Internet financial business risk control real-time monitoring platform

Abstract

This invention discloses a real-time risk control monitoring platform for internet finance businesses, belonging to the field of interdisciplinary application technology of financial technology and artificial intelligence. The platform includes a data access layer, a streaming feature and drift attribution layer, a Fast-Slow dual-track decision layer, and an online self-healing and compliance control layer. The streaming feature and drift attribution layer calculates the distribution divergence of fine-grained micro-groups and performs feature attribution within a sliding time window, outputting drift alarms. The online self-healing and compliance control layer performs online incremental updates of the lightweight model based on the drift alarms, and hot-swaps or rolls back the model version under the constraint of the safety circuit breaker boundary. This invention achieves real-time drift perception and automatic self-healing without downtime at the sub-group level without introducing additional decision delays, overcoming the response lag problem caused by the reliance on global coarse-grained indicators and offline batch processing in existing technologies.

Description

Technical Field

[0001] This invention relates to the field of cross-application technology of financial technology and artificial intelligence, specifically a real-time monitoring platform for risk control in internet finance business. Background Technology

[0002] Traditional internet finance risk control systems are typically built on rule engines and statistical machine learning models. They acquire user transaction characteristics, device characteristics, and behavioral characteristics through real-time feature computing platforms, input them into pre-trained risk control scoring models, and output decision results such as credit granting, rejection, and referral to manual review. The performance monitoring of such models usually relies on offline batch processing tasks to statistically analyze the global scoring distribution and performance indicators at fixed intervals, and push the statistical results to a monitoring dashboard for risk control operations personnel to review. Once an abnormal decline in indicators is detected, risk control personnel need to manually check the data, locate the problem characteristics, and organize the data team to re-pull the training samples, retrain the model offline, and redeploy it after verification and approval.

[0003] The closest existing technical solution to this invention is a risk control system architecture consisting of a real-time feature calculation engine, a single decision model (or rule engine), and an offline batch monitoring dashboard. Its processing flow is roughly as follows: the real-time feature platform collects and calculates the multi-dimensional feature vector corresponding to the transaction request, inputs the feature vector into the deployed risk control decision model, obtains the decision result, and directly returns it to the business system for execution. The offline monitoring system summarizes and statistically analyzes the global model score distribution and performance indicators at a fixed period and generates monitoring reports. Risk control operations personnel regularly check the monitoring reports. If the indicators deteriorate beyond the preset threshold, they manually initiate the data analysis, problem localization, and model retraining process. In recent years, some institutions have begun to try to introduce large language models or large financial models into the risk control decision-making process. The usual practice is to directly place the large model in the synchronous decision main link for invocation, in order to use its semantic understanding and knowledge reasoning capabilities to identify complex fraud patterns.

[0004] The aforementioned existing technical solutions have the following shortcomings: Firstly, since the large model is directly placed in the synchronous decision-making main link, when the transaction concurrency increases, the high inference latency and low concurrency throughput of the large model will make it difficult for the response latency of real-time credit granting and anti-fraud scenarios to meet the requirements of business service level. At the same time, the occasional output of the large model that does not match the facts and the unexplainability of the decision-making process conflict with the certainty and explainability required by financial risk control. Secondly, since the existing monitoring system only counts coarse-grained performance indicators at the global level and relies on fixed-period offline batch processing and manual report review to discover problems, when the customer characteristic distribution only occurs locally in certain subgroups... When a deviation occurs, the local deviation is easily masked by the averaging effect of global indicators and is difficult to detect in a timely manner. Even if it is detected, the post-event alarm and manual retraining mode relied upon by existing risk control monitoring systems have a large time window gap. Before manual investigation and retraining are completed, the performance degradation of the risk control model is already in a state that is difficult to detect, which may lead to business financial losses. Therefore, how to utilize the semantic reasoning capabilities of large models and achieve real-time perception and automated repair of model performance degradation at the level of subdivided subgroups without introducing additional decision delays has become an urgent technical problem to be solved in this field. To this end, we propose a real-time monitoring platform for risk control in Internet finance business. Summary of the Invention

[0005] The purpose of this invention is to provide a real-time risk control monitoring platform for internet finance businesses.

