A method, device, medium, and product for monitoring abnormal financial behavior.

Abstract

This invention discloses a method, device, medium, and product for monitoring abnormal financial behavior, applied in the fintech field. The method includes: acquiring raw transaction data through participating nodes; training a local model based on the raw transaction data and determining the model gradient; generating an encrypted gradient based on the model gradient and sending the encrypted gradient to a federated coordination node; aggregating the encrypted gradient through the federated coordination node to generate a global model, and distributing the global model to participating nodes; and calculating the risk score of the target customer based on the global model through participating nodes. Training the local model and generating the encrypted gradient through participating nodes protects the privacy of the raw transaction data. Generating the global model through the federated coordination node allows for the fusion of data features from multiple sources, improving the model's comprehensiveness and accuracy. Participating nodes enable accurate identification and reliable risk assessment of abnormal financial behavior based on the fused global features.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a method, device, medium and product for monitoring abnormal financial behavior. Background Technology

[0002] Monitoring abnormal financial behavior is a key aspect of ensuring fund security and complying with regulatory requirements in the financial sector. It requires integrating multi-source data such as transaction data, identity verification data, and device association data to conduct risk assessments. Traditional centralized data processing models are no longer adequate for the current dual needs of data security and cross-institutional collaboration.

[0003] Currently, the monitoring of abnormal financial behavior mostly adopts the method of centralized data aggregation and modeling. Each financial institution uploads original transaction data, identity verification data, device association data, etc. to a central server. A risk assessment model is built through the structured transaction data within a single institution to complete customer risk scoring and abnormal behavior identification.

[0004] Existing centralized modeling not only violates data security principles and poses a high risk of raw data leakage, but also suffers from missing feature dimensions and incomplete identification coverage due to relying solely on structured data from a single institution. Furthermore, static models cannot adapt to the dynamic changes in money laundering methods, and the model's decision-making process is opaque, making it difficult to meet privacy compliance and regulatory audit requirements. Summary of the Invention

[0005] This invention provides a method, device, medium, and product for monitoring abnormal financial behavior. By constructing a privacy-preserving multimodal federated learning framework and introducing dynamic evaluation and interpretability mechanisms, it solves the technical problems of traditional centralized modeling, such as difficulty in data privacy compliance, static lag in risk assessment, and lack of transparency in model decision-making, which makes it difficult to regulate.

[0006] According to one aspect of the present invention, a method for monitoring abnormal financial behavior is provided, applied to an abnormal financial behavior monitoring device, including a federated coordination node and at least one participating node, the method comprising: The participating nodes obtain the original transaction data, train a local model based on the original transaction data and determine the model gradient, generate an encrypted gradient based on the model gradient, and send the encrypted gradient to the federated coordination node. The original transaction data includes structured data, text data and graph data. The encrypted gradients are aggregated through the federated coordination node to generate a global model, which is then distributed to the participating nodes. Risk scores for target customers are calculated based on a global model using participating nodes.

[0007] Optionally, training a local model based on the original transaction data and determining the model gradient includes: preprocessing the original transaction data to obtain local features; obtaining a preset basic model structure, training the basic model structure locally based on the local features to obtain a local model; and calculating the gradient of the loss function of the local model through the backpropagation algorithm to obtain the model gradient.

[0008] The advantage of this setup is that it optimizes feature quality and ensures the reliability of data during subsequent encrypted uploads and model aggregation.

[0009] Optionally, the original transaction data is preprocessed to obtain local features, including: performing sliding window statistics and feature discretization on structured data to obtain structured features, wherein the sliding window statistics adopt a preset time window; performing entity recognition and semantic vectorization on text data to obtain text features; performing neighbor aggregation and graph embedding on graph data to obtain graph features; and fusing structured features, text features, and graph features to obtain local features.

[0010] The advantage of this setup is that it fully leverages multimodal data information, enriches feature dimensions, and improves the subsequent model training effect.

[0011] Optionally, generating encrypted gradients based on model gradients includes: adding differential privacy noise to the model gradients to generate noisy gradients; and encrypting the noisy gradients using a homomorphic encryption algorithm to generate encrypted gradients.

[0012] The advantages of this setup are: effectively protecting gradient information, avoiding the risk of raw data leakage, and meeting data privacy compliance requirements.

