradients only on open parameters such as flow weight gating and risk heads, which not only maintains the stable representation of the legitimate liquidation topology, but also enables rapid convergence for long-chain transport across projects.

[0147] Reference Figure 5 , Figure 5 This is a schematic diagram of a synthetic sequence injection process provided in an embodiment of this application. Figure 5 The specific implementation process of synthetic sequence injection is illustrated, such as... Figure 5 As shown, this method specifically includes: S501, each synthetic fraud sequence is broken down into several transaction entries.

[0148] In this embodiment, each transaction entry includes a payment address, a receiving address, an amount, a timestamp, and an instruction tag.

[0149] In this embodiment, the synthetic fraud sequence S is generated by the generative sample expansion step and is decomposed into several single transaction entries, denoted as [from, to, a, t, γ], where from is the payment address, to is the receiving address, a is the amount, t is the timestamp, and γ is one of four types of tags, namely, recharge, refund, split payment, or receipt.

[0150] S502. Map the addresses in the transaction entries to nodes of the corresponding type, create directional edges with timestamps according to the order in which the transactions occur, and construct a synthetic flow temporary graph.

[0151] Specifically, according to the preset mapping criteria, for Mapping investor nodes ,right If it is a project contract, then map the project node. If it is a custodian account, then it maps to a bank node. Then, create timestamped directional edges between the three types of nodes according to the order in which the transactions occur. And write it into the synthetic flow temporary graph. This involves reusing node identifiers from real transactions. Directly referencing an existing address .

[0152] S503. Add a source field and risk label to each edge in the synthetic flow temporary graph, along with the original sequence identifier. Sort all edges in ascending order based on timestamps, and encapsulate the edge set into a synthetic window according to a fixed sliding window length.

[0153] In this embodiment, for Each edge in Add source field Risk Label , along with the original sequence identifier For retrospective purposes. Based on timestamps. Sort all edges in ascending order, according to a fixed sliding window length. Encapsulate the edge set into a window block, i.e., composite window. And write to the synthesized stream buffer .

[0154] S504. Align the synthetic stream buffer and the real-time transaction sliding window according to the time boundary, and inject the synthetic window into the running multi-stream heterogeneous graph in sequence to obtain a unified graph structure.

[0155] In this embodiment, With real-time trading sliding window Align the composition windows according to time boundaries and use a first-in-first-out strategy. Sequentially inject into the running multi-flow heterogeneous graph Specifically, during the injection process, the node number of an existing node is reused. For edges with the same direction and amount, the amount is accumulated to avoid duplicate recording; if the merged amount exceeds the single transaction limit, it is split into multiple virtual edges and written separately. After all insertions are completed, a unified graph structure containing both real transactions and synthetic fraud is obtained. It also maintains the semantics of four transaction types: top-up, refund, split, and receipt.

[0156] S505. Perform a value conservation check on each edge of the unified graph structure. If any edge fails the check, roll back the current time window insertion and record the reason for the exception.

[0157] In this embodiment, the balance conservation detection includes verifying that the balance deduction from the investor node matches the amount transferred out, verifying that the cumulative inflow matches the amount received at the project node, and verifying that the addition or subtraction of the escrow balance matches the difference between all receipts and payments at the bank node.

[0158] S506. If all verifications pass, save the unified graph structure as a graph snapshot, and write the graph snapshot, window number, and start and end block heights into the training set directory.

[0159] In this embodiment, the unified graph structure is saved as a graph snapshot. Snapshot the current image Along with window number Start and end block heights Write to training set directory This serves as training data for subsequent incremental fine-tuning.

[0160] As can be seen from the above technical solutions, the data processing method provided in this application embodiment realizes the compliant injection of synthetic fraud sequences into multi-stream heterogeneous graphs, ensures that the synthetic samples meet on-chain business constraints through amount conservation verification, avoids data redundancy through node reuse and amount accumulation, and provides labeled training data for incremental fine-tuning.

[0161] Reference Figure 6 , Figure 6 This is a schematic diagram of an incremental fine-tuning process provided in an embodiment of this application. Figure 6 The specific implementation process of incremental fine-tuning is illustrated in the example, such as Figure 6 As shown, this method specifically includes: S601. Send the graph snapshots to the training scheduler in sequence according to the window number. The training scheduler performs a progressive operation on each graph snapshot to form a batch index entry and write it into the incremental fine-tuning input list.

[0162] In this embodiment, the image snapshot By window number The data are sequentially fed into the training scheduler, which performs a progressive operation on each graph snapshot. This progressive operation includes: adding edges to the graph snapshot. Return to the edge , accounting , receipt edge Scan each of the four types of transaction edges sequentially and count the actual number of transaction edges in real time. With synthetic fraud edge count ; Carry the node identifier on each edge With the start and end block heights of the snapshot Concatenate to form batch index entries The actual percentage is explicitly recorded in the batch index entries. ,as follows: ; in: There are four types of instruction edges; For the first Snapshot of actual transaction edge count; For the first Snapshot synthesis fraud edge count; The ratio of real to composite elements; For node identification; For batch index entries.