[0006] The technical problem to be solved by this invention is that existing Internet finance risk control systems, when introducing artificial intelligence technologies such as large models and dealing with complex and ever-changing attack methods, suffer from problems such as high inference latency of large models and difficulty in directly embedding them into the real-time decision-making process. In addition, existing drift monitoring methods rely on global coarse-grained indicators and fixed-period offline batch processing, which cannot achieve real-time detection, localization, attribution and self-healing closed-loop processes at the level of subdivided subgroups. As a result, model performance degradation remains undetected and unalerted for a long period of time.

[0007] To address the aforementioned technical issues, this invention provides a real-time risk control monitoring platform for internet finance businesses. The platform includes a business application layer for receiving risk control decision results and driving downstream business operations, a data access layer, a streaming feature and drift attribution layer, a Fast-Slow dual-track decision layer, and an online self-healing and compliance control layer. The data access layer collects transaction request data, user behavior data, and device fingerprint data in real time and distributes the collected data to a streaming computing cluster. The streaming feature and drift attribution layer includes a micro-group segmentation module and a streaming drift detection and attribution module. It maps real-time arriving feature vectors to fine-grained micro-groups, continuously calculates the group-level distribution divergence index between the current feature distribution and the historical baseline distribution of each micro-group within a sliding time window, and calculates and sorts the feature attribution scores for each dimension of the micro-group when the index reaches a preset drift judgment threshold, forming a responsibility feature ranking list and outputting drift alarm information. The Fast-Slow dual-track decision layer includes a routing and diversion module, a FastPath lightweight decision model, and a SlowPath risk control module. The inference cluster uses a routing module to distribute transaction requests based on the decision confidence obtained through the FastPath lightweight decision model. For regular transactions with high confidence, the output of the FastPath lightweight decision model is directly used as the real-time decision result. For edge risk samples with low confidence, while returning the FastPath decision result as a fallback real-time result, the sample is asynchronously distributed to the SlowPath risk control large model inference cluster for deep semantic inference. The SlowPath inference result is verified and confirmed, and then used as a distillation supervision label to feed back into the online self-healing process. The online self-healing and compliance control layer includes an incremental training and gradient fine-tuning module, a safety circuit breaker determination module, and a baseline version rollback module. These modules are used to perform online incremental updates of relevant parameter subsets in the FastPath lightweight decision model based on drift alarm information and distillation supervision samples. When the prediction offset does not exceed the preset safety circuit breaker boundary, the updated model is deployed to the online service in a hot-swap manner. When the prediction offset exceeds the safety circuit breaker boundary, the model is automatically rolled back to the previous stable version and a manual review alarm is triggered.

[0008] Compared with the prior art, the beneficial effects of the present invention by adopting the above technical solution are as follows:

[0009] 1. This invention constructs a real-time concept drift streaming attribution engine based on micro-populations, which refines the granularity of drift detection from the global level to the sub-population level, and completes the integrated processing of detection, localization and attribution within a millisecond-level sliding time window, overcoming the problems of global coarse-grained indicators masking local drift and offline monitoring having response lag.

[0010] 2. This invention constructs a Fast-Slow dual-track asynchronous decision-making architecture that coordinates large and small models, enabling the large risk control model to only undertake the deep reasoning and distillation supervision sample generation responsibilities of the asynchronous slow link without entering the synchronous main decision-making link. Without introducing additional decision delay, it achieves effective utilization of the semantic reasoning ability of the large model. At the same time, through the distillation supervision feedback mechanism, the reasoning ability of the large model is continuously deposited into the low-latency model.

[0011] 3. This invention constructs a non-stop streaming incremental self-healing mechanism under the constraint of a safety circuit breaker boundary. It links drift attribution results with online gradient fine-tuning, shadow verification offset calculation, safety threshold determination, and automatic rollback. After drift is detected, it can automatically complete online correction within a safe and controllable range. This avoids the response time window gap in the traditional manual retraining mode. It improves the risk control system from a manual retraining response mode of detection alarms at the minute to day level to an automatic closed-loop self-healing capability at the millisecond to second level. At the same time, the safety circuit breaker boundary mechanism ensures that the self-healing process complies with the prudential regulatory requirements of the financial industry. Attached Figure Description