[0013] Optionally, the risk score of the target customer is calculated based on the global model, including: extracting customer features corresponding to the target customer from local features; and inputting the customer features into the global model to obtain the risk score of the target customer.

[0014] The advantage of this setup is that by integrating information from multiple sources into a global model, customer risk scores are output, thereby improving the ability to identify abnormal financial behavior.

[0015] Optionally, the device further includes a decision application layer, and the method further includes: determining the target risk level corresponding to the risk score and determining the timestamp corresponding to the customer characteristics through the decision application layer; calculating the time difference between the timestamp and the current time; obtaining a preset list of time decay coefficients, wherein the list of time decay coefficients includes decay coefficients corresponding to each risk level; matching the target risk level with the list of time decay coefficients to determine the target decay coefficient corresponding to the target risk level; substituting the target decay coefficient and the time difference into a preset time decay function to calculate the dynamic weight; and correcting the risk score through the dynamic weight to obtain a corrected risk score.

[0016] The advantage of this setup is that it allows for dynamic adjustments to the scoring based on the timeliness of the data, thereby improving the flexibility and accuracy of risk assessment results.

[0017] Optionally, the method also includes: detecting the real-time transaction data of the target customer through the decision application layer, and when the detected real-time transaction data exceeds a preset threshold, reducing the preset time window by a specified ratio.

[0018] The advantage of this setup is that it can quickly detect sudden abnormal transactions and improve the sensitivity of monitoring high-risk behaviors.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, which is then executed by the at least one processor to enable the at least one processor to perform an abnormal financial behavior monitoring method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement an abnormal financial behavior monitoring method according to any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements an abnormal financial behavior monitoring method according to any embodiment of the present invention.

[0022] The technical solution of this invention, through participating nodes acquiring multiple types of raw transaction data, training local models, generating encrypted gradients, and uploading them, can effectively extract local features and protect privacy without leaking the original data. By aggregating the encrypted gradients through a federated coordination node and generating and distributing a global model, the comprehensiveness and accuracy of the model can be improved by integrating features from multiple parties. By having participating nodes calculate target customer risk scores based on the global model, accurate identification and reliable risk assessment of abnormal financial behavior can be achieved by relying on the integrated global features.

[0023] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a flowchart of an abnormal financial behavior monitoring method provided in Embodiment 1 of the present invention; Figure 2 This is a flowchart of another abnormal financial behavior monitoring method provided in Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of an abnormal financial behavior monitoring device provided in Embodiment 3 of the present invention; Figure 4 This is a schematic diagram of the structure of an electronic device that implements an abnormal financial behavior monitoring method according to an embodiment of the present invention. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] Example 1 Figure 1This is a flowchart illustrating an abnormal financial behavior monitoring method provided in Embodiment 1 of the present invention. This embodiment is applicable to abnormal financial behavior monitoring scenarios. The method can be executed by an abnormal financial behavior monitoring device, which includes a federated coordination node and at least one participating node. Figure 1 As shown, the method includes: S110. Obtain the original transaction data through the participating nodes, train the local model based on the original transaction data and determine the model gradient, generate the encrypted gradient according to the model gradient, and send the encrypted gradient to the federated coordination node. The original transaction data includes structured data, text data and graph data.

[0029] In federated learning, the central coordinating node is the central coordinator, responsible for aggregating encrypted gradients from all participants, updating and distributing the global model, without accessing the raw data. Participant nodes are locally deployed nodes belonging to financial institutions such as banks and payment institutions, used to store raw data, train local models, generate encrypted gradients, and perform risk scoring. Raw transaction data refers to multi-source heterogeneous data collected by the participant nodes, including structured data, text data, and graph data. Structured data refers to transaction records in comma-separated value file format, such as transaction amounts, frequencies, and timestamps. Text data refers to semi-structured text, such as financial system questionnaires and customer identity verification materials. Graph data refers to unstructured device association graphs, such as adjacency lists, reflecting login and transaction relationships between devices. The local model refers to the sub-model trained by the participant nodes based on local data, integrating structured, textual, and graph features using a multimodal fusion framework. Model gradients refer to the direction and magnitude of parameter updates during local model training, reflecting the impact of data on model optimization. Encrypted gradients refer to model gradients that have undergone privacy protection processing and are transmitted to the federated coordination node through an encrypted channel to prevent the leakage of intermediate parameters.

