Anti-fraud identification methods, media, and products

Abstract

The application discloses a kind of anti-fraud identification method, medium and product.The method comprises: in response to the trigger of preset high-risk behavior event, determine the behavior characteristic data corresponding to preset high-risk behavior event;According to terminal running context information determination data communication parameter, and adjust behavior characteristic data according to data communication parameter;The adjusted behavior characteristic data is sent to edge server, to make edge server based on behavior characteristic data carry out anti-fraud identification, generate anti-fraud identification result;Receive the anti-fraud identification result returned by edge server, and execute corresponding anti-fraud decision operation based on anti-fraud identification result.The application not only guarantees the timely, reliable disposal of high-risk event, but also balances between communication efficiency, energy consumption, security and data integrity, improves the running robustness and overall security response efficiency in weak network environment, and gives consideration to security, real-time performance, energy efficiency and user experience.

Description

Technical Field

[0001] This invention relates to the fields of information security and artificial intelligence technology, and in particular to an anti-fraud identification method, medium, and product. Background Technology

[0002] With the widespread application of mobile internet, 5G communication, and smart terminals, telecommunications network fraud methods are becoming increasingly intelligent, organized, and cross-platform, exhibiting characteristics such as high incidence, variability, and strong concealment, posing a serious threat to user property security and social order. Against this backdrop, building an efficient, real-time, and reliable anti-fraud system has become an urgent need for telecommunications operators, financial institutions, and regulatory authorities. An ideal anti-fraud system not only needs millisecond-level risk identification and response capabilities but should also consider terminal energy efficiency, user privacy protection, dynamic network adaptability, and the ability to perceive organized and collaborative fraud activities. Especially in resource-constrained mobile edge computing scenarios, a new intelligent anti-fraud architecture that integrates multimodal behavior perception, adaptive communication scheduling, and distributed knowledge collaboration is urgently needed.

[0003] Currently, the industry has proposed a variety of anti-fraud technology solutions. For example, by integrating multi-source data such as communication records, financial transactions, social media and geolocation, user profiles are built using machine learning models such as random forests and support vector machines, and spatiotemporal clustering and time series analysis are combined to identify and warn of fraud hotspots.

[0004] However, existing technologies generally adopt a raw data upload + cloud-based centralized processing model, which results in the continuous upload of a large amount of sensitive raw data (such as complete trajectories and transaction content). This not only causes wireless link congestion and increases end-to-end latency, but also creates high-risk privacy leakage points, violates the principle of data minimization, and makes it impossible to dynamically adjust communication strategies, resulting in low system energy efficiency and limited availability. Summary of the Invention

[0005] This invention provides an anti-fraud identification method, medium, and product to solve the problem that anti-fraud identification cannot simultaneously achieve low latency, high performance, and strong privacy.

[0006] According to one aspect of the present invention, an anti-fraud identification method is provided, executed by a terminal, comprising: In response to the triggering of a preset high-risk behavior event, determine the behavioral representation data corresponding to the preset high-risk behavior event; The data communication parameters are determined based on the terminal's operating context information, and the behavioral representation data is adjusted accordingly. The adjusted behavioral representation data is sent to the edge server so that the edge server can perform anti-fraud identification based on the behavioral representation data and generate anti-fraud identification results. Receive the anti-fraud identification results returned by the edge server, and perform corresponding anti-fraud decision operations based on the anti-fraud identification results.

[0007] According to one aspect of the present invention, an anti-fraud identification method is provided, executed by an edge server, comprising: Receive target behavior representation data sent by the target terminal, and update the pre-built knowledge graph based on the target behavior representation data; wherein, the knowledge graph is constructed based on historical behavior representation data uploaded by multiple terminals; Collaborative reasoning is performed on the updated knowledge graph based on a pre-trained graph neural network model to obtain anti-fraud identification results corresponding to the target behavior representation data.

[0008] According to another aspect of the present invention, an anti-fraud identification device is provided, executed by a terminal, comprising: The behavioral representation data determination module is used to determine the behavioral representation data corresponding to the preset high-risk behavioral event in response to the triggering of the preset high-risk behavioral event. The behavior representation data adjustment module is used to determine the data communication parameters based on the terminal's operating context information, and to adjust the behavior representation data according to the data communication parameters; The behavior representation data sending module is used to send the adjusted behavior representation data to the edge server, so that the edge server can perform anti-fraud identification based on the behavior representation data and generate anti-fraud identification results; The anti-fraud decision-making operation module is used to receive the anti-fraud identification results returned by the edge server and perform corresponding anti-fraud decision-making operations based on the anti-fraud identification results.

[0009] According to another aspect of the present invention, an anti-fraud identification device is provided, executed by an edge server, comprising: The knowledge graph update module is used to receive target behavior representation data sent by the target terminal and update the pre-built knowledge graph based on the target behavior representation data; wherein, the knowledge graph is constructed based on historical behavior representation data uploaded by multiple terminals; The anti-fraud identification module is used to perform collaborative reasoning on the updated knowledge graph based on a pre-trained graph neural network model to obtain the anti-fraud identification results corresponding to the target behavior representation data.

[0010] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and A memory that is communicatively connected to at least one processor; wherein, The memory stores a computer program that can be executed by at least one processor, such that the at least one processor is able to perform the anti-fraud identification method of any embodiment of the present invention.

[0011] According to another aspect of the present invention, a computer-readable storage medium is provided, which stores computer instructions for causing a processor to execute and implement the anti-fraud identification method of any embodiment of the present invention.

[0012] According to another aspect of this application, a computer program product is provided, which includes a computer program that, when executed by a processor, implements the anti-fraud identification method of any embodiment of this application.

[0013] The technical solution of this invention responds to preset high-risk behavioral events on the terminal side, accurately obtains corresponding behavioral representation data, and adaptively adjusts the data in combination with the terminal's operating context information. The adjusted data is then efficiently transmitted to an edge server for low-latency anti-fraud identification. The terminal then executes corresponding anti-fraud decision-making operations based on the returned identification results, thus achieving a complete closed loop from behavioral perception, intelligent communication, edge analysis to local response. This not only ensures timely and reliable handling of high-risk events but also achieves a balance between communication efficiency, energy consumption, security, and data integrity. It improves operational robustness and overall security response efficiency in weak network environments, taking into account security, real-time performance, energy efficiency, and user experience.

[0014] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart of an anti-fraud identification method provided according to an embodiment of the present invention; Figure 2 This is a flowchart of another anti-fraud identification method provided by an embodiment of the present invention; Figure 3 This is a schematic diagram of the architecture of a lightweight semantic coding model provided according to an embodiment of the present invention; Figure 4This is a schematic diagram of the architecture of a DDPG algorithm provided according to an embodiment of the present invention; Figure 5 A flowchart of another anti-fraud identification method provided according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an anti-fraud identification device according to an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of an anti-fraud identification device according to an embodiment of the present invention; Figure 8 This is a schematic diagram of the structure of an electronic device that implements the anti-fraud identification method of the present invention. Detailed Implementation

[0017] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0018] It should be noted that the terms "candidate," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0019] Figure 1 This invention provides a flowchart of an anti-fraud identification method. This embodiment is applicable to situations requiring efficient and accurate identification of fraudulent events in a terminal. The method can be executed by an anti-fraud identification device, which can be implemented in hardware and / or software and configured within the terminal. Figure 1 As shown, the method includes: S110. In response to the triggering of a preset high-risk behavior event, determine the behavioral representation data corresponding to the preset high-risk behavior event.

[0020] Among them, pre-defined high-risk behavior events refer to a set of user behaviors or system states that may pose a significant threat to system security, user rights, business compliance, or asset integrity, identified and defined in advance by technical personnel or security policy makers. Pre-defined high-risk behavior events have corresponding judgment criteria. These events are pre-defined and solidified before execution through configuration files, machine learning tags, etc., and possess observable input signals or log characteristics. Behavioral representation data refers to the data set used to quantify, describe, or characterize the essential features of pre-defined high-risk behavior events. It reflects information such as the time, space, frequency, intensity, and context of the behavior. For example, behavioral representation data includes numerical vectors, structured log fields, or feature embedding vectors.

[0021] Specifically, when the user behavior or system status monitored in real time meets the judgment conditions corresponding to the preset high-risk behavior event, the preset high-risk behavior event is considered to be triggered. For example, according to the rule matching, if the rule of failed login ≥ 5 times within 1 minute is met, a brute-force attack attempt event is triggered; if the classification model outputs a high-risk probability exceeding the threshold based on the real-time behavior flow, the corresponding event is triggered, etc. Based on the identification of the preset high-risk behavior event, the corresponding event trigger signal or event trigger record is generated, including meta-information such as event type, occurrence time and associated entities.