[0012] Figure 1 This is a schematic diagram of the overall five-layer vertical architecture of the platform in this embodiment of the invention;

[0013] Figure 2 This is a schematic diagram of the attribution process for micro-population flow drift detection in an embodiment of the present invention;

[0014] Figure 3 This is a schematic diagram of the entire process of dual-track decision-making and online self-healing closed loop in an embodiment of the present invention. Detailed Implementation

[0015] The following is in conjunction with the appendix Figure 1-3 The specific embodiments of the present invention will be further described below. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0016] Furthermore, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0017] I. System Overall Architecture:

[0018] The real-time monitoring platform for risk control of internet finance business provided by the present invention includes, from bottom to top, a data access layer, a streaming feature and drift attribution layer, a Fast-Slow dual-track decision layer, an online self-healing and compliance control layer, and a business application layer.

[0019] The data access layer collects raw data streams such as transaction requests, user behavior, and device fingerprints in real time through the message bus component, and distributes them to the downstream streaming computing cluster to support the real-time consumption of data by subsequent processing layers.

[0020] The streaming feature and drift attribution layer consists of a real-time feature calculation module, a baseline distribution storage module, a micro-group segmentation module, and a streaming drift detection and attribution module. The real-time feature calculation module is used to extract and calculate features from the incoming raw data stream to obtain multi-dimensional feature vectors corresponding to transaction requests. The baseline distribution storage module is used to save the feature distribution statistics of each micro-group under the historical stable window as a benchmark for subsequent comparison. The micro-group segmentation module is used to map each arriving feature vector to its corresponding fine-grained customer subgroup in real time according to the preset micro-group segmentation rules. The streaming drift detection and attribution module is used to continuously compare the distribution statistics within the current sliding time window with the baseline distribution of the corresponding micro-group, and output a drift alarm signal and the corresponding list of responsible features when drift is determined to occur.

[0021] The Fast-Slow dual-track decision layer includes a routing module, a FastPath decision model deployed in a lightweight model format, and a SlowPath risk control domain large model inference cluster. The routing module distributes requests to the corresponding links based on the decision confidence of the transaction request: for regular transactions with a confidence level that reaches a preset threshold, FastPath outputs real-time decision results and returns them directly to the business application layer; for edge risk samples with a confidence level that does not reach the preset threshold, while returning the FastPath fallback decision result, the sample is asynchronously routed to the SlowPath link, where the risk control large model performs deep semantic inference. The inference results enter the manual audit queue on the one hand, and on the other hand, serve as a distillation supervision target to feed back into the incremental training module.

[0022] The online self-healing and compliance control layer includes an incremental training and gradient fine-tuning module, a safety circuit breaker determination module, and a baseline version rollback module. When the streaming drift detection and attribution module outputs a drift alarm, the incremental training and gradient fine-tuning module starts an online learning process based on the identified responsibility characteristics. The safety circuit breaker determination module continuously monitors whether the prediction offset of the updated model exceeds the preset safety boundary. If it exceeds the boundary, it triggers the baseline version rollback module, automatically rolls back the FastPath model to the previous stable version, and sends a manual review alarm to the risk control operations personnel.

[0023] The business application layer receives the decision results from FastPath, or the final decision results after manual review and confirmation, and uses them to drive the execution of downstream business operations such as credit granting, loan disbursement, and rejection.

[0024] II. Real-time concept drift streaming attribution engine based on micro-groups:

[0025] The streaming attribution engine provided in this embodiment completes processing sequentially through a transaction feature stream access node, a micro-group dynamic partitioning node based on business tags and feature clustering, a sliding time window statistics calculation node, a group-level distribution divergence calculation node, a drift threshold determination node, a feature-level attribution node, and a drift alarm and attribution result output node. Each node is connected by a streaming data pipeline, and the data flows continuously and is continuously calculated within the sliding time window, which is different from the traditional offline batch processing timed task mode.