[0030] Specifically, participating nodes are deployed locally at each data holding institution, acquiring raw transaction data including structured transaction data, semi-structured customer identity text, and unstructured device association graph data. Participating nodes can perform sliding window statistics on structured data, such as transaction frequency over the past 7 days, and then use this data for training after feature engineering processes such as binning and discretization. Participating nodes can extract key fields from text data using named entity recognition and then convert them into semantic vectors for training. Participating nodes can perform preprocessing and feature engineering operations on graph data, such as aggregating multi-hop neighbor features, before feeding it into training. Each participant uses the locally processed raw transaction data to calculate the model gradient, then adds Laplace noise to the gradient and encrypts it using a homomorphic encryption algorithm to generate an encrypted gradient. The encrypted gradients are sent between modules to the federated coordination node via an encrypted channel, while the original data remains locally.

[0031] Optionally, training a local model based on the original transaction data and determining the model gradient includes: preprocessing the original transaction data to obtain local features; obtaining a preset basic model structure, training the basic model structure locally based on the local features to obtain a local model; and calculating the gradient of the loss function of the local model through the backpropagation algorithm to obtain the model gradient.

[0032] Specifically, participating nodes preprocess the raw transaction data to obtain local features. First, outlier handling is performed on the raw transaction data; for example, transactions exceeding five times the account's average monthly transaction amount are removed, while missing values ​​are filled to ensure data integrity. Then, a sliding window technique is used to statistically analyze transaction frequency and the number of large transactions within the past seven days, transforming dynamic transaction behavior into static feature vectors. Continuous features such as transaction amounts are then binned and discretized into discrete categories such as "0-10,000 yuan" and "10,000-50,000 yuan." Finally, a feature importance assessment module retains the top 300 features that contribute most to risk identification, reducing computational complexity. Next, participating nodes acquire a pre-defined basic model structure. They obtain a gradient boosting tree model structure from the federated coordination node, containing basic parameters such as the number of model layers and node splitting rules, ensuring consistency in the model structure trained by each participant. Using the preprocessed local features as input, the model learns the mapping relationship between transaction features and risk labels such as "suspicious transactions" and "normal transactions." By continuously adjusting the model's internal parameters to minimize prediction errors, local training is completed, resulting in a local model. Finally, the model gradient is calculated using the backpropagation algorithm. First, a loss function is defined, and the prediction accuracy is measured by the deviation between the risk score predicted by the model and the actual label. The smaller the loss value, the better the model performance. Then, starting from the model output layer, the backpropagation algorithm is used to calculate the partial derivatives of the loss function with respect to each parameter layer by layer to obtain the gradient. A positive gradient means that the parameters need to be increased to reduce the loss, and a negative gradient means that the parameters need to be decreased. After the calculation is completed, Laplace noise is added to the gradient. The noise intensity is dynamically adjusted according to the privacy budget. Then, homomorphic encryption technology is used to encrypt the gradient to prevent information from being stolen or parsed during transmission. Finally, the model gradient is obtained.

[0033] Optionally, the original transaction data is preprocessed to obtain local features, including: performing sliding window statistics and feature discretization on structured data to obtain structured features, wherein the sliding window statistics adopt a preset time window; performing entity recognition and semantic vectorization on text data to obtain text features; performing neighbor aggregation and graph embedding on graph data to obtain graph features; and fusing structured features, text features, and graph features to obtain local features.

[0034] Specifically, the process begins with processing structured data. A sliding window statistical analysis is performed using a pre-defined time window, such as analyzing transaction frequency, number of large transactions, and transaction time distribution over the past 7 days. Then, the statistical results are binned and discretized, dividing continuous numerical features into different discrete intervals. Transaction amounts are categorized into "0-10,000 yuan," "10,000-50,000 yuan," and "over 50,000 yuan," thus obtaining structured features. When processing text data, named entity recognition is used to extract key fields such as occupation, nationality, and transaction purpose descriptions. Irrelevant and redundant information is filtered out, and the extracted text is then converted into a fixed-dimensional semantic vector, transforming the text information into a computer-processable numerical form, resulting in text features. When processing graph data, graph neural networks can be used to aggregate multi-hop neighbor features. For example, using a transaction device as a central node, feature information from its directly associated devices and indirectly associated multi-hop devices is aggregated. Then, a fixed-length graph embedding vector is generated, transforming complex graph structure information into a unified-dimensional numerical feature, resulting in graph features. Finally, the participating nodes will integrate the obtained structured features, text features, and graph features, and combine the features of different dimensions into a unified feature vector by feature concatenation, forming local features.