[0022] After a preset high-risk behavior event is triggered, behavioral representation data directly related to the preset high-risk behavior event is extracted, calculated, or generated from raw behavior logs, sensor data, or contextual information. For example, raw behavior data within a certain time window before and after the preset high-risk behavior event is acquired, such as network request logs, operation sequences, and sensor readings; key dimension data, such as operation frequency, geographical location jumps, and resource consumption, are extracted based on a preset feature template; the raw data is converted into a structured representation form, such as generating feature vectors and calculating statistical summaries; and a mapping relationship is established between the generated representation data and the triggered high-risk event type to ensure a one-to-one or many-to-one association.

[0023] S120. Determine the data communication parameters based on the terminal's operating context information, and adjust the behavior representation data according to the data communication parameters.

[0024] Terminal runtime context information refers to a set of multi-dimensional dynamic information that reflects the current working status, environmental conditions, resource status, and task requirements of terminal devices, such as smartphones, vehicle terminals, industrial sensors, and wearable devices, in real time during operation. For example, terminal runtime context information includes at least one of the following: network status, device resource status, geographical location and mobility status, application layer context, time and environmental information, etc.

[0025] Data communication parameters refer to a set of configurable technical parameters that control or influence the communication methods, formats, efficiency, and reliability adopted by a terminal when transmitting data. Data communication parameters directly determine how data is encoded, compressed, encrypted, fragmented, scheduled, and transmitted. For example, data communication parameters include at least one of the following: the transmission protocol between the terminal and the edge server, the data compression rate or encoding format used by the terminal to send data to the edge server, encryption strength, transmission frequency / reporting cycle, data granularity or sampling rate, etc.

[0026] In one feasible embodiment, the terminal operating context information includes at least the current channel state information, the terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior event; the data communication parameters include at least the data compression rate, uplink bandwidth, and transmit power.

[0027] Terminal runtime context information refers to environmental and state-related data that a terminal device perceives in real time and uses for decision-making during operation. Among these, current channel state information refers to a set of physical layer or link layer parameters describing the quality of the wireless channel between the terminal and the edge server, reflecting the reliability and efficiency of the current wireless transmission environment. Examples include, but are not limited to: received signal strength indication; reference signal received power or received quality; signal-to-noise ratio (SNR) or signal-to-interference-plus-noise ratio (SINR); bit error rate (BER) or block error rate (BIR); channel bandwidth availability; and multipath delay spread. Current channel state information is used to assess whether the current wireless link is suitable for high-speed, high-reliability, or low-latency data transmission. For example, in situations with poor channel quality, high-bandwidth transmission should be avoided, and a more robust but lower-rate communication strategy should be adopted instead.

[0028] Terminal battery power refers to the quantitative representation of the remaining battery energy of a terminal device, usually presented as a percentage or in milliampere-hours (mAh). It can also be used in conjunction with power consumption models to estimate remaining usage time. Terminal battery power serves as a key indicator for energy efficiency management. In low battery conditions, priority should be given to reducing the power consumption of the communication module to extend device availability, ensure the normal operation of other terminal functions, and avoid impacting the user experience.

[0029] The urgency level of preset high-risk behavioral events is a grading indicator of the timeliness of security response to triggered preset high-risk behavioral events. It is used to characterize the priority of handling the event or the tolerance for response delay. For example, the urgency level is divided into: High urgency, such as detecting account theft attempts, abnormal shutdown of industrial equipment, and vehicle collision warnings, requiring reporting within seconds or even milliseconds; Medium urgency, such as abnormal login with a different geographical location, tolerating delays of several seconds to tens of seconds; Low urgency, such as slight deviations from user operating habits, which can be batch cached and reported periodically. This urgency level is usually pre-bound to the type of high-risk behavioral event, such as through configuration tables or metadata annotations, or it can be dynamically output by a risk scoring model.

[0030] Data communication parameters refer to the technical control variables that can be dynamically adjusted by the terminal when uploading behavioral representation data. Among them, the data compression ratio refers to the proportion by which the original behavioral representation data is reduced in size after being processed by the compression algorithm. It is usually expressed as the ratio of the compressed data size to the original data size. For example, if the channel is poor or the battery is low, the compression ratio can be increased to reduce the amount of data transmitted. If the urgency of the behavior is high, the compression ratio can be reduced (or even not compressed) to ensure information integrity and parsing speed.

[0031] Uplink bandwidth refers to the maximum transmission rate that a terminal can use when sending data to an edge server. This bandwidth can be allocated by the network scheduler or dynamically negotiated by the terminal based on QoS requests. For example, in Wi-Fi, uplink bandwidth can be controlled by selecting different physical layer rates or channel widths. If a high-urgent event is triggered, higher uplink bandwidth is requested to speed up transmission; if the terminal is in a low-power or weak-channel situation, bandwidth usage is actively limited to avoid a surge in power consumption due to retransmissions.

[0032] Transmit power refers to the radio frequency output power used by the terminal's wireless communication module when transmitting data. This parameter directly affects communication distance, signal penetration capability, and energy consumption. For example, if the terminal channel quality is poor, the transmit power is appropriately increased to maintain link reliability; if the terminal battery is severely insufficient, the maximum transmit power is limited, even at the cost of sacrificing some communication success rate; if a high-emergency event is triggered, link connectivity is prioritized, allowing short-term high-power transmission.

[0033] This embodiment dynamically adjusts the data communication parameters, such as compression rate, uplink bandwidth, and transmission power, by combining channel status, power consumption, and the urgency of the behavior. While ensuring timely and reliable reporting of high-risk behavioral events, it effectively reduces terminal power consumption, improves transmission robustness in weak network environments, and optimizes network resource utilization, thereby achieving a synergistic balance between security, real-time performance, and energy efficiency.

[0034] Specifically, the terminal's operating system or middleware module continuously monitors and collects the aforementioned runtime context information, and evaluates the context based on preset strategies or machine learning models. For example, if the battery level is less than 10% and the device is on a mobile network, it is determined to be a low-power, high-cost communication scenario; if the device is on a financial app interface and connected to public Wi-Fi, it is determined to be a high-security scenario. Based on the evaluation results, communication parameters are determined from a preset rule base or through optimization algorithms. For example, in low-power scenarios, the reporting frequency is reduced, high compression ratio is enabled, and low-power protocols are switched; in high-security scenarios, end-to-end encryption is enforced, caching is disabled, and digital signatures are added; in weak network environments, packet size is reduced, forward error correction is enabled, and retransmission timeouts are extended.

[0035] The determined communication parameters are configured into communication modules, such as the network SDK and message queue client, for subsequent data transmission. For example, when the terminal detects that the user is moving at high speed and the 5G signal fluctuates greatly, the reporting period of behavioral representation data is automatically extended from 5 seconds to 30 seconds, and differential encoding is used to upload only the changes. Next, based on the determined data communication parameters, the original behavioral representation data is modified in terms of format, content, or structure to meet communication constraints or optimize transmission performance. Exemplary adjustment methods include at least one of the following: data pruning: if communication bandwidth is limited or power is insufficient, only the most critical feature dimensions of the behavioral representation data are retained. For example, if the original representation contains 10 features, only 3 highly discriminative features are uploaded after adjustment; data compression: applying a specified compression algorithm to reduce data volume. For example, converting time-series behavioral logs into differential sequences before compression; data aggregation: merging behavioral representations from multiple time points into a statistical summary (such as mean, variance, maximum value) to reduce transmission frequency. Suitable for non-emergency monitoring scenarios; encryption and encapsulation: encrypt data, add digital signatures, or encapsulate it into specific protocol frames according to communication parameter requirements; precision degradation: reduce numerical precision within the allowable error range to save bytes; metadata addition: add communication context tags (such as low power mode, weak network environment) to help the receiving end understand the reasons why data integrity may be limited.

[0036] For example, the behavioral representation data is a 128-dimensional user action embedding vector. After determining to use high-compression low-frequency reporting parameters, it is reduced to 16 dimensions by PCA, and then encoded with Base64 and appended with a timestamp and device ID to form the adjusted behavioral representation data.

[0037] S130. The adjusted behavioral representation data is sent to the edge server so that the edge server can perform anti-fraud identification based on the behavioral representation data and generate anti-fraud identification results.

[0038] After adapting the originally generated behavioral representation data according to the terminal's operating context information, the terminal device sends the adjusted behavioral representation data to an edge server deployed at the network edge via a wireless communication link. Upon receiving the data, the edge server performs real-time analysis and risk assessment of the behavioral representation data based on a pre-defined anti-fraud analysis model, such as a machine learning classifier, rule engine, or graph neural network. This identifies any abnormal or fraudulent behavioral patterns and generates structured anti-fraud identification results. For example, the anti-fraud identification results may include labels such as normal, suspicious, or high-risk, or specific risk scores, which are used to trigger subsequent security response actions such as alarms, interception, manual review, or policy updates.