[0163] Furthermore, the training scheduler will eventually train all Write the incremental fine-tuning input list in window order. This ensures that subsequent gradient control can accurately read the actual synthesis ratio.

[0164] S602. Fix the node embedding layer parameters and cross-flow bridging operator parameters, and allow the open flow weight gating layer weights and risk assessment head weights to participate in gradient updates.

[0165] In this embodiment, the node embedding layer parameters are... With cross-current bridging operator parameters To ensure the stability of the legitimate liquidation topology, only the flow access gating layer weights are enabled. With risk assessment head weight Participate in gradient updates. The training scheduler loads a batch of indices. Then, first lock the corresponding snapshot data, and then... The learning rate multiplier is passed to the optimizer to adjust the new gradients so that they are focused on sculpting anomalous rhythmic features across projects without compromising the representational integrity of existing liquidation paths.

[0166] S603. The set of edges in the graph snapshot corresponding to the same batch of index entries is sent into the network inference, and the training scheduler calculates the structural consistency loss for each edge through the loss comparison model.

[0167] In this embodiment, the structural consistency loss output by the loss comparison model is obtained through cross-project transport probability. Compared to the actual number of cross-project hops recorded in the snapshot Obtained, and based on risk labels Dynamically adjust the intensity of the penalty, if Then use the magnification factor. ,like Then use the reduction factor. Structural consistency loss The calculation logic is as follows: ; in: This represents the number of edges in the batch. For the edge The model transport probability; For the edge The number of cross-project hops in the link; This is the boundary penalty coefficient; This serves as the reference constant for amplification and reduction.

[0168] Through the aforementioned differentiated penalties, the model is clearly guided to focus on long-chain transfer patterns while maintaining low sensitivity to legitimate short-chain liquidation, directly meeting the business risk requirements of covert transfer across projects.

[0169] S604. Perform two-level rhythm difference on the time increment of all edges in the edge set of the graph snapshot corresponding to the same batch of index entries, and calculate the rhythm alignment loss.

[0170] In this embodiment, the two-level rhythm difference includes: The first level calculates the time difference between a single edge and the previous jump, marking the instantaneous transport impact.

[0171] The second level calculates the sign change for consecutive Δt sequences within the same link, marking nodes where the rhythm accelerates or decelerates. These rhythm markers are then mapped to frequency index vectors, aligned with the positions of the temporal attention weights currently provided by the model.

[0172] Furthermore, the rhythm alignment loss is calculated based on the weight peak offset as follows: If the peak weight falls within the high-frequency transfer segment, it is considered rhythm alignment, resulting in a smaller loss. If the peak weight deviates and the side risk label is fraud, the rhythm loss weight is increased, and the deviation is added to the penalty pool. If the label is normal, a mitigation channel is enabled for the deviation to prevent excessive penalty for normal revenue sharing rhythm. This loss is used to constrain the model's ability to capture the rhythm of fund flow.

[0173] S605. Based on the proportion of synthetic samples in each batch index entry, determine the target gradient cache, write the gradient of the batch index entry into the target gradient cache, until all batches are processed.

[0174] In this embodiment, a risk proportion segmented gradient accumulation method is used to coordinate parameter updates.

[0175] Specifically, a four-level risk gradient cache is maintained for the open layer, corresponding to different synthesis percentage ranges (0–25%, 25–50%, 50–75%, 75–100%). For each received batch, based on its... Select the target cache to write gradients, and append a learning rate multiplier to the fraudulent label gradients. Once four batches have accumulated in the same cache, a parameter write-back is triggered. During the write-back, normalization is performed on both fraudulent and normal gradients to prevent high-proportion batches from causing a single impact on the weights. The gradient buffering, normalization, and write-back loop prioritizes injecting scarce but critical risk signals into the flow weight gating layer and risk headers, while suppressing the bias caused by concentrated arrival of synthetic samples. This allows for stable and controllable incremental fine-tuning without the need for large-scale manual annotation.

[0176] S606. After training, record the average values ​​of structural consistency loss and rhythm alignment loss in multiple consecutive batches of index entries using a rolling window. If the average values ​​of structural consistency loss and rhythm alignment loss are both lower than the preset threshold in multiple consecutive batches, the model is determined to have converged, the parameters of the current open layer are frozen, and a model version number is generated.

[0177] If both metrics (i.e., the average consistency loss across multiple batches of index entries and the average rhythm alignment loss across multiple batches of index entries) are below the threshold for two consecutive monitoring periods... If so, immediately freeze the current open layer parameters and generate a model version number. .

[0178] S607. Push the model version number through the on-chain model governance interface and replace the old version of the risk reasoning service with a hot-swap and backtracking strategy.

[0179] Specifically, the new model at block height After taking over online inference, the old model retains the backtracking window of three blocks to support accountability and verification.