[0035] Optionally, generating encrypted gradients based on model gradients includes: adding differential privacy noise to the model gradients to generate noisy gradients; and encrypting the noisy gradients using a homomorphic encryption algorithm to generate encrypted gradients.

[0036] Differential privacy noise is generated using random values ​​through a Laplace distribution. The intensity of the noise is determined by the privacy budget; a smaller budget results in greater noise, ensuring that even if an attacker obtains the noisy gradient, they cannot deduce the original local data, effectively protecting data privacy. When adding noise, the noise level is dynamically adjusted based on different gradient dimensions. For gradient dimensions with less impact on the model, the noise level is increased appropriately, while for critical gradient dimensions, the noise intensity is controlled to avoid excessively affecting model performance. Participating nodes use a homomorphic encryption algorithm to encrypt the noisy gradient, generating an encrypted gradient. Homomorphic encryption allows direct computation in ciphertext, ensuring the encrypted gradient does not leak original information. Furthermore, the federated coordination node can directly aggregate the encrypted gradient without prior decryption. Participating nodes can use a preset public key to encrypt the noisy gradient, generating ciphertext that can only be decrypted with the corresponding private key. During encryption, each gradient value is encrypted individually, ensuring the protection of information in each dimension. The final encrypted gradient can be securely transmitted to the federated coordination node, achieving the privacy goal of data usability without visibility.

[0037] S120. Through the federated coordination node, the encryption gradient is aggregated to generate a global model, and the global model is distributed to the participating nodes.

[0038] Aggregation processing refers to the process by which the federated coordination node integrates the encrypted gradients of each participant. The federated coordination node can employ secure aggregation technology to generate global model parameters through weighted averaging. The global model is a unified model obtained after aggregation by the federated coordination node, incorporating the feature information of all participants and possessing comprehensive risk identification capabilities across institutional data. After encryption, the global model is distributed to each participant node for local customer risk score calculation.

[0039] Specifically, the federated coordination node includes a parameter server and a secure aggregation module. After receiving the encrypted gradients sent by each participating node, the secure aggregation module aggregates the encrypted gradients using a weighted average strategy. The weights are dynamically adjusted based on the amount of data from each participating node. Homomorphic encryption is used to ensure the security of the aggregation process, and the secure aggregation module implements differential privacy protection. After aggregation, a global model is generated and then distributed to each participating node via an encrypted channel.

[0040] S130. Calculate the risk score of the target customer based on the global model through the participating party nodes.

[0041] In this context, "target customers" refers to financial institution clients who require risk assessment. Their transaction behavior, identity information, and device-related data will be analyzed through a global model. The risk score refers to the global model's quantitative assessment of the target customer's money laundering risk.

[0042] Specifically, after receiving the global model, participating nodes can use it to assess the risk of target customers and calculate their risk scores. Simultaneously, the system generates visual reports containing risk heatmaps, feature impact rankings, and other visual interpretations through feature attribution and decision tracing, showcasing the contribution distribution of each feature to the risk score.

[0043] Optionally, the risk score of the target customer is calculated based on the global model, including: extracting customer features corresponding to the target customer from local features; and inputting the customer features into the global model to obtain the risk score of the target customer.

[0044] Specifically, participating nodes can extract customer features corresponding to the target customer from local features. Local features include structured features, text features, and graph features processed by all participating nodes. Participating nodes can accurately filter all feature data belonging to the target customer from a massive amount of local features based on the target customer's unique identifier, such as the customer's account number. This includes structured transaction features such as the customer's transaction amount and frequency, text features such as occupation and identity information, and graph features such as associated devices and transaction chains. Participating nodes input the extracted customer features into a global model. The global model is a unified model that integrates data features from all participating nodes, possessing comprehensive risk identification capabilities across institutions. The model performs calculations according to preset risk assessment rules based on the various dimensions of customer features. For example, it identifies whether the customer exhibits abnormal behavior such as frequent large-amount transfers, transactions from different locations, and association with high-risk devices. Each abnormal behavior is assigned a corresponding risk score. Finally, all risk scores are weighted and summed to obtain the target customer's risk score. A higher score indicates a greater likelihood of abnormal financial behavior. The system also generates a feature contribution report, showing the degree of influence of each feature on the final risk score.