[0039] Sending behavioral representation data to edge servers leverages the low latency, high privacy, and localized processing advantages of edge computing to significantly improve the response speed, scalability, and data security of anti-fraud systems.

[0040] S140. Receive the anti-fraud identification result returned by the edge server, and perform corresponding anti-fraud decision operations based on the anti-fraud identification result.

[0041] The terminal device receives the anti-fraud identification result returned by the edge server. Based on this result, it automatically executes corresponding anti-fraud decision-making operations according to a preset policy rule engine. For example, if the risk is determined to be high, the current transaction or login session is immediately blocked, the account is locked, and two-factor authentication or multi-factor authentication is triggered; if the risk is suspicious, logs are recorded, monitoring intensity is increased, or a manual review task is pushed; if the risk is normal, the business process is allowed to continue. Optionally, different types of terminals correspond to different policy rule engine mechanisms, thereby realizing personalized anti-fraud decision-making operations for different terminals to meet their needs.

[0042] This closed-loop mechanism enables integrated anti-fraud capabilities, encompassing behavior perception, edge intelligent analysis, and rapid local response, effectively balancing security, user experience, and system real-time performance.

[0043] The technical solution of this embodiment accurately acquires corresponding behavioral representation data by responding to preset high-risk behavioral events on the terminal side, and adaptively adjusts the data in combination with the terminal's operating context information. Then, the adjusted data is efficiently transmitted to the edge server for low-latency anti-fraud identification. The terminal then executes the corresponding anti-fraud decision operation based on the returned identification results, thereby realizing a complete closed loop from behavior perception, intelligent communication, edge analysis to local response. This not only ensures the timely and reliable handling of high-risk events, but also achieves a balance between communication efficiency, energy consumption, security, and data integrity, improving the operational robustness and overall security response efficiency in weak network environments, and taking into account security, real-time performance, energy efficiency, and user experience.

[0044] Figure 2 This is a flowchart of another anti-fraud identification method provided by an embodiment of the present invention. This embodiment further refines the process of adjusting the behavioral representation data in the above embodiments. For example... Figure 2 As shown, the method includes: S210. In response to the triggering of a preset high-risk behavior event, determine the behavioral representation data corresponding to the preset high-risk behavior event.

[0045] In one feasible embodiment, the behavioral representation data corresponding to the preset high-risk behavioral events is determined, including: Acquire image data and behavioral text descriptions corresponding to preset high-risk behavioral events; Based on the feature extraction results of the image data, determine the visual semantic features; Based on the feature extraction results of behavioral text description information, determine the semantic features of the text; Behavioral representation data is determined based on visual semantic features and textual semantic features.

[0046] In this embodiment, to more comprehensively and accurately characterize the semantic information of preset high-risk behavioral events, multimodal perception is used to acquire image data and behavioral text description information related to the event. Image data can be acquired through the terminal's camera, surveillance video frames, or screenshots to record the terminal's visual information at the time the behavior occurs. Behavioral text description information can come from user operation logs, system event summaries, natural language input, or structured behavioral tags, such as a user attempting to change their payment password in an uncommon location, providing the semantic context of the behavior.

[0047] Feature extraction is performed on the two types of heterogeneous data respectively. Pre-trained visual models, such as ResNet, ViT, or CNN backbone networks, are used to process the image data, extracting high-level semantic feature vectors to obtain visual semantic features. These visual semantic features can characterize key visual elements in the image related to high-risk behaviors, such as abnormal facial expressions, suspicious device access, and environmental background. For example, visual semantic features are represented by high-dimensional visual semantic vectors. Simultaneously, natural language processing models, such as BERT, TextCNN, or Transformer encoders, are used to encode the behavioral text description information, generating text semantic features that reflect behavioral intent, contextual logic, and risk keywords. For example, text semantic features are represented by low-dimensional text semantic vectors.

[0048] Finally, visual semantic features are fused with textual semantic features, for example, through splicing, weighted fusion, cross-modal attention mechanisms, or multimodal joint embedding, to generate unified and highly discriminative behavioral representation data.

[0049] In this embodiment, efficient and low-power semantic feature extraction is achieved on the terminal side to significantly reduce the amount of raw data uploaded. Existing technologies generally require terminals to upload complete call logs, SMS content, images, or location trajectories to the cloud, resulting in high communication load and significant transmission latency. This embodiment directly extracts semantic features from data corresponding to preset high-risk behavioral events such as scanning QR codes, entering verification codes, and launching financial applications on the device side, uploading only highly compressed semantic vectors instead of raw image or text data. While ensuring recognition accuracy, this significantly reduces the number of model parameters and computational load. Furthermore, by uploading semantic features instead of bitstreams, it effectively alleviates wireless link pressure and prevents the leakage of sensitive information, achieving the privacy protection goal of keeping data within the terminal.

[0050] This embodiment generates behavioral representation data by integrating semantic information from both visual and textual dimensions. This not only enhances the ability to identify complex and high-risk behaviors through behavioral representation data, but also fundamentally reduces data transmission load and the risk of original data privacy leakage by completing feature extraction of the original data locally on the terminal and sending only the feature extraction results to the edge server, thereby improving the real-time performance of anti-fraud identification.

[0051] In one feasible embodiment, visual semantic features are determined based on the feature extraction results of the image data, including: Image data is input into a pre-trained lightweight semantic coding model, which performs high-level semantic extraction on the image data to generate visual semantic features corresponding to preset high-risk behavioral events. The lightweight semantic coding model includes an encoder, an attention module, and a decoder connected in sequence. The attention module adopts a convolutional block attention mechanism and includes a channel attention submodule and a spatial attention submodule. It is used to adaptively weight the feature map output by the encoder. The feature map includes at least the feature map corresponding to the key visual region. The key visual region includes at least one of the following: QR code region, face region, or sensitive text region.

[0052] Traditional centralized systems require the aggregation of large amounts of raw user behavior data, posing a serious risk of privacy breaches. This embodiment adopts an architecture where a lightweight semantic coding model is uniformly trained and distributed by a central platform, edge nodes are responsible for local inference and decision-making, and terminals load adapted models on demand. Through a semantic communication paradigm, the transformation from raw data to task-related semantic features is completed on the terminal side. The data uploaded to the edge server is only an abstract vector or classification result, without containing information that can directly reconstruct user identity or behavioral details. Combined with a trusted execution environment and data anonymization technology, end-to-end privacy and security are ensured from collection and processing to transmission. That is, by minimizing user privacy exposure through semantic abstraction mechanisms, the security and compliance of the data processing process can be guaranteed.

[0053] Specifically, the acquired image data, such as images containing user interfaces, transaction scenarios, or identity verification screens, is input into a pre-trained lightweight semantic encoding model. This lightweight semantic encoding model is designed for resource-constrained terminal devices, such as smartphones, IoT terminals, or embedded security devices, significantly reducing computational overhead and memory usage while ensuring semantic expressive capabilities, thus adapting to the real-time processing needs of the edge.

[0054] The lightweight semantic coding model employs a three-layer structure, consisting of an encoder, an attention module, and a decoder. For example... Figure 3 The diagram illustrates the architecture of a lightweight semantic coding model. The encoder typically consists of several lightweight convolutional layers (such as depthwise separable convolutions) used to downsample the input image layer by layer and extract multi-scale feature maps. These feature maps initially contain texture, edge, and local semantic information from the image. Subsequently, the feature maps are fed into an attention module, which employs a convolutional block attention mechanism. This module comprises two sub-modules: a channel attention sub-module, which captures global contextual information for each channel through global average pooling and global max pooling, and generates channel weights via a shared multilayer perceptron (MLP) to enhance the response to high-risk semantically relevant channels (such as face feature channels and text region channels); and a spatial attention sub-module, which aggregates the data along the channel dimension and generates a spatial weight map through convolutional operations to highlight the location information of key discriminative visual regions in the image.

[0055] Key visual areas refer to local image regions that have high-risk indication significance in anti-fraud or security monitoring scenarios, including but not limited to: QR code areas, face areas, and sensitive text areas, such as screen text containing keywords like "transfer," "verification code," and "urgent." These areas are often directly associated with the occurrence of fraudulent activities.

[0056] After adaptive weighting by the attention module, the semantic responses of key regions in the feature map are enhanced, while irrelevant or interfering regions are suppressed, thereby improving the discriminative power of the features. Finally, the weighted feature map is input to the decoder, which can be a lightweight upsampling structure or a feature projection layer, to further integrate contextual information and output a fixed-dimensional vector, which is the visual semantic feature corresponding to the preset high-risk behavioral event.