[0180] All subsequent revenue sharing instructions are evaluated in real time by the new logic before submission. High-risk links will receive a freeze recommendation before the core clearing system freeze window period, achieving T+0 level cross-project transfer interception, while ensuring that historical judgment paths are traceable.

[0181] Reference Figure 7 , Figure 7 This is a schematic diagram of an online inference process provided in an embodiment of this application. Figure 7 The specific implementation process of online inference is illustrated, such as... Figure 7 As shown, this method specifically includes: S701. Push the transaction events in the latest block production event of the platform consortium chain to the listener in real time, map the transaction events as edges and add them to the multi-stream heterogeneous graph, extract the structural embedding and temporal embedding of the affected nodes, call the trained risk judgment model to perform local forward inference, and obtain the real-time risk probability.

[0182] Specifically, the platform pushes four types of instructions—recharge, refund, revenue sharing, and receipt—from the latest block production event on the consortium blockchain to the listener in real time, using sequential pointers. Read each instruction sequentially. For each instruction, apply the role mapping rules to the payment address, contract address, and escrow account to obtain the investor node. Project Nodes Bank nodes In the current multi-stream heterogeneous graph, events are arranged in the order of arrival. Add direction edge And write the block timestamp At the same time, the original node identifiers remain unchanged. This applies to the newly written edge set. Call the forward interface: Locate the set of indexes of affected nodes. And extract the latest structural embedding for each node in real time. With temporal embedding The two types of embeddings are concatenated into an inference input tensor. Input into the enhanced risk assessment model By strengthening the risk assessment model Perform local forward inference and return the real-time risk probability of the corresponding edge. .

[0183] S702. Compare the real-time risk probability with the current threshold side by side. If it is greater than the threshold, mark it as a candidate for freezing, backtrack and assemble the list of frozen sub-accounts, and send the freezing instruction to the bank's core system. If it is less than or equal to the threshold, push the clearing confirmation signal to the clearing channel.

[0184] Specifically, Compared with the current threshold Side-by-side comparison, if Then immediately move the edge Marked as a frozen candidate. By tracing back along the central edge, we track related investor nodes and bank custody nodes, and use a depth-first strategy to assemble a list of sub-accounts to be frozen. This allows for the location of potential fraudulent paths at the graph level. Send a freeze command to the bank's core system and generate a command number off-chain. With the height of the trigger block The mapping. If a certain edge's If the transaction fails, a settlement confirmation signal will be immediately sent to the settlement channel to ensure uninterrupted fund flow. After the above feedback is completed, the monitoring pointer will automatically move to the next transaction event.

[0185] As can be seen from the above technical solution, this embodiment of the application monitors transaction events in the latest block in real time, maps new transactions as edges and appends them to the multi-stream heterogeneous graph, extracts the structural embedding and temporal embedding of affected nodes, calls the trained enhanced risk judgment model to perform local forward inference, obtains the real-time risk probability, compares it with the threshold and marks the freezing candidates, reverse-tracks back to assemble the list of frozen sub-accounts, and sends the freezing instruction to the bank's core system. This embodiment uses the linkage of local forward inference and real-time risk control threshold, triggers calculation on incremental edges and outputs freezing suggestions before the accounting instruction is submitted, combined with event flow sequence monitoring and graph depth-first backtracking, to generate a complete list of frozen sub-accounts at the escrow account level, achieving second-level interaction with the bank's core system.

[0186] As the liquidation schedules of the same investor participating in multiple projects become increasingly fragmented, traditional methods based on threshold rules and offline reports struggle to identify hidden cross-project fund transfer chains in a timely manner, resulting in pain points such as delayed fund freezing and difficulties in accountability. Based on the above embodiments, this application provides a data processing method that can be applied to the aforementioned scenarios to model and verify all on-chain events.

[0187] In blockchain ledger scenarios, existing methods often use single-layer or shallow graphs to handle various transaction types such as top-ups, refunds, and ledger splits. Edge semantics are compressed into uniform weights, making it difficult to explicitly represent the closed-loop path involving bank escrow accounts in the graph structure. Node embedding relies on random walks or local aggregations, failing to simultaneously preserve the global continuity of cross-project migration links. Time dimension processing employs a topology-first, time-later splicing strategy, introducing alignment errors during window sliding. Risk judgment relies on classification models with superimposed rule thresholds, and the model's generalization of new transfer patterns depends on the completeness of the rules, resulting in both false positives and false negatives. Sample expansion remains at the level of feature space interpolation or amount scaling, lacking verification of on-chain business constraints and higher-order topology forms. Online inference adopts batch push and full forward methods, with freezing actions often lagging behind ledger split execution, making it difficult to meet the business requirements of T+0 interception.

[0188] To address the aforementioned technical issues, this application's embodiments establish a real-time risk identification and interception mechanism through six stages of closed-loop iteration. This mechanism can simultaneously characterize cross-project topology closed loops and the rhythm of capital flow, and can continuously and adaptively evolve through self-generated samples.