[0045] It should be noted that the user information and data involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, and necessary confidentiality measures have been taken. The data does not violate public order and good morals, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0046] The technical solution of this invention, through participating nodes acquiring multiple types of raw transaction data, training local models, generating encrypted gradients, and uploading them, can effectively extract local features and protect privacy without leaking the original data. By aggregating the encrypted gradients through a federated coordination node and generating and distributing a global model, the comprehensiveness and accuracy of the model can be improved by integrating features from multiple parties. By having participating nodes calculate target customer risk scores based on the global model, accurate identification and reliable risk assessment of abnormal financial behavior can be achieved by relying on the integrated global features.

[0047] Example 2 Figure 2 This is a flowchart of an abnormal financial behavior monitoring method provided in Embodiment 2 of the present invention. This embodiment adds a decision application layer based on Embodiment 1. Figure 2 As shown, the method includes: S210. Through the decision application layer, determine the target risk level corresponding to the risk score and determine the timestamp corresponding to the customer characteristics.

[0048] Specifically, the decision application layer determines the target risk level based on the initial risk score output by the global model and the preset risk level classification rules. For example, 0-20 points can be classified as low risk, 21-60 points as medium risk, and 61-100 points as high risk. At the same time, the generation timestamp corresponding to the customer feature is extracted from the local feature library, and the timestamp records the specific time when the feature was generated.

[0049] S220, Calculate the time difference between the timestamp and the current time.

[0050] Specifically, the decision application layer will calculate the time difference between the timestamp and the current time. For example, if the timestamp shows that the feature was generated 3 days ago, and the current time is June 2, the time difference will be 3 days.

[0051] S230. Obtain a preset list of time decay coefficients, wherein the list of time decay coefficients includes the decay coefficients corresponding to each risk level.

[0052] Specifically, the time decay coefficient list sets corresponding decay coefficients for different risk levels, such as 0.3 for low risk, 0.6 for medium risk, and 0.9 for high risk.

[0053] S240. Match the target risk level with the time decay coefficient list to determine the target decay coefficient corresponding to the target risk level.

[0054] Specifically, the decision-making application layer can match the determined target risk level with the list content to find the corresponding target attenuation coefficient.

[0055] S250. Substitute the target attenuation coefficient and time difference into the preset time attenuation function to calculate the dynamic weight.

[0056] Specifically, the decision application layer can substitute the target decay coefficient and the calculated time difference into a preset time decay function. The time decay function can adjust the weight of the feature's impact on the current risk assessment based on the time proximity, with higher weights for more recent data. If the target decay coefficient is 0.6 and the time difference is 3 days, the calculated dynamic weight is 0.15.

[0057] S260. The risk score is corrected by applying dynamic weights to obtain the corrected risk score.

[0058] Specifically, the decision application layer can dynamically adjust the initial risk score with weights. For example, if the initial score is 50 points, the adjusted risk score is 50 multiplied by 0.15, which equals 7.5 points, thus making the risk score more in line with the customer's current actual risk situation.

[0059] Optionally, the method also includes: detecting the real-time transaction data of the target customer through the decision application layer, and when the detected real-time transaction data exceeds a preset threshold, reducing the preset time window by a specified ratio.

[0060] Specifically, the decision application layer continuously receives and analyzes real-time transaction data from target customers, comparing it with pre-set thresholds, such as a single transaction exceeding five times the customer's average transaction amount over the past 30 days. When a real-time transaction exceeds a preset threshold, the decision application layer automatically triggers a time window adjustment mechanism, dynamically shrinking the preset time window by a specified ratio, for example, reducing it to one-third of its original size. This event-triggered mechanism allows for rapid response and adjustment of the time window size upon identifying abnormal transactions, thus focusing more on recent transaction behavior, improving sensitivity and timeliness in detecting suspicious transactions, and helping to promptly identify potential risks from abnormal financial behavior.