[0057] The visual semantic features generated in this embodiment not only retain the high-level semantic content that is strongly related to risky behavior in the original image, but also achieve high-precision, low-latency, and low-power visual understanding capabilities on the terminal side through the synergistic effect of lightweight architecture and attention mechanism, providing a reliable and efficient visual input foundation for subsequent multimodal fusion and anti-fraud decision-making.

[0058] This embodiment deploys a lightweight model on the terminal side to extract local semantic features of high-risk behaviors. Only highly compressed semantic vectors are uploaded, reducing the amount of communication data. Furthermore, since the uploaded content consists of abstract features rather than raw data, it does not contain information that can identify an individual, thus achieving "data not leaving the terminal." This fundamentally reduces bandwidth pressure, communication overhead, and the risk of privacy leaks.

[0059] S220. The current channel state information, terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior event are used as state inputs and provided to the pre-trained reinforcement learning policy model to obtain the data compression rate, uplink bandwidth, and transmit power output by the reinforcement learning policy model.

[0060] To achieve intelligent and adaptive configuration of data communication parameters, the current channel state information, terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior events are used as multi-dimensional state inputs to jointly constitute the environment state for reinforcement learning decision-making. This state is then provided to a pre-trained reinforcement learning policy model, such as a model built based on Deep Q-Network (DQN), Policy Gradient Programming (PPO), or Actor-Critic architecture.

[0061] The reinforcement learning strategy model dynamically adjusts the configuration strategy of data communication parameters during training based on feedback signals of anti-fraud decision quality and terminal resource consumption. Aiming to maximize long-term overall benefits, this model, upon receiving the aforementioned state input, infers in real time through its internal policy network and outputs a set of optimal data communication parameter configurations. These parameters include: data compression rate controlling the volume and fidelity of behavioral representation data; uplink bandwidth determining data upload rate and network resource consumption; and transmit power affecting communication distance, reliability, and terminal power consumption. These parameters collectively determine how the behavioral representation data is adjusted and transmitted.

[0062] For example, the reinforcement learning policy model is optimized during the offline training phase by interacting with the simulation environment or historical operating data. Its reward function comprehensively considers two core feedback signals: anti-fraud decision quality, which is reflected by indicators such as identification accuracy, false negative rate, and response latency returned by the edge server, used to measure whether the transmitted data is sufficient to support effective security judgment; and terminal resource consumption, which includes energy consumption, bandwidth cost, transmission latency, and impact on terminal battery life during communication.

[0063] The reinforcement learning strategy model learns through continuous training how to balance security effectiveness and resource efficiency in different contexts, dynamically adjusting the configuration strategy of communication parameters. For example, in situations of high urgency and sufficient power, the model tends to choose low compression ratio, high bandwidth, and high transmission power to ensure recognition quality; while in situations of low urgency and low power, it prioritizes high compression ratio, low bandwidth, and minimum transmission power to save resources. After sufficient training, the model is deployed on the terminal side and can generate communication parameters adapted to the current situation in real time during actual operation, without relying on manual rule configuration. Thus, the system achieves intelligent communication control in a closed loop from perception to decision-making to execution, significantly improving the reliability, energy efficiency, and adaptability of high-risk behavior monitoring.

[0064] In this process, the terminal is only responsible for lightweight feature extraction and compression. All complex calculations involving fraud pattern recognition, correlation analysis and risk assessment are completed only at the edge server layer. This not only makes full use of the stronger computing power on the edge side, but also conforms to the design principles of lightweight and low power consumption on the terminal side.

[0065] For example, this embodiment proposes an energy-saving end-edge collaborative resource scheduling mechanism based on DDPG. By jointly optimizing the data compression rate, uplink bandwidth and transmission power on the terminal side, the overall system energy consumption is minimized while meeting the fraud identification accuracy requirements. This mechanism constitutes the core control loop of "terminal-edge" intelligent collaboration, ensuring the system's robustness and optimal energy efficiency in dynamic wireless environments.

[0066] Semantic feature extraction is performed at the terminal, and then the semantic features are transmitted to the edge server via wireless vectors for training. A schematic diagram of the architecture of the DDPG algorithm is shown below. Figure 4 As shown, an intelligent scheduling strategy involving edge-end collaboration is constructed. DDPG is suitable for long-term decision optimization in a continuous action space and can adaptively learn the optimal resource allocation strategy. The four elements of reinforcement learning are defined as follows: Intelligent Agent: Each terminal device acts as an independent intelligent agent, autonomously deciding its compression rate, bandwidth, and power.

[0067] Environmental state: The state of the system in time slot t can be represented by the state vector as follows: This includes channel gain, current compression rate, amount of data to be transmitted, remaining battery power, and task urgency.

[0068] Action space: continuous action vectors: the agent's current state Mapping to an action The action values ​​involved consist of three parts: data compression rate, uplink bandwidth, and transmit power, which can be expressed as: This indicates the adjustment of three resource variables in this round of scheduling.

[0069] Reward Function: To minimize energy consumption, a reward function is designed as the reciprocal of energy consumption, and a constraint penalty is introduced: ; ; Where ω is the penalty coefficient, [] represents the indicator function. The reward function guides the agent to find the strategy with the lowest energy consumption while satisfying the accuracy constraint.

[0070] The policy and value functions are jointly trained using an Actor-Critic network. An experience replay mechanism is used to improve sample utilization, and the training process is stabilized through a target network. The specific steps are as follows: S1. System Initialization Phase: First, each agent in the edge-edge collaborative computing environment is initialized. This initialization process includes: setting the parameters of the policy generation network. Parameters of the valuation network and their respective target network parameters. and Perform initialization assignment. Simultaneously, create and initialize an experience replay space for storing historical decision-making experiences and an environment space for defining the scope of their interactions for each agent. .

[0071] S2. Resource Allocation Strategy Generation and Execution: In each training epoch, the system performs the following core steps: The resource allocation strategy is generated by the strategy generation network. To encourage exploration, behavioral noise is added to the generated strategy, thus forming the final resource allocation action. The system then executes this action. And calculate immediate rewards based on their effects. At the same time, the system was observed to enter a new state. .

[0072] S3. Storage and reuse of empirical data: Record the decision-making process as an empirical tuple. Next, check the capacity of the experience replay space R. If the space is not full, store the tuple directly; if the space is full, follow the first-in-first-out principle and replace the earliest stored historical experience with the new experience.

[0073] S4. Iterative Update of Network Parameters: Once sufficient data has accumulated in the experience replay space R, the system enters the parameter update phase. Specifically, a small batch of experience samples is randomly drawn from R.

[0074] S4.1 Value Assessment Network Update: Calculate the target value of the value assessment network using the following formula: This formula embodies the evaluation idea based on future cumulative rewards. Subsequently, the parameters are updated by minimizing the mean squared error loss function between the predicted and target values. The loss function is defined as: .

[0075] S4.2 Policy Generation Network Update: The update objective of the policy generation network is to maximize the expected return given by the value evaluation network. Its parameters... The update gradient is calculated using the chain rule, with the following formula: This formula reveals that improvements in policy performance depend on the guidance of value assessment. The parameters are then updated using gradient ascent. .

[0076] S4.3 Target Network Soft Update: To improve the stability of the learning process, a soft update strategy is used to slowly synchronize the parameters of the target network, rather than directly copying them. The update formula is: ) and ) , where is an update coefficient close to 0. This process is performed after each round of parameter updates.

[0077] S5. Iterative optimization: Repeat steps S2 to S4. Through multiple training rounds, the parameters of the policy generation network and the value evaluation network are continuously optimized iteratively, eventually converging into a dynamic decision-making strategy that can achieve efficient and energy-saving allocation of resources in the edge system.

[0078] S230. Adjust the behavioral representation data according to the data communication parameters.

[0079] S240. The adjusted behavioral representation data is sent to the edge server so that the edge server can perform anti-fraud identification based on the behavioral representation data and generate anti-fraud identification results.

[0080] S250: Receive the anti-fraud identification results returned by the edge server, and perform corresponding anti-fraud decision operations based on the anti-fraud identification results.

[0081] This application adopts a three-tier architecture of "cloud training-edge distribution-end loading" and combines it with a lightweight model design to support on-demand loading and dynamic updates of the model on heterogeneous terminals. It balances training efficiency and terminal adaptability, and is suitable for unified management and continuous evolution in large-scale terminal environments, thereby improving model scalability and deployment flexibility.