[0189] Phase 1: Multi-stream Heterogeneous Graph Construction: In the data preparation phase, recharge, refund, distribution, and receipt instructions are first captured in block height order. The four types of instructions continuously output by the consortium blockchain event bus are monitored, and the instructions are written to the transaction buffer queue in block height order. When the queue length first reaches a preset value, the starting transaction number of the first sliding window is fixed. Each time the queue pointer moves one transaction forward, the entire sliding window is shifted to the right, allowing only the transaction starting in the previous window to proceed. For each instruction within the window, edges are created in the multi-stream heterogeneous graph according to the payment direction, mapping payment addresses to investor nodes, target contracts to project nodes, and escrow accounts to bank nodes, maintaining four independent layers for recharge, refund, distribution, and receipt. A sliding window queue of length 1024 is constructed, maintaining the four-layer instruction flow heterogeneous graph in real time, with each edge including the amount, block timestamp, and instruction identifier. After window smoothing, the first batch of transactions written into the graph structure covers all investor addresses, project contracts, and bank escrow account nodes.

[0190] Phase Two: Feature Extraction and Risk Identification: For multi-flow heterogeneous graphs, node vectors are generated by concatenating node role identifiers, current balances, and cumulative inflows into projects. Edge vectors are generated by concatenating edge amounts, timestamps, and transaction types. An input tensor is constructed and fed into a graph neural network containing a cross-flow bridging aggregation operator and a temporal attention module. A two-hop amount conservation loop is used to inject bridging memory at the bank node, outputting node structure embeddings, temporal embeddings, and edge-level risk probabilities. The cross-flow bridging aggregation operator automatically injects bridging memory at the two-hop amount conservation loop, explicitly amplifying the central role of bank nodes in cross-project fund circulation. After three rounds of training, the AUC index improved from 0.84 in the baseline GraphSAGE network to 0.92, and the recall rate of the cross-project transfer link improved by 13.6%.

[0191] Phase 3: Generative Sample Expansion: To address the scarcity of genuine fraud samples, when the marginal risk probability falls below the freezing threshold, time-series embeddings are paired with manually labeled cross-project transfer trajectories to form a conditional index. Within a single recursive loop, rhythm evolution, project selection, amount allocation, role mapping, and memory update are sequentially executed to generate candidate fraud sequences. A dual-scale transfer graph discriminator is used to determine the authenticity of the candidate sequences. After compliance projection layer verification of amount conservation and quota limits, a synthetic fraud sequence is output. Conditional index clustering is performed on the 2148 manually labeled transfer trajectories, and compliant candidate fraud sequences are continuously generated. Within three weeks, the number of synthetic sequences reached 284,000, covering various highly concealed forms such as the interaction of investors, banks, and projects, as well as hierarchical jumps in amount. After all synthetic sequences are injected into the real transaction graph in Phase 4, the proportion of those passing the amount conservation verification is 97.8%, significantly higher than the 71.3% of the traditional SMOTE feature interpolation method.

[0192] Phase 4: Synthetic Sequence Injection Phase: The synthetic fraud sequence is broken down into individual transactions and written into the multi-stream heterogeneous graph according to the S1 mapping rules. The transactions are inserted in chronological order and the amount conservation check is performed. After passing the check, a graph snapshot with window number and block height is saved as training data.

[0193] Phase 5: Incremental Fine-tuning Phase: Graph snapshots are read sequentially by window. The node embedding layer and cross-flow bridging operator are frozen. Only the flow weight gating layer and risk assessment header are enabled for training. The structural consistency loss and rhythm alignment loss are calculated, and risk proportion segmented gradient accumulation is applied until both losses are below the threshold, resulting in the updated risk identification model. Layered freezing training was performed on 142,000 graph snapshots, with only the flow weight gating layer and risk assessment header enabled. After the 18th iteration, both the structural consistency loss and rhythm alignment loss fell below the threshold simultaneously, and the final model version V3.8 was approved and launched by the on-chain governance contract. Backtracking tests were conducted on grayscale blocks. The average freeze response latency for cross-project transfers using the new model was 4.7 seconds, a 62% reduction compared to the old rules + XGBoost system; the false positive rate decreased from 4.1% to 2.3%.

[0194] Phase 6: Online Inference Phase: After formal deployment, the system monitors the latest block events in real time, maps new instructions into edges and adds them to the multi-stream heterogeneous graph. It extracts affected nodes, embeds them, and calls the updated model to perform local forward inference to obtain real-time risk probabilities. If the risk probability is higher than the freezing threshold, the corresponding edge is marked as a freezing candidate. Along this edge, it traces related investor nodes and bank nodes to generate a list of frozen sub-accounts and sends a freezing instruction to the bank's core system to complete fund interception. The platform only performs local forward computation on incremental edges, processing an average of 860 new transactions per second. During testing, the system marked 1538 high-risk links and issued 482 freezing instructions to the custodian bank, of which 461 were verified to be abnormal, achieving an accuracy rate of 95.6%. The average frozen amount was locked within 2.8 seconds, ensuring that all risk-sharing transactions were intercepted before the daily clearing window closed.