[0026] Specifically, the system continuously receives high-dimensional feature vector data streams corresponding to transaction requests through a streaming computing cluster. Based on preset micro-group division rules, such as at least two combinations of business dimensions including channel, region, device fingerprint clustering, and risk level stratification, the system maps each arriving feature vector to its corresponding micro-group number in real time. For each micro-group, the system maintains a sliding time window buffer of preset length and continuously accumulates the sample feature distribution statistics of the micro-group within the window, including the binning ratio, mean, and standard deviation of each feature. At the same time, the system pre-stores the baseline distribution statistics of the micro-group during the historical stable period as a comparison benchmark.

[0027] Based on this, the system calculates the population-level distribution divergence index between the characteristic distribution and the baseline distribution of the micro-population within the current sliding window according to the preset binning rules. In this embodiment, the population stability divergence index is used, and its calculation method is as follows:

[0028] ;

[0029] Among them, subscript Indicates the microgroup number. Indicates the total number of feature bins. Indicates the micro-group within the current sliding window In the The sample percentage of each bin Indicates micropopulations within the baseline window In the The sample percentage of each bin microgroups The distribution offset is used to reflect the overall degree of shift in the current characteristic distribution of the micropopulation relative to the historical baseline distribution.

[0030] The system will calculate the distribution offset. Compared with the preset drift detection threshold If a comparison is made, If the microgroup is determined to have experienced significant conceptual drift, it will proceed to feature-level attribution processing. If the threshold is not reached, the monitoring status will be maintained and subsequent window data will continue to be accumulated.

[0031] For a micro-group identified as having drifted, the system calculates a feature attribution score for each of its features to pinpoint the responsible feature for the drift. The calculation method is as follows:

[0032] ;

[0033] Among them, subscript Indicates the microgroup number, subscript Indicates the feature dimension number. microgroups Features within the current sliding window The mean, microgroups Features within the baseline window The mean, microgroups Features within the baseline window standard deviation A very small positive number is set to prevent the denominator from being zero. Representation of features The attribution contribution of this micro-population drift is such that a larger value indicates a higher degree of contribution of this feature to the drift.

[0034] The system sorts the attribution scores corresponding to each feature from largest to smallest to form a responsibility feature ranking list. It then packages the micro-group number, distribution offset, and responsibility feature ranking list into a drift alarm event, which is pushed to the Fast-Slow dual-track decision layer and online self-healing module through a streaming message channel for subsequent route adjustment and online correction.

[0035] III. A Fast-Slow Dual-Track Decision Architecture with Asynchronous Circuit Breaker for Large and Small Models and Verifiable Compensation:

[0036] In this embodiment, after being processed by the routing and diversion module, the transaction request enters two links, FastPath and SlowPath, respectively. The FastPath link includes a lightweight interpretable model inference node and a decision result direct output node, with a response latency in the millisecond range, and directly returns the decision result to the business system. The SlowPath link includes a risk control large model asynchronous inference node, a deep semantic feature extraction node, a manual audit queue node, and a distillation supervision sample generation node. The distillation supervision sample generation node packages the large model inference result with the corresponding original features and labels and outputs it to the incremental training module, forming a continuous knowledge supplementation loop for the FastPath model.

[0037] Specifically, after receiving the feature vector of an arriving transaction request, the routing module first calls the FastPath lightweight decision model to perform a quick inference, obtaining the predicted probability that the request belongs to different risk categories, denoted as follows: and , used to represent samples The probability of being classified as normal or risky is used to calculate the confidence level of the decision by the routing module based on the predicted probability, as follows:

[0038] ;

[0039] in, This represents the feature vector corresponding to the current transaction request. The model determines the sample. The probability of being the normal category. The model determines the sample. The probability of a risk category. This represents the confidence score for this decision, which is the larger of the two predicted probabilities.

[0040] The system will assign confidence scores. Compared with the preset confidence threshold Comparison: When the confidence score is not lower than the threshold, the request is determined to be a regular transaction, and the FastPath output is directly used as the final decision result and synchronously returned to the business application layer for execution. When the confidence score is lower than the threshold, the request is determined to be an edge risk sample. Under the premise of using the FastPath result as a fallback real-time decision and returning it to the business system, the sample is asynchronously diverted to the SlowPath link.