[0082] The technical solution of this embodiment, by further introducing reinforcement learning algorithms to determine data communication parameters, can dynamically adjust the allocation of data communication resources according to real-time channel status, terminal battery level, and task urgency. Under the premise of ensuring that the semantic features transmitted to the edge meet the minimum recognition accuracy requirements, it minimizes the system energy consumption of the entire end-to-end transmission process, thereby extending the terminal's battery life and adapting to complex wireless network environments, realizing adaptive scheduling of end-to-end resources, and improving system energy efficiency and environmental adaptability.

[0083] Figure 5 This invention provides a flowchart of an anti-fraud identification method. This embodiment is applicable to situations where anti-fraud identification is performed based on terminal behavior data. The method can be executed by an anti-fraud identification device, which can be implemented in hardware and / or software and can be configured in an edge server. Figure 5 As shown, the method includes: S510: Receive target behavior representation data sent by the target terminal, and update the pre-built knowledge graph based on the target behavior representation data.

[0084] The edge server receives target behavior representation data from the target terminal, i.e., any smart terminal device participating in behavior monitoring, such as a smartphone, vehicle terminal, financial POS machine, or IoT security node. This target behavior representation data is a structured, high-dimensional semantic vector generated by the terminal after detecting a preset high-risk behavior event, through multimodal fusion and adaptive adjustment of communication parameters. It can accurately characterize the essential attributes, context, and potential risk features of a specific user behavior.

[0085] After receiving the target behavior representation data, the edge server uses it as input for incremental learning, dynamically updating and evolving the pre-built knowledge graph. The knowledge graph is a structured knowledge base built from historical behavior representation data uploaded by multiple terminals during initialization or historical operation phases, using techniques such as entity extraction, relation modeling, and semantic clustering. Nodes in the graph can represent entities such as users, devices, geographical locations, behavior types, and risk tags, while edges represent the relationships between entities and can be appended with attributes such as weights, timestamps, or confidence levels.

[0086] For example, the knowledge graph update process includes: entity alignment and deduplication: mapping the target behavior representation data to existing nodes in the graph or identifying new entities; relationship reasoning and expansion: inferring and adding relationships between nodes based on the current behavior context; graph embedding update: adjusting node vector representations to incorporate new knowledge using graph neural networks or incremental embedding algorithms; risk pattern deposition: if the behavior is confirmed as real fraud by subsequent anti-fraud results, it is solidified into a high-risk subgraph or rule template in the graph.

[0087] In one feasible embodiment, updating the pre-built knowledge graph based on the target behavior representation data includes: Semantic space alignment is performed on the high-dimensional visual semantic vectors and text semantic vectors in the target behavior representation data to obtain the aligned multimodal vectors; The aligned multimodal vectors are weighted and fused based on an attention mechanism to obtain a joint semantic representation; The joint semantic representation is decoded to obtain at least one graph element from the corresponding graph nodes, relations or attributes, and the knowledge graph is updated based on the graph elements.

[0088] To achieve a structured understanding of target behavior representation data and accurate updating of the knowledge graph, the high-dimensional visual semantic vectors extracted from image data using a lightweight semantic encoding model and the textual semantic vectors encoded from behavioral text description information using a natural language processing model are first semantically aligned. Since visual and textual modalities differ in their distribution in the original feature space (e.g., inconsistent dimensions, different semantic granularities), direct fusion may lead to information mismatch. Therefore, a shared projection layer, such as a linear transformation or a cross-modal encoder, maps the two types of vectors to a unified common semantic embedding space, enabling similar semantic concepts to have similar vector representations in this space, thus obtaining aligned multimodal vectors.

[0089] Subsequently, an attention mechanism, such as multi-head cross-attention or gated fusion networks, is introduced to perform weighted fusion of the aligned multimodal vectors. This mechanism can dynamically evaluate the relative importance of the visual and textual modalities based on the specific context of the current high-risk behavior. For example, in scenarios involving sensitive text recognition in screenshots, textual semantic weights are higher; while in scenarios relying on liveness detection or environmental background judgment, visual semantic weights are superior. Through this adaptive weighting process, a joint semantic representation that integrates multi-source semantic information and retains key discriminative features is generated. This representation possesses both high expressive power and good semantic consistency.

[0090] Finally, the joint semantic representation is input into a graph element decoding module, which can be implemented based on a graph neural network decoder, a sequence-to-graph conversion model, or a rule-guided parser. This module performs structured parsing of the representation, extracting graph elements that can be used for knowledge graph construction or updating. Graph elements include, but are not limited to: graph nodes: such as user entities, device identifiers, geographical locations, behavior types (e.g., login from a different location), risk tags (e.g., suspected theft); relationships: such as user-execution-behavior, behavior-occurrence-location, behavior-associated-risk type; attributes: such as behavior occurrence time, confidence score, urgency level, terminal type, and other metadata.

[0091] The extracted graph elements are used to incrementally update the pre-built knowledge graph: if the corresponding node or relationship already exists, its attributes are updated or its association strength is enhanced; if it is a newly emerging behavior pattern or entity, the corresponding node and edge are added to the graph.

[0092] This embodiment achieves automatic transformation from raw multimodal behavioral data to structured knowledge through knowledge graph update operations, thereby improving the timeliness and coverage of the knowledge graph.

[0093] In one feasible embodiment, the joint semantic representation is decoded into graph elements to obtain at least one graph element from the corresponding graph nodes, relations, or attributes, and the knowledge graph is updated based on the graph elements, including: The joint semantic representation is matched with the existing entities in the knowledge graph for semantic similarity. If the match is successful, it is associated with the corresponding entity; otherwise, a new graph node is created as the new entity. Based on joint semantic representation, the association relationship between entities is activated or constructed, and association edges are generated; among them, when the similarity between the visual semantic vectors corresponding to the target terminal and other terminals exceeds a preset threshold, strong association edges are established between the corresponding entities. The dynamic attributes of related entities are updated synchronously based on the joint semantic representation; wherein the dynamic attributes include at least one of the most recent active timestamp and the frequency of occurrence.

[0094] The joint semantic representation is semantically similar to existing entity nodes in the knowledge graph (such as users, devices, geographical locations, behavior types, or risk tags). This matching is achieved by calculating the similarity (such as cosine similarity or Euclidean distance) between the joint semantic representation and the embedding vectors of each entity, with a preset similarity threshold as the judgment criterion. If the similarity of an existing entity exceeds the threshold, it is considered a successful match, and the semantic information corresponding to the current behavior is associated with the existing entity to avoid the generation of redundant nodes. If no entity meets the matching condition, it is considered a newly emerging behavior pattern or unknown entity, and a new graph node is created with its joint semantic representation as the initial embedding, becoming a new entity in the knowledge graph.

[0095] Based on joint semantic representations, relationships between entities are activated or constructed, generating association edges. Specifically, when behavioral representations from a target terminal are highly similar to behavioral representations uploaded by other historical terminals at the visual semantic level—for example, when the similarity between their high-dimensional visual semantic vectors exceeds a preset threshold—it indicates that multiple terminals may have encountered the same or similar fraudulent methods, such as the same phishing page or the same fake identity operation. In this case, strong association edges will be established between the corresponding entities, such as different user nodes or device nodes. These strong association edges can be used for subsequent group fraud identification, attack source tracing, or cross-user risk propagation analysis, significantly improving the relational expression capability and reasoning depth of the graph.

[0096] Finally, the dynamic attributes of relevant entities are updated synchronously using joint semantic representations. Dynamic attributes refer to non-static metadata that changes over time or with the frequency of behavior, and include at least: a recent activity timestamp, used to record the time when the entity (such as a certain type of abnormal behavior or a certain device) was last observed, used to assess its timeliness and activity status; and frequency of occurrence, used to count the cumulative number of times the entity has been detected across all network terminals, reflecting its prevalence or attack scale. These dynamic attributes not only enrich the descriptive dimensions of entities, but can also serve as temporal features in graph neural network training, or be used to set risk scoring weights.

[0097] For example, feature alignment and multimodal semantic fusion are performed using a lightweight semantic decoder. The lightweight semantic decoder receives heterogeneous semantic vectors from multiple sources, and its primary task is to perform cross-modal alignment and deep fusion on them.

[0098] Vector alignment: The decoder maps high-dimensional visual semantic vectors extracted from the terminal side (such as 128-dimensional features extracted from image screenshots using the UNet-CBAM model) to traditional text semantic vectors (such as behavior encoding in structured logs) into a unified semantic space. For example, a visual feature vector representing "high-fidelity bank login page" is semantically associated and aligned with a text log vector indicating "user enters password on this page".

[0099] Feature fusion: The aligned multimodal vectors are fused through feature concatenation or attention weighting mechanisms to generate a unified joint semantic representation rich in multidimensional information. This representation includes both intuitive visual evidence and contextual information from behavioral sequences, providing complete input for subsequent knowledge graph mapping.