[0195] The data processing method provided in this application abstracts fund transfer into a four-stream parallel interaction, constructs a sliding window according to the block height, and only allows the first transaction in the window to ensure that the original time order is not rearranged. In a single heterogeneous graph, four types of edges, namely recharge, refund, split, and receipt, are respectively fixed with the role labels of investors, projects, and banks, providing the necessary structure and time sequence carrier for conservation tests.

[0196] Furthermore, in the graph learning phase, co-current aggregation is first performed by role domain, and then two-hop closed loops are retrieved at the bank nodes. When the amount difference satisfies the conservation constraint, bridging memory is triggered, injecting the bank-side memory into the origin and end-point embeddings; for nodes that appear simultaneously in multiple flows, a gating coefficient is set according to the cross-flow overlap rate to complete the weighting, and then temporal attention is applied to the continuous edge sequence to obtain the rhythm vector. Structurally, the closed loops of the same funds scattered in instructions such as recharge and splitting are explicitly aligned; temporally, the round-trip rhythm is amplified, jointly transforming the amount conservation characteristics of multiple instructions for the same fund from weak signals into strong evidence.

[0197] Furthermore, in addition to risk reasoning, a recursive state generator and a dual-scale discriminator are introduced. The generator uses the balance and document limit as states, and synchronously advances the rhythm increment, project migration, amount allocation, and role mapping within a single recursion, while being constrained by the compliance projection of amount conservation and limit restrictions. The discriminator first performs local accumulation of time slices, and then performs macro-statistics across slices (jump depth, number of closed loops), and feeds back the violation location to the generator. The training adopts gradient accumulation segmented according to the risk proportion, so that the update focus is on the long chain of cross-projects and the conservation closed loop rather than the normal liquidation path. Even when there is a lack of new labels, it can still continuously expand the distribution of transported samples and feed back into representation learning and online recall.

[0198] In summary, under the conditions of scarce risk samples, multiple parallel transaction events, and the requirement for second-level response to freezes, the embodiments of this application establish a real-time risk identification and interception mechanism that can simultaneously characterize the cross-project topology closed loop and the rhythm of fund flow, and can continuously and adaptively evolve through self-generated samples, so as to accurately detect and immediately block hidden cross-project fund transfer behaviors.

[0199] The above describes a data processing method provided by an embodiment of this application. The following will describe the related apparatus for performing the above data processing method.

[0200] Please see Figure 8 , Figure 8 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application. Figure 8 As shown, the data processing device 800 includes: The event listening unit 801 is used to listen to the transaction events output by the blockchain event bus and push each transaction event to the transaction buffer queue in sequence according to the location information of each transaction event. The location information includes the block height and the transaction index within the block. The heterogeneous graph generation unit 802 is used to perform graph structure mapping based on transaction events in the sliding window of the transaction buffer queue to construct a multi-stream heterogeneous graph, wherein the multi-stream heterogeneous graph includes multiple homogeneous subgraphs divided according to transaction type. Risk probability determination unit 803 is used to extract features from the multi-flow heterogeneous graph and determine the risk probability of each edge; The risk control operation execution unit 804 is used to perform risk control operations based on the risk probability.

[0201] In one possible implementation, the heterogeneous graph generation unit 802, when constructing a multi-stream heterogeneous graph by mapping the graph structure based on transaction events within a sliding window in the transaction buffer queue, specifically performs the following: When the length of the transaction buffer queue reaches a preset threshold for the number of transactions, a sliding window is generated. Whenever a new transaction event is added to the transaction buffer queue, the first transaction event in the sliding window is removed, and the newly added transaction event is included in the sliding window. In response to the generation of the initial sliding window, based on the transaction information of each initial transaction event within the initial sliding window, the payment address is mapped to the investor node, the contract address is mapped to the project node, and the escrow account address is mapped to the bank node. Directed edges are generated according to the transaction type, and homogeneous subgraphs of each transaction type are aggregated to construct an initial multi-flow heterogeneous graph. In response to each update of the sliding window, the transaction information of the newly added target transaction event within the sliding window is obtained, nodes and edges corresponding to the target transaction event are generated, and added to the multi-flow heterogeneous graph to perform incremental updates to the multi-flow heterogeneous graph.

[0202] In one possible implementation, the risk probability determination unit 803, when performing feature extraction on the multi-flow heterogeneous graph and determining the risk probability of each edge, is specifically used for: Read the set of subgraph edges of each homogeneous subgraph and the set of subgraph nodes corresponding to each set of subgraph edges from the multi-flow heterogeneous graph; For each set of nodes in a subgraph, the nodes are numbered according to the first-see key to obtain the node identifier of each node; For each node, generate a node vector based on the node attributes; for each edge, generate an edge vector based on the edge attributes. For each edge, the node vector of the payer node, the edge vector, and the node vector of the payee node are concatenated according to the direction of fund flow to obtain the triplet vector corresponding to the edge. For each homoprime subgraph, stack the triple vectors according to the edge position information to obtain the subgraph tensor of the homoprime subgraph; Write the subgraph tensor of each homoprotic subgraph to the tensor buffer.