[0041] The large-scale risk control model in the SlowPath pipeline performs deep semantic reasoning on the edge risk samples diverted from the pipeline. It integrates multi-dimensional information such as transaction context information, historical behavior sequence information, and correlation graph information to output more refined risk judgment results and explanation text of reasoning basis. SlowPath writes the reasoning results of the large-scale model, along with the original feature vector and the initial decision results of FastPath, into the manual audit queue for risk control operations personnel to review. For reasoning results that have been reviewed and confirmed to be correct, the system uses them as distillation supervision labels, combines them with the original feature vector to form incremental training sample pairs, and pushes them to the online self-healing module for knowledge distillation-style incremental updates to the FastPath lightweight model. This allows the deep semantic reasoning capabilities of the large-scale model to be continuously accumulated into the low-latency model.

[0042] IV. Seamless, downtime-free self-healing mechanism of the streaming incremental model:

[0043] The self-healing mechanism provided in this embodiment completes the processing sequentially through the drift alarm receiving node, the incremental sample acquisition node, the online gradient fine-tuning point, the safety circuit breaker determination node, the model hot replacement node, and the baseline rollback and manual alarm node. Each node runs continuously in a closed loop.

[0044] Specifically, the online self-healing module receives drift alarm events output by the streaming drift detection and attribution module, parses the micro-group IDs and responsibility feature ranking lists, and extracts a preset number and features ranked first by attribution score from the responsibility feature ranking list as the key correction targets for this round. The system collects the most recently arrived labeled samples belonging to this micro-group from the streaming data pipeline, including real feedback label samples from the business side and distillation supervision samples output by SlowPath, forming the incremental sample set for this round of online learning, denoted as... ;

[0045] The system is based on an incremental sample set The gradient descent method is used to update the subset of parameters related to responsibility features in the FastPath model in small steps online. The update formula is as follows:

[0046] ;

[0047] in, Indicates the first The parameter vector of the FastPath model during each iteration. This represents the preset online learning rate, which is set to a small value to ensure that the update step size is controllable. This indicates that the model is in the incremental sample set. loss function on, This indicates that the loss function is related to the parameters. gradient, This represents the updated model parameter vector;

[0048] The system will update the parameters. The corresponding candidate model is used to make predictions on an independent shadow validation sample set, and the prediction results are compared sample by sample with the prediction results of the current online baseline model to calculate the prediction offset:

[0049] ;

[0050] in, This represents the total number of samples in the shadow validation sample set. Indicates the candidate update model for the th The predicted output of each validation sample. This indicates that the current online baseline model is for the first... The predicted output of each validation sample. This represents the average prediction offset of the candidate model relative to the baseline model;

[0051] The system will predict the offset. With respect to the preset safety fuse boundary Comparison: When the predicted offset does not exceed the safety circuit breaker boundary, the current online update is determined to be within a safe and controllable range. The candidate model parameters are seamlessly deployed to the FastPath online service in a hot replacement manner. During the replacement process, the double-buffered version switching method ensures that the requests being processed are not affected, thereby achieving self-healing without downtime. When the predicted offset exceeds the safety circuit breaker boundary, the current update is determined to have an abnormal risk. The system automatically abandons the parameter update, retains the current online baseline model unchanged, and sends a manual review alarm to the risk control operations personnel. It also records the detailed logs of this drift event and the rejected update for subsequent offline analysis. Regardless of whether the update is adopted or rejected, the system writes the processing results of this round, including the micro-group number, responsibility characteristics, update decision and offset, into the self-healing operation audit log and continuously monitors subsequent drift alarm events to form a closed-loop self-healing process that runs perpetually.

[0052] V. Alternative Implementation Methods:

[0053] In an alternative implementation, the calculation method for the population-level distribution divergence index in the micro-population real-time drift attribution engine is not limited to the aforementioned population stability divergence index. A similar distribution offset quantification effect can also be achieved using a relative entropy metric, and its calculation method is as follows:

[0054] ;

[0055] Among them, subscript Indicates the microgroup number. microgroups The corresponding feature value space, and These represent the micro-populations under the current window and the baseline window, respectively. In feature value The probability density at that location, using this alternative divergence index, can also achieve drift detection and attribution functions at the subgroup level, and can serve as an effective supplementary implementation of the present invention;

[0056] In another alternative implementation, the routing and traffic splitting criteria in the Fast-Slow dual-track decision architecture are not limited to the confidence level output by the FastPath model. Instead, rule-based traffic splitting conditions can be pre-set at the feature access level, such as business rules like transaction amount exceeding a specific threshold, hitting a specific high-risk list label, or originating from a specific high-risk channel. Requests that hit the rules are directly split to SlowPath for deep inference using a large model, while requests that do not hit the rules follow the FastPath regular decision-making process. This static traffic splitting method based on business rules can be combined with the dynamic traffic splitting method based on confidence level to jointly constitute the routing and traffic splitting implementation method of this invention.