[0100] The graph element decoding and dynamic updating process involves inputting the fused joint semantic representation into the graph decoding module, which is responsible for decoding it into specific elements of the knowledge graph and updating the graph status in real time.

[0101] Entity Linking and Recognition: The decoder performs similarity matching between semantic representations and existing entities in the knowledge graph to achieve entity linking. If a new risk pattern is discovered (such as a new type of phishing website template), a new entity node will be created.

[0102] Relationship Path Activation and Construction: Based on fusion features, the system automatically activates or constructs relationships between entities. For example, it establishes a relationship of "User Device A - [Access] - High-imitation phishing website X". In particular, the system calculates the similarity between visual semantic vectors reported by different terminals. If the similarity exceeds a threshold, a strong "visually similar" association edge is automatically constructed between the corresponding "website" entities, which is key to associating isolated events.

[0103] Entity attribute update: The decoder synchronously updates the attributes of related entities. For example, it updates the dynamic attributes of the entity "high-imitation phishing website X", such as "recent active timestamp", "related screenshot feature hash" and "occurrence frequency", to keep the graph up-to-date.

[0104] This embodiment achieves the transformation of knowledge graph from a static knowledge base to a dynamic, self-evolving intelligent cognitive graph through three collaborative steps: semantic matching, relationship construction, and attribute updating. This effectively supports the continuous perception and accurate modeling of new, variant, and collaborative fraud behaviors.

[0105] S520: Based on a pre-trained graph neural network model, collaborative reasoning is performed on the updated knowledge graph to obtain the anti-fraud identification results corresponding to the target behavior representation data.

[0106] After the knowledge graph is dynamically updated, a pre-trained graph neural network model is called to perform collaborative reasoning on the updated knowledge graph, thereby generating anti-fraud identification results corresponding to the target behavior representation data.

[0107] Specifically, the graph neural network model has been pre-trained offline on historical multi-terminal behavior data and its corresponding real fraud labels, enabling it to aggregate neighbor information, propagate risk signals, and learn complex dependencies between entities from the graph structure. During the inference phase, the graph neural network model takes an updated knowledge graph as input, which includes newly added or updated entity nodes (such as the user, device, or operation type corresponding to the current target behavior), newly added strong-link edges (reflecting similar behavior patterns across terminals), and dynamic attributes (such as active time and frequency). Through a multi-layer message passing mechanism, the graph neural network model fuses local node features with semantic and structural information within their multi-hop neighborhoods, thereby generating context-aware graph embedding representations for nodes related to the current target behavior.

[0108] Based on this, the model uses a classification head to discriminate the embedding and outputs structured anti-fraud identification results, including but not limited to: risk category (such as normal, suspicious, account theft, phishing attack); risk confidence score (probability value between 0 and 1); and related evidence path (such as strong visual similarity between the behavior and 3 confirmed fraudulent devices).

[0109] For example, based on real-time updates of the knowledge graph, the system enters the collaborative reasoning and hierarchical decision generation stage. Its core is to achieve accurate identification and adaptive hierarchical handling of group risks through a series of quantifiable algorithmic models. The specific implementation of this process is as follows: (1) Graph relation reasoning based on multimodal evidence First, deep relationship mining is performed, with its key innovation lying in quantifying visual semantic evidence as strongly correlated edges in a graph. When two different "high-imitation phishing website" entities... and Possessing visual semantic vectors extracted from the terminal and At that time, the system calculates the cosine similarity as the association weight: ; like ( If the threshold is preset, the system will create or reinforce a weight between entities. The system uses "visual similarity" edges to establish relationships. Based on these edges, the system can perform multi-hop reasoning to discover hidden paths such as "User A → visits → website P ← [visually similar, w_{pq}] → website Q ← belongs to → black market group Z", thereby penetrating domain name spoofing and enabling cross-terminal event association.

[0110] (2) Risk community mining algorithm based on graph neural network (GNN) To automatically identify the structure of fraud gangs from the aforementioned knowledge graph rich in multimodal evidence, this application deploys a lightweight graph neural network model on the edge side, and the specific implementation process is as follows: Node feature initialization: Each entity node in the graph initial features It is composed of its fused multimodal semantic vectors, which are weighted by a learnable weight matrix. and For visual vectors and text vector After performing a linear transformation and adding them together, we get: ; Risk Information Dissemination and Aggregation: In GNN's... Layers, node features are iteratively propagated and aggregated through relational edges (including "visual similarity" edges). Nodes From its neighboring nodes Received information: ; Then, all neighbor information is aggregated to update its own characteristics: ; go through The final representation of each node after layer iteration It contains structural and semantic information about the risk network as a whole. The system then... Cluster analysis is performed to automatically group clusters of nodes that are closely clustered in the vector space into the same "risk community," thereby identifying organized fraud networks.

[0111] (3) Quantitative risk assessment and adaptive hierarchical decision making For identified individuals or communities at risk, the system invokes a multi-dimensional risk quantification assessment algorithm for precise scoring. This algorithm integrates quantifiable indicators across the following four dimensions: ; Graph structure risk score, derived from GNN model output or community density calculation.

[0112] : Multimodal evidence confidence, which combines visual and behavioral confidence from the terminal model output.

[0113] Spatiotemporal clustering: quantifies the density of similar events occurring within a specific time window and geographical range.

[0114] Asset sensitivity, a constant predefined by business rules.

[0115] The weights are learnable or preset, satisfying .

[0116] Based on the calculated comprehensive risk score The system automatically triggers a tiered decision-making process based on the comparison with a preset threshold. ; The relevant characteristics and associated paths of low-risk events will be used as feedback data and fed back into the model training process to continuously optimize the parameters of the terminal-side feature extraction model and the edge-side GNN model, forming a self-evolving intelligent decision-making closed loop.

[0117] This embodiment achieves a leap from individual anomaly detection to insightful group fraud by collaborating with an edge-side "human-device-behavior-spatiotemporal" knowledge graph and a lightweight semantic decoder. Traditional centralized architectures require an "upload-centralized processing-distribution" process, often resulting in end-to-end latency of several seconds. This embodiment, by predicting risky behavior locally on the terminal and uploading semantic features in advance, combined with rapid analysis and decision-making using the edge-side knowledge graph, significantly shortens the response path, dramatically improves the interception success rate, achieves millisecond-level response, and meets real-time intervention requirements.

[0118] The technical solution in this embodiment fully utilizes the collective behavioral knowledge accumulated in the knowledge graph, significantly improving the ability to identify covert, novel, or collaborative fraudulent behaviors compared to traditional methods that rely solely on single-point behavioral features. Simultaneously, by continuously introducing fresh behavioral representation data from distributed terminals, the knowledge graph is constantly enriched in its ability to recognize new, variant, or covert fraud patterns, thereby enhancing the overall system's generalization, interpretability, and proactive defense capabilities. This embodiment achieves a closed loop from individual behavioral perception to collective knowledge accumulation, supporting not only more accurate real-time risk identification but also providing structured knowledge support for strategy optimization and model retraining.

[0119] This invention proposes a real-time terminal fraud data identification and edge collaboration system based on lightweight semantic communication, aiming to solve the problems of high communication overhead, high privacy risks, long response delays, and difficulty in identifying group fraud in existing anti-fraud systems. The core of this solution lies in the innovative construction of a three-level progressive architecture: "terminal local semantic perception—edge-end dynamic resource collaboration—edge multi-source intelligent decision-making." Unlike existing technologies that generally require terminals to upload raw data to the cloud for processing, this solution achieves "data not leaving the terminal" by extracting and compressing visual semantic features of high-risk behaviors locally on the terminal, fundamentally reducing transmission load and privacy leakage risks. The extracted semantic features are efficiently transmitted to the edge via an adaptive resource scheduling strategy based on deep reinforcement learning. The core decision-making process for fraud identification is completed only at the edge layer. The edge server integrates multimodal semantic features uploaded from multiple terminals and drives a group risk identification model based on knowledge graphs and graph neural networks to perform deep correlation analysis and hierarchical decision-making. This architecture not only achieves millisecond-level real-time risk response, but also, by mining deeper evidence such as visual semantics, achieves a leap in capability from single-point anomaly detection to precise identification of cross-terminal and cross-regional fraud gangs, forming a new generation of terminal anti-fraud technology solution with low latency, high energy efficiency, and strong privacy protection. For example, specific implementation schemes include: Step 1: Semantic feature extraction based on attention mechanism on the terminal side.