[0203] In one possible implementation, the risk probability determination unit 803, when performing feature extraction on the multi-flow heterogeneous graph and determining the risk probability of each edge, is further configured to: Based on the set of nodes and edges of each homogeneous subgraph, extract the starting node, transaction type, and ending node of each edge to construct a set of triples for each homogeneous subgraph. For each homoprotic subgraph, feature fusion based on the set of triples is performed to obtain the homoprotic subgraph feature vector of each node; Retrieve two-hop adjacent paths. When the flow of resources in the two-hop adjacent paths meets the preset flow conservation condition, inject the feature vector of the transit node as a bridging memory vector into the feature vector of the homo-prime graph to obtain an enhanced feature vector. Based on the gating vectors of each homoprotic subgraph and the overlap rate of the nodes, the weight of each homoprotic subgraph is determined, and the enhanced feature vector is weighted and aggregated based on the weights to obtain the structural embedding of the nodes. The structural embeddings and edge sequences of each node are input into the temporal attention model to obtain the temporal embeddings of each node. The structural embeddings and temporal embeddings are concatenated to obtain the joint representation of each node. Based on the joint representation of each node, the risk probability of each edge is determined.

[0204] In one possible implementation, a sample augmentation unit is also included, for: Pair the temporal embedding vectors of all edges within the time window with the fraud trajectory set according to transaction type to construct condition vectors, and cluster the condition vectors to obtain a condition index set. The condition index set is sequentially input into the recursive state generator, and the rhythm evolution, project selection, amount allocation, role mapping and memory update are continuously completed in a single recursive loop to construct a candidate fraud sequence. The candidate fraud sequence and the real fraud sequence are input into the dual-scale discriminator one by one to obtain the authenticity judgment result and the violation location feedback result; A compliance projection layer is inserted between the generator output and the discriminator input. All transfer amounts within the sequence are accumulated and the amount conservation is checked. The amount for the same document number is accumulated and compared with the bank limit. If it does not comply with the rules, the minimum adjustment algorithm is used to back down part of the transaction amount or insert a delay segment. An adversarial iterative strategy is employed to alternately update the generator and discriminator; After the adversarial training converges, the generator weights are fixed, and synthetic fraud sequences are continuously sampled from the condition index set and generated in batches.

[0205] In one possible implementation, a synthetic sequence injection unit is also included, for: Each synthetic fraud sequence is broken down into several transaction entries, and the addresses in the transaction entries are mapped to nodes of the corresponding type. Directional edges with timestamps are created according to the order in which the transactions occur, and a temporary graph of the synthetic flow is constructed. Add a source field and risk label to each edge in the synthetic flow temporary graph, sort all edges in ascending order according to timestamp, and encapsulate the edge set into a synthetic window according to a fixed sliding window length; Align the synthetic stream buffer with the real-time transaction sliding window according to the time boundary, and inject the synthetic window sequentially into the running multi-stream heterogeneous graph to obtain a unified graph structure; Perform an amount conservation check on the unified graph structure edge by edge. If all checks pass, save the unified graph structure as a graph snapshot and write the graph snapshot, window number, and start and end block heights into the training set directory.

[0206] In one possible implementation, an incremental fine-tuning unit is also included for: The image snapshots are sent to the training scheduler in sequence according to the window number, forming batch index entries which are then written into the incremental fine-tuning input list. The node embedding layer parameters and cross-flow bridging operator parameters are fixed, and the weights of the open flow weight gating layer and the risk assessment head weights participate in the gradient update. The set of edges in the graph snapshot corresponding to the same batch of index entries is fed into the network inference to calculate the structural consistency loss and rhythm alignment loss. Based on the proportion of synthetic samples in each batch index entry, determine the target gradient cache, write the gradient of the batch index entry into the target gradient cache, and continue until all batches are processed. After training, the average values ​​of structural consistency loss and rhythm alignment loss in multiple consecutive batches are recorded in a rolling window. If all values ​​are lower than the preset threshold, the model is considered to have converged, the parameters of the current open layer are frozen, and a model version number is generated. The model version number is pushed through the on-chain model governance interface, and the old version of the risk reasoning service is replaced by a hot-swap and backtracking strategy.

[0207] In one possible implementation, a real-time inference unit is also included, for: The transaction events in the latest block production event of the platform consortium blockchain are pushed to the listener in real time. The transaction events are mapped as edges and added to the multi-stream heterogeneous graph. The structural embedding and temporal embedding of the affected nodes are extracted. The trained risk judgment model is called to perform local forward inference to obtain the real-time risk probability. The real-time risk probability is compared side-by-side with the current threshold. If it is greater than the threshold, it is marked as a candidate for freezing. The list of frozen sub-accounts is then assembled by reverse tracing and a freezing instruction is sent to the bank's core system. If it is less than or equal to the threshold, a clearing confirmation signal is pushed to the clearing channel.