[0057] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of the present invention. Therefore, any modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope defined by the claims of the present invention.

Claims

1. A real-time risk control monitoring platform for internet finance businesses, comprising a business application layer for receiving risk control decision results and driving downstream business operations, characterized in that: Also includes: The data access layer is used to collect transaction request data, user behavior data, and device fingerprint data in real time, and distribute the collected data to the streaming computing cluster. The streaming feature and drift attribution layer includes a micro-population segmentation module and a streaming drift detection and attribution module. The micro-population segmentation module maps each arriving feature vector to a corresponding micro-population according to a preset micro-population segmentation rule. The streaming drift detection and attribution module calculates the population-level distribution divergence index between the current feature distribution and the historical baseline distribution within a sliding time window for each micro-population. When the population-level distribution divergence index reaches a preset drift judgment threshold, the module calculates feature attribution scores for each dimension of the feature in the micro-population and sorts them according to the score values ​​to form a responsible feature ranking list. The module then outputs drift alarm information containing the micro-population number, the population-level distribution divergence index, and the responsible feature ranking list. The Fast-Slow dual-track decision layer includes a routing module, a FastPath lightweight decision model, and a SlowPath risk control large-scale model inference cluster. The routing module is used to route transactions based on the decision confidence obtained by the FastPath lightweight decision model: when the decision confidence is not lower than a preset confidence threshold, the decision result of the FastPath lightweight decision model is used as the final decision result; when the decision confidence is lower than the preset confidence threshold, while using the decision result of the FastPath lightweight decision model as the real-time decision result and returning it to the business application layer, the transaction request is routed to the SlowPath risk control large-scale model inference cluster for asynchronous deep semantic inference. The SlowPath risk control large-scale model inference cluster is used to output risk judgment results and generate distillation supervision samples based on the verified risk judgment results. The online self-healing and compliance control layer includes an incremental training and gradient fine-tuning module, a circuit breaker determination module, and a baseline version rollback module. The incremental training and gradient fine-tuning module is used to perform online incremental updates on the parameter subset associated with the responsibility feature ranking list in the FastPath lightweight decision model based on the drift alarm information and the distillation supervision samples to obtain a candidate model. The circuit breaker determination module is used to calculate the prediction offset between the candidate model and the current online baseline model on the shadow verification sample set. When the prediction offset does not exceed the preset circuit breaker boundary, the candidate model is hot-swapped to the online service. When the prediction offset exceeds the circuit breaker boundary, the baseline version rollback module keeps the current online baseline model unchanged and triggers a manual review alarm.

2. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that: The micro-group segmentation module is specifically used to construct the micro-group segmentation rule based on a combination of at least two business dimensions, including channel, region, device fingerprint clustering, and risk level stratification, and to apply the micro-group segmentation rule to each arriving feature vector to obtain the micro-group number to which the feature vector belongs.

3. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that, The streaming drift detection and attribution module is specifically used for: maintaining a sliding time window buffer of a preset length for each microgroup, accumulating the sample proportion of the microgroup's samples within the sliding time window under preset binning rules, comparing the sample proportion of each bin within the sliding time window with the baseline sample proportion of the corresponding bin during the historical stable period of the microgroup, calculating the group-level distribution divergence index, comparing the group-level distribution divergence index with the drift determination threshold, and determining that the microgroup has experienced concept drift when the group-level distribution divergence index reaches the drift determination threshold.

4. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that, The streaming drift detection and attribution module is further configured to: for each feature included in the microgroup that has been determined to have experienced concept drift, calculate the absolute value of the difference between the mean of the feature in the current sliding time window and the mean of the feature in the baseline window, and use the ratio of the absolute value of the difference to the standard deviation of the feature in the baseline window as the feature attribution score corresponding to the feature, and sort the feature attribution scores corresponding to each feature in the microgroup from largest to smallest to obtain the responsibility feature ranking list.

5. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that: The routing module is specifically used to: obtain the first predicted probability that the transaction request output by the FastPath lightweight decision model belongs to the normal category and the second predicted probability that it belongs to the risk category, and take the larger of the first predicted probability and the second predicted probability as the decision confidence.

6. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that: The SlowPath risk control large model inference cluster is specifically used for: performing deep semantic reasoning on the transaction requests obtained from the traffic splitting, combining transaction context information, historical behavior sequence information, and correlation graph information, outputting the risk judgment result and the corresponding reasoning basis explanation text, writing the risk judgment result, the original feature vector, and the initial decision result of the FastPath lightweight decision model into the manual audit queue, and using the risk judgment result that has been verified as a distillation supervision label, combining it with the corresponding original feature vector to form the distillation supervision sample.

7. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that: The incremental training and gradient fine-tuning module is specifically used to: extract a preset number of features ranked first by feature attribution score from the responsibility feature ranking list as responsibility features; collect business-side labeled samples corresponding to the micro-group and the distillation supervision samples to form an incremental sample set; and use gradient descent to update the parameter subset associated with the responsibility features in the FastPath lightweight decision model based on the incremental sample set to obtain the candidate model. The learning rate value used in the online incremental update is preset to control the step size of the parameter update.

8. The real-time monitoring platform for risk control in internet finance business according to claim 1, characterized in that: The circuit breaker determination module is specifically used to: compare the prediction output of the candidate model on an independent shadow verification sample set with the prediction output of the current online baseline model on the shadow verification sample set on a sample-by-sample basis, calculate the average value of the absolute value of the difference between the two prediction outputs as the prediction offset, and when the prediction offset does not exceed the circuit breaker boundary, use a double-buffered version switching method to replace the parameters of the candidate model with the online service of the FastPath lightweight decision model, without interrupting the transaction requests being processed during the replacement process.

9. A method for real-time risk control monitoring of internet finance business, characterized in that, include: Real-time collection of transaction request data, user behavior data, and device fingerprint data; Based on the preset micro-group division rules, the collected feature vectors are mapped to the corresponding micro-groups. Within the sliding time window, the group-level distribution divergence index between the current feature distribution of the micro-group and the historical baseline distribution is calculated. When the group-level distribution divergence index reaches the preset drift judgment threshold, the feature attribution score of each dimension of the micro-group is calculated and sorted according to the score value to form a responsible feature sorting list, and the drift alarm information is output. The transaction request is routed based on the decision confidence obtained through the FastPath lightweight decision model: when the decision confidence is not lower than a preset confidence threshold, the decision result of the FastPath lightweight decision model is used as the final decision result and returned to the business application layer; when the decision confidence is lower than the preset confidence threshold, while the decision result of the FastPath lightweight decision model is used as the real-time decision result and returned to the business application layer, the transaction request is routed to the SlowPath risk control large model inference cluster for asynchronous deep semantic inference to obtain a risk judgment result, and a distillation supervision sample is generated based on the verified risk judgment result. Based on the drift alarm information and the distillation supervision samples, the parameter subset associated with the responsibility feature ranking list in the FastPath lightweight decision model is updated online incrementally to obtain a candidate model. The prediction offset between the candidate model and the current online baseline model on the shadow verification sample set is calculated. When the prediction offset does not exceed the preset safety circuit breaker boundary, the candidate model is hot-swapped to the online service. When the prediction offset exceeds the safety circuit breaker boundary, the current online baseline model is kept unchanged, and a manual review alarm is triggered.

10. The method for real-time monitoring of risk control in internet finance business according to claim 9, characterized in that: When the predicted offset exceeds the safety circuit breaker boundary, the method further includes: recording the drift alarm information and the corresponding candidate model update rejection log information. When the predicted offset does not exceed the safety circuit breaker boundary, the method further includes: writing the update result corresponding to the candidate model into the self-healing operation audit log, and recording the micro-group number, the responsibility feature sorting list and the predicted offset in the self-healing operation audit log.

Images