[0120] When a terminal device detects high-risk behavioral events such as scanning a QR code, receiving a text message containing the keyword "verification code," or launching a financial app and entering a sensitive interface, the semantic awareness service module in the operating system kernel or trusted execution environment is activated and initiates a semantic feature extraction process locally. This process is completed entirely on the terminal side, without uploading raw data, thus protecting user privacy. The specific steps are as follows: High-risk event triggering: The behavior monitoring agent monitors terminal operations in real time based on the rule engine. When a high-risk event is detected, the semantic extraction task scheduler is triggered.

[0121] Lightweight Model Loading: The scheduler loads the proposed UNet-CBAM lightweight semantic coding model, which includes: an encoder, a Convolutional Block Attention Module (CBAM) mechanism (including channel attention and spatial attention mechanisms) to dynamically focus on key regions such as QR codes, faces, and sensitive text, significantly improving model accuracy, and a decoder. The Deep Automatic Portrait Matting dataset is used for training and testing. A training set is selected from the image dataset, appropriately processed, and then used to train the model. This training set contains 1530 training images and 170 test images, each in RGB format. The proposed system is trained under additive white Gaussian noise channels, with the signal-to-noise ratio randomly varying between 1 and 20 dB to simulate different channel environments. The RMSprop algorithm is used to optimize the model.

[0122] Semantic feature extraction: The original image frame is input, and after the attention weight map is generated by the CBAM module, a 128-dimensional floating-point semantic vector is generated by global average pooling. Feature structured encapsulation: The output includes a structured semantic feature package containing device identifier, timestamp, modality type, feature vector, risk type, confidence level, etc., providing a foundation for subsequent transmission and decision-making.

[0123] Step 2: Energy-saving edge resource allocation algorithm based on DDPG.

[0124] The current channel state information, terminal battery level, and the urgency level of preset high-risk behavioral events are used as state inputs to a pre-trained reinforcement learning policy model. This yields the data compression rate, uplink bandwidth, and transmit power output by the reinforcement learning policy model. The behavioral representation data is then adjusted based on these parameters.

[0125] Step 3: Multi-source semantic fusion decision based on knowledge graph.

[0126] Edge servers aggregate visual semantic vectors and textual semantic vectors from multiple terminals, including device behavior and user logs, in real time, forming a multi-source semantic feature stream. This feature stream is aligned and fused by a lightweight semantic decoder, driving the construction and updating of a dynamic knowledge graph. Based on this, the system performs deep collaborative reasoning through a graph neural network model deployed at the edge, achieving accurate identification from individual anomalies to group fraud gangs, and generating hierarchical decision instructions.

[0127] Current anti-fraud systems have significant shortcomings in communication efficiency, terminal energy efficiency, privacy protection, environmental adaptability, and the ability to identify group risks. This invention aims to systematically address these intertwined technical challenges by deeply integrating architecture and algorithms to construct a next-generation real-time terminal fraud identification and collaborative defense system for future mobile network environments. Specifically, it includes the following four solutions: First, this application achieves efficient and low-power semantic feature extraction on the terminal side to significantly reduce the amount of raw data uploaded. Existing systems generally require terminals to upload complete call logs, SMS content, images, or location trajectories to the cloud, resulting in high communication load and significant transmission latency. This application proposes deploying a lightweight UNet-CBAM model locally on the terminal, directly extracting semantic features from high-risk behaviors such as scanning QR codes, entering verification codes, and launching financial applications. Only highly compressed semantic vectors are uploaded, rather than the original image or text data. This method significantly reduces the number of model parameters by 55% and the model computation by 14% while maintaining recognition accuracy. Moreover, by uploading semantic features instead of bitstreams, it effectively alleviates wireless link pressure and prevents the leakage of sensitive information, achieving the privacy protection goal of "data not leaving the terminal."

[0128] Secondly, dynamic collaborative scheduling of communication and computing resources between the terminal and the edge can balance recognition accuracy and overall system energy efficiency. In complex and ever-changing wireless environments, factors such as terminal battery power, channel quality, and task urgency change dynamically, and static upload strategies are prone to resource waste or task failure. To address this, this application introduces a reinforcement learning algorithm based on DDPG to construct an edge-end collaborative scheduling mechanism. The edge server collects terminal status and network load in real time, forming a multi-dimensional state space, and outputs the optimal upload decision through an Actor-Critic architecture. This strategy prioritizes high-risk events while dynamically adjusting transmission behavior to minimize system energy consumption, achieving joint optimization of accuracy and energy efficiency. Compared with traditional methods, it can reduce energy consumption by 27.6% while maintaining accuracy.

[0129] Third, minimizing user privacy exposure through semantic abstraction mechanisms ensures the security and compliance of data processing. Traditional centralized systems require the aggregation of large amounts of raw user behavior data, posing a serious risk of privacy leakage and violating the "minimum necessary" principle in the Personal Information Protection Law. This application adopts an architecture where a lightweight model is uniformly trained and distributed by a central platform, edge nodes are responsible for local inference and decision-making, and terminals load adapted models on demand. Through a semantic communication paradigm, the transformation from "raw data" to "task-related semantic features" is completed on the terminal side. The uploaded content is only an abstract vector or classification result, without containing information that can directly reconstruct user identity or behavioral details. Combined with a trusted execution environment and data anonymization technology, end-to-end privacy security is ensured from collection and processing to transmission, meeting the requirements of international privacy regulations such as GDPR and CCPA.

[0130] Fourth, this application constructs an intelligent decision-making mechanism that supports cross-terminal and cross-modal correlation analysis to enhance the ability to identify organized and group-based fraud. Currently, most systems are limited to single-point detection, making it difficult to detect group-based fraud activities distributed across multiple devices and communication channels. This application achieves collaboration between a "human-device-behavior-spatiotemporal" knowledge graph and a lightweight semantic decoder at the edge, realizing a leap from individual anomaly detection to insightful group-based fraud correlation.

[0131] In summary, this application systematically solves the bottlenecks of existing anti-fraud systems in terms of efficiency, security, intelligence, and scalability through the deep integration of technologies such as semantic communication, edge intelligence, reinforcement learning, and knowledge graphs. It constructs a low-latency, high-reliability, and strong-privacy terminal fraud identification and collaborative defense system for future 5G / 6G environments.

[0132] Figure 6 This is a schematic diagram of the structure of an anti-fraud identification device provided in an embodiment of the present invention. Figure 6 As shown, the device includes: The behavior representation data determination module 610 is used to determine the behavior representation data corresponding to the preset high-risk behavior event in response to the triggering of the preset high-risk behavior event. The behavior representation data adjustment module 620 is used to determine the data communication parameters based on the terminal's operating context information, and to adjust the behavior representation data according to the data communication parameters; The behavior representation data sending module 630 is used to send the adjusted behavior representation data to the edge server so that the edge server can perform anti-fraud identification based on the behavior representation data and generate anti-fraud identification results. The anti-fraud decision operation module 640 is used to receive the anti-fraud identification results returned by the edge server and perform corresponding anti-fraud decision operations based on the anti-fraud identification results.

[0133] The technical solution of this embodiment accurately acquires corresponding behavioral representation data by responding to preset high-risk behavioral events on the terminal side, and adaptively adjusts the data in combination with the terminal's operating context information. Then, the adjusted data is efficiently transmitted to the edge server for low-latency anti-fraud identification. The terminal then executes the corresponding anti-fraud decision operation based on the returned identification results, thereby realizing a complete closed loop from behavior perception, intelligent communication, edge analysis to local response. This not only ensures the timely and reliable handling of high-risk events, but also achieves a balance between communication efficiency, energy consumption, security, and data integrity, improving the operational robustness and overall security response efficiency in weak network environments, and taking into account security, real-time performance, energy efficiency, and user experience.

[0134] Optionally, the terminal operating context information includes at least the current channel state information, the terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior event; the data communication parameters include at least the data compression rate, uplink bandwidth, and transmit power.

[0135] Optionally, the behavior representation data adjustment module includes a data communication parameter determination unit, specifically used for: The current channel state information, terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior event are used as state inputs and provided to the pre-trained reinforcement learning policy model to obtain the data compression rate, uplink bandwidth, and transmit power output by the reinforcement learning policy model. Among them, the reinforcement learning strategy model dynamically adjusts the configuration strategy of data communication parameters based on the feedback signals of anti-fraud decision quality and terminal resource consumption during the training process.

[0136] Optional, the behavioral representation data determination module includes: The data acquisition unit is used to acquire image data and behavioral text description information corresponding to preset high-risk behavioral events; The visual semantic extraction unit is used to determine visual semantic features based on the feature extraction results of image data; The text semantic extraction unit is used to determine the text semantic features based on the feature extraction results of the behavioral text description information; The behavior representation data determination unit is used to determine behavior representation data based on visual semantic features and textual semantic features.