[0208] This application also provides an electronic device, which includes at least one processor and a memory connected to the processor, wherein: the memory is used to store a computer program; and the processor is used to execute the computer program so that the electronic device can implement the data processing method as described in any of the above embodiments.

[0209] refer to Figure 9 As shown, Figure 9 The electronic device provided in this application embodiment may include, but is not limited to, fixed terminals such as mobile phones, laptops, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 9The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0210] like Figure 9 As shown, the electronic device may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage device 908 into a random access memory (RAM) 903. When the electronic device is powered on, the RAM 903 also stores various programs and data required for the operation of the electronic device. The processing unit 901, ROM 902, and RAM 903 are interconnected via a bus 904. An input / output (I / O) interface 905 is also connected to the bus 904.

[0211] Typically, the following devices can be connected to I / O interface 905: input devices 906 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 907 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 908 including, for example, memory cards, hard drives, etc.; and communication devices 909. Communication device 909 allows electronic devices to exchange data via wireless or wired communication with other devices. Although Figure 9 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0212] This application also provides a computer program product including computer-readable instructions, which, when executed on an electronic device, cause the electronic device to implement any of the data processing methods provided in this application.

[0213] This application also provides a computer-readable storage medium that carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any of the data processing methods provided in this application.

[0214] It should also be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. In addition, in the device embodiment drawings provided in this application, the connection relationship between modules indicates that they have a communication connection, which can be implemented as one or more communication buses or signal lines.

[0215] Through the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware, or it can be implemented by special-purpose hardware including application-specific integrated circuits, special-purpose CPUs, special-purpose memory, special-purpose components, etc. Generally, any function performed by a computer program can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be diverse, such as analog circuits, digital circuits, or special-purpose circuits. However, for this application, software program implementation is more often the preferred implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a readable storage medium, such as a computer floppy disk, USB flash drive, mobile hard disk, ROM, RAM, magnetic disk, or optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, training equipment, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0216] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0217] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, training device, or data center to another website, computer, training device, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device or data center that integrates one or more available media. The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

Claims

1. A data processing method, characterized in that, include: Listen to the transaction events output by the blockchain event bus, and push each transaction event to the transaction buffer queue in sequence according to the location information of each transaction event, wherein the location information includes the block height and the transaction index within the block; A graph structure mapping is performed based on the transaction events within the sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph, which includes multiple homogeneous subgraphs divided according to transaction type. Feature extraction is performed on the multi-flow heterogeneous graph to determine the risk probability of each edge; Risk control operations are performed based on the aforementioned risk probability.

2. The data processing method according to claim 1, characterized in that, The step of mapping a graph structure based on transaction events within a sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph includes: When the length of the transaction buffer queue reaches a preset threshold for the number of transactions, an initial sliding window is generated; In response to the generation of the initial sliding window, based on the transaction information of each initial transaction event within the initial sliding window, the addresses involved in each transaction event are mapped to nodes of the corresponding type, and directed edges are generated according to the transaction type to construct the initial multi-flow heterogeneous graph.

3. The data processing method according to claim 2, characterized in that, The step of mapping the graph structure based on the transaction events within the sliding window in the transaction buffer queue to construct a multi-stream heterogeneous graph further includes: Whenever a new transaction event is added to the transaction buffer queue, the first transaction event in the sliding window is removed, and the newly added transaction event is added to the sliding window. In response to each update of the sliding window, the transaction information of the newly added target transaction event within the sliding window is obtained, nodes and edges corresponding to the target transaction event are generated, and added to the multi-flow heterogeneous graph to perform incremental updates to the multi-flow heterogeneous graph.

4. The data processing method according to claim 2, characterized in that, The step of extracting features from the multi-flow heterogeneous graph and determining the risk probability of each edge includes: Read the set of subgraph edges of each homogeneous subgraph and the set of subgraph nodes corresponding to each set of subgraph edges from the multi-flow heterogeneous graph; For each set of nodes in a subgraph, the nodes are numbered according to the first-see key to obtain the node identifier of each node; For each node, generate a node vector based on the node attributes; for each edge, generate an edge vector based on the edge attributes. For each edge, the node vector of the payer node, the edge vector, and the node vector of the payee node are concatenated according to the direction of fund flow to obtain the triplet vector corresponding to the edge. For each homoprime subgraph, stack the triple vectors according to the edge position information to obtain the subgraph tensor of the homoprime subgraph; Based on the subgraph tensor of the homoprime subgraph, the risk probability of each edge is determined.

5. The data processing method according to claim 4, characterized in that, The determination of the risk probability of each edge based on the subgraph tensor of the homoprime subgraph includes: Based on the subgraph tensors of each homomorphic subgraph, determine the relationships between nodes and edges in each homomorphic subgraph; For each homoprotic subgraph, the homoprotic subgraph feature vector of each node is determined based on the aforementioned association relationship; Based on the feature vectors of the homoprotic subgraph, the structural embedding of the nodes is determined; The structural embeddings and edge sequences of each node are input into the temporal attention model to obtain the temporal embeddings of each node. The structural embeddings and temporal embeddings are concatenated to obtain the joint representation of each node. Based on the joint representation of each node, the risk probability of each edge is determined.

6. The data processing method according to claim 5, characterized in that, The step of determining the structural embedding of nodes based on the feature vectors of the homoprime subgraph includes: Retrieve two-hop adjacent paths. When the flow of resources in the two-hop adjacent paths meets the preset flow conservation condition, inject the feature vector of the transit node as a bridging memory vector into the feature vector of the homo-prime graph to obtain an enhanced feature vector. Based on the gating vectors of each homoprotic subgraph and the overlap rate of the nodes, the weight of each homoprotic subgraph is determined, and the enhanced feature vectors are weighted and aggregated based on the weights to obtain the structural embedding of the nodes.

7. The data processing method according to claim 2, characterized in that, Also includes: Pair the temporal embedding vectors of all edges within the time window with the fraud trajectory set according to transaction type to construct condition vectors, and cluster the condition vectors to obtain a condition index set. The condition index set is sequentially input into the recursive state generator to construct a candidate fraud sequence; The candidate fraud sequence and the real fraud sequence are input into the dual-scale discriminator one by one to obtain the authenticity judgment result and the violation location feedback result; Based on the results of the authenticity assessment and the feedback results of the violation location, adversarial training is conducted; After the adversarial training converges, the generator weights are fixed, and synthetic fraud sequences are continuously sampled from the condition index set and generated in batches.

8. The data processing method according to claim 7, characterized in that, Also includes: Each synthetic fraud sequence is broken down into several transaction entries, and the addresses in the transaction entries are mapped to nodes of the corresponding type. Directional edges with timestamps are created according to the order in which the transactions occur, and a temporary graph of the synthetic flow is constructed. Add a source field and risk label to each edge in the synthetic flow temporary graph, sort all edges in ascending order according to timestamp, and encapsulate the edge set into a synthetic window according to a fixed sliding window length; Align the synthetic stream buffer with the real-time transaction sliding window according to the time boundary, and inject the synthetic window sequentially into the running multi-stream heterogeneous graph to obtain a unified graph structure; Perform an amount conservation check on the unified graph structure edge by edge. If all checks pass, save the unified graph structure as a graph snapshot and write the graph snapshot, window number, and start and end block heights into the training set directory.

9. The data processing method according to claim 8, characterized in that, Also includes: The image snapshots are sent to the training scheduler in sequence according to the window number, forming batch index entries which are then written into the incremental fine-tuning input list. The node embedding layer parameters and cross-flow bridging operator parameters are fixed, and the weights of the open flow weight gating layer and the risk assessment head weights participate in the gradient update. The set of edges in the graph snapshot corresponding to the same batch of index entries is fed into the network inference to calculate the structural consistency loss and rhythm alignment loss. Based on the proportion of synthetic samples in each batch index entry, determine the target gradient cache, write the gradient of the batch index entry into the target gradient cache, and continue until all batches are processed. After training, the average values ​​of structural consistency loss and rhythm alignment loss in multiple consecutive batches are recorded in a rolling window. If all values ​​are lower than the preset threshold, the model is considered to have converged, the parameters of the current open layer are frozen, and a model version number is generated. Push the model version number to enable model version replacement.

10. The data processing method according to claim 9, characterized in that, Also includes: Real-time monitoring of transaction events in the latest block production events of the platform's consortium blockchain; mapping transaction events as edges and appending them to a multi-stream heterogeneous graph; extracting the structural and temporal embeddings of affected nodes; calling the trained risk judgment model to perform local forward inference; and obtaining real-time risk probabilities. The real-time risk probability is compared side-by-side with the current threshold. If it is greater than the threshold, it is marked as a candidate for freezing. The list of frozen sub-accounts is then assembled by reverse tracing and a freezing instruction is sent to the bank's core system. If it is less than or equal to the threshold, a clearing confirmation signal is pushed to the clearing channel.

11. A data processing apparatus, characterized in that, include: The event listening unit is used to listen to the transaction events output by the blockchain event bus and push each transaction event to the transaction buffer queue in sequence according to the location information of each transaction event. The location information includes the block height and the transaction index within the block. The heterogeneous graph generation unit is used to perform graph structure mapping based on transaction events within a sliding window in the transaction buffer queue, and to construct a multi-stream heterogeneous graph, wherein the multi-stream heterogeneous graph includes multiple homogeneous subgraphs divided according to transaction type. The risk probability determination unit is used to extract features from the multi-flow heterogeneous graph and determine the risk probability of each edge. The risk control operation execution unit is used to perform risk control operations based on the risk probability.

12. An electronic device, characterized in that, It includes at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program to enable the electronic device to implement the data processing method as described in any one of claims 1 to 10.

Images