[0137] Optional, visual semantic extraction unit, specifically used for: Image data is input into a pre-trained lightweight semantic coding model, which performs high-level semantic extraction on the image data to generate visual semantic features corresponding to preset high-risk behavioral events. The lightweight semantic coding model includes an encoder, an attention module, and a decoder connected in sequence. The attention module adopts a convolutional block attention mechanism and includes a channel attention submodule and a spatial attention submodule. It is used to adaptively weight the feature map output by the encoder. The feature map includes at least the feature map corresponding to the key visual region. The key visual region includes at least one of the following: QR code region, face region, or sensitive text region.

[0138] The anti-fraud identification device provided in the embodiments of the present invention can execute the anti-fraud identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0139] Figure 7 This is a schematic diagram of the structure of an anti-fraud identification device provided in an embodiment of the present invention. Figure 7 As shown, the device includes: The knowledge graph update module 710 is used to receive target behavior representation data sent by the target terminal and update the pre-built knowledge graph based on the target behavior representation data; wherein, the knowledge graph is constructed based on historical behavior representation data uploaded by multiple terminals; The anti-fraud identification module 720 is used to perform collaborative reasoning on the updated knowledge graph based on a pre-trained graph neural network model to obtain the anti-fraud identification result corresponding to the target behavior representation data.

[0140] The technical solution in this embodiment significantly improves the ability to identify covert, novel, or collaborative fraudulent behaviors by fully utilizing the collective behavioral knowledge accumulated in the knowledge graph, compared to traditional methods that rely solely on single-point behavioral features. Simultaneously, by continuously introducing fresh behavioral representation data from distributed terminals, the knowledge graph is constantly enriched in its ability to recognize new, variant, or covert fraud patterns, thereby enhancing the overall system's generalization, interpretability, and proactive defense capabilities. This embodiment achieves a closed loop from individual behavioral perception to collective knowledge accumulation, supporting not only more accurate real-time risk identification but also providing structured knowledge support for strategy optimization and model retraining.

[0141] Optional, the knowledge graph update module includes: The multimodal alignment unit is used to perform semantic space alignment on the high-dimensional visual semantic vectors and text semantic vectors in the target behavior representation data to obtain the aligned multimodal vectors. The joint semantic representation unit is used to perform weighted fusion of aligned multimodal vectors based on an attention mechanism to obtain a joint semantic representation. The graph feature extraction and update unit is used to decode the joint semantic representation into graph features to obtain at least one graph feature among the corresponding graph nodes, relations or attributes, and update the knowledge graph based on the graph features.

[0142] Optional, the graph feature extraction and update unit is specifically used for: The joint semantic representation is matched with the existing entities in the knowledge graph for semantic similarity. If the match is successful, it is associated with the corresponding entity; otherwise, a new graph node is created as the new entity. Based on joint semantic representation, the association relationship between entities is activated or constructed, and association edges are generated; among them, when the similarity between the visual semantic vectors corresponding to the target terminal and other terminals exceeds a preset threshold, strong association edges are established between the corresponding entities. The dynamic attributes of related entities are updated synchronously based on the joint semantic representation; wherein the dynamic attributes include at least one of the most recent active timestamp and the frequency of occurrence.

[0143] The anti-fraud identification device provided in the embodiments of the present invention can execute the anti-fraud identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0144] The acquisition, storage, use, and processing of data in this application comply with the relevant provisions of national laws and regulations. Data is acquired and collected with the user's consent after informing the user of the intended use of the data, and does not violate public order and good morals.

[0145] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0146] Figure 8 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0147] like Figure 8As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0148] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0149] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods described above, such as anti-fraud detection methods.

[0150] In some embodiments, the anti-fraud detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the anti-fraud detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the anti-fraud detection method by any other suitable means (e.g., by means of firmware).

[0151] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific reference products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0152] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0153] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0154] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0155] The systems and technologies described herein can be implemented in computing systems that include back-end components (e.g., as data servers), or computing systems that include switching components (e.g., application servers), or computing systems that include front-end components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such back-end, switching, or front-end components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0156] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0157] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication unit 19, or installed from storage unit 18, or installed from ROM 12. When the computer program is executed by processor 11, it performs the functions defined in the methods of the embodiments of the present invention.

[0158] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements the anti-fraud identification method as provided in any embodiment of this application.

[0159] In implementing the computer program product, computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0160] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0161] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for identifying fraud, characterized in that, Executed by the terminal, the method includes: In response to the triggering of a preset high-risk behavior event, determine the behavioral representation data corresponding to the preset high-risk behavior event; The data communication parameters are determined based on the terminal's operating context information, and the behavioral representation data is adjusted based on the data communication parameters. The adjusted behavioral representation data is sent to the edge server, so that the edge server can perform anti-fraud identification based on the behavioral representation data and generate anti-fraud identification results. The anti-fraud identification result returned by the edge server is received, and corresponding anti-fraud decision-making operations are performed based on the anti-fraud identification result.

2. The method according to claim 1, characterized in that, in, The terminal operating context information includes at least the current channel state information, the terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior event. The data communication parameters include at least the data compression rate, uplink bandwidth, and transmission power.

3. The method according to claim 2, characterized in that, The step of determining data communication parameters based on terminal runtime context information includes: The current channel state information, terminal battery level, and the urgency level of the behavior corresponding to the preset high-risk behavior event are used as state inputs and provided to the pre-trained reinforcement learning strategy model to obtain the data compression rate, uplink bandwidth, and transmit power output by the reinforcement learning strategy model. The reinforcement learning strategy model dynamically adjusts the configuration strategy of the data communication parameters based on feedback signals of anti-fraud decision quality and terminal resource consumption during the training process.

4. The method according to claim 1, characterized in that, The determination of behavioral representation data corresponding to the preset high-risk behavioral events includes: Acquire image data and behavioral text description information corresponding to the preset high-risk behavioral events; Based on the feature extraction results of the image data, visual semantic features are determined; Based on the feature extraction results of the behavioral text description information, determine the text semantic features; The behavioral representation data is determined based on the visual semantic features and the textual semantic features.

5. The method according to claim 4, characterized in that, The step of determining visual semantic features based on the feature extraction results of the image data includes: The image data is input into a pre-trained lightweight semantic coding model, and the lightweight semantic coding model performs high-level semantic extraction on the image data to generate visual semantic features corresponding to the preset high-risk behavioral events. The lightweight semantic coding model includes an encoder, an attention module, and a decoder connected in sequence. The attention module adopts a convolutional block attention mechanism and includes a channel attention submodule and a spatial attention submodule, which are used to adaptively weight the feature map output by the encoder. The feature map includes at least the feature map corresponding to a key visual region, which includes at least one of a QR code region, a face region, or a sensitive text region.

6. A method for identifying fraud, characterized in that, Executed by the edge server, the method includes: The system receives target behavior representation data sent by a target terminal and updates a pre-constructed knowledge graph based on the target behavior representation data; wherein the knowledge graph is constructed based on historical behavior representation data uploaded by multiple terminals. Based on a pre-trained graph neural network model, collaborative reasoning is performed on the updated knowledge graph to obtain the anti-fraud identification result corresponding to the target behavior representation data.

7. The method according to claim 6, characterized in that, The step of updating the pre-constructed knowledge graph based on the target behavior representation data includes: Semantic space alignment is performed on the high-dimensional visual semantic vectors and text semantic vectors in the target behavior representation data to obtain aligned multimodal vectors; The aligned multimodal vectors are weighted and fused based on an attention mechanism to obtain a joint semantic representation; The joint semantic representation is decoded to obtain at least one graph element from the corresponding graph nodes, relations or attributes, and the knowledge graph is updated based on the graph elements.

8. The method according to claim 7, characterized in that, Decoding the joint semantic representation into graph elements to obtain at least one graph element from the corresponding graph nodes, relations, or attributes, and updating the knowledge graph based on the graph elements, including: The joint semantic representation is matched with the existing entities in the knowledge graph for semantic similarity. If the match is successful, it is associated with the corresponding entity; otherwise, a new graph node is created as the new entity. Based on the joint semantic representation, the association relationship between entities is activated or constructed, and the association edge is generated; wherein, when the similarity between the visual semantic vectors corresponding to the target terminal and other terminals exceeds a preset threshold, a strong association edge is established between the corresponding entities. The dynamic attributes of related entities are updated synchronously based on the joint semantic representation; wherein the dynamic attributes include at least one of the most recent active timestamp and frequency of occurrence.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the anti-fraud identification method according to any one of claims 1-5 or any one of claims 6-8.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the anti-fraud identification method according to any one of claims 1-5 or any one of claims 6-8.

Images