[0061] The technical solution of this invention determines the risk level and characteristic timestamp and calculates the time difference through the decision application layer, matches the attenuation coefficient, substitutes it into the attenuation function to obtain dynamic weights, and corrects the risk score. This can dynamically adapt to the timeliness of risks and improve the accuracy of assessment. At the same time, it monitors transaction data in real time, narrows the time window when the threshold is exceeded, and can quickly respond to abnormal transactions and enhance the sensitivity of monitoring high-risk scenarios.

[0062] Example 3 Figure 3 This is a schematic diagram of the structure of an abnormal financial behavior monitoring device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a federated coordination node 310 and at least one participating node 320; the participating node 320 is used to acquire raw transaction data, train a local model based on the raw transaction data and determine the model gradient, generate an encrypted gradient based on the model gradient, and send the encrypted gradient to the federated coordination node, wherein the raw transaction data includes structured data, text data and graph data; the federated coordination node 310 is used to aggregate the encrypted gradient to generate a global model and distribute the global model to the participating node; the participating node 320 is used to calculate the risk score of the target customer based on the global model.

[0063] Optionally, participant node 320 is specifically used for: preprocessing the original transaction data to obtain local features; obtaining a preset basic model structure, training the basic model structure locally based on the local features to obtain a local model; and calculating the gradient of the loss function of the local model through the backpropagation algorithm to obtain the model gradient.

[0064] Optionally, participant node 320 is specifically used for: performing sliding window statistics and feature discretization on structured data to obtain structured features, wherein the sliding window statistics adopt a preset time window; performing entity recognition and semantic vectorization on text data to obtain text features; performing neighbor aggregation and graph embedding on graph data to obtain graph features; and fusing structured features, text features and graph features to obtain local features.

[0065] Optionally, participant node 320 is specifically used to: add differential privacy noise to the model gradient to generate a noisy gradient; and encrypt the noisy gradient using a homomorphic encryption algorithm to generate an encrypted gradient.

[0066] Optionally, participant node 320 is specifically used for: extracting customer features corresponding to the target customer from local features; and inputting the customer features into the global model to obtain the risk score of the target customer.

[0067] Optionally, the device further includes a decision application layer, specifically used for: determining the target risk level corresponding to the risk score and determining the timestamp corresponding to the customer characteristics; calculating the time difference between the timestamp and the current time; obtaining a preset list of time decay coefficients, wherein the list of time decay coefficients includes decay coefficients corresponding to each risk level; matching the target risk level with the list of time decay coefficients to determine the target decay coefficient corresponding to the target risk level; substituting the target decay coefficient and the time difference into a preset time decay function to calculate the dynamic weight; and correcting the risk score using the dynamic weight to obtain a corrected risk score.

[0068] Optionally, the decision application layer is also used to: detect the real-time transaction data of the target customer, and when the detected real-time transaction data exceeds the preset threshold, reduce the preset time window by a specified ratio.

[0069] The technical solution of this invention, through participating nodes acquiring multiple types of raw transaction data, training local models, generating encrypted gradients, and uploading them, can effectively extract local features and protect privacy without leaking the original data. By aggregating the encrypted gradients through a federated coordination node and generating and distributing a global model, the comprehensiveness and accuracy of the model can be improved by integrating features from multiple parties. By having participating nodes calculate target customer risk scores based on the global model, accurate identification and reliable risk assessment of abnormal financial behavior can be achieved by relying on the integrated global features.

[0070] The abnormal financial behavior monitoring device provided in this embodiment of the invention can execute an abnormal financial behavior monitoring method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0071] Example 4 Figure 4 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0072] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) or random access memory (RAM), communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded into the RAM 13 from the storage unit 18. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. Input / output (I / O) interfaces are also connected to the bus 14.

[0073] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0074] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as an abnormal financial behavior monitoring method.

[0075] In some embodiments, an abnormal financial behavior monitoring method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the abnormal financial behavior monitoring method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform an abnormal financial behavior monitoring method by any other suitable means (e.g., by means of firmware).

[0076] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0077] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0078] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0079] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0080] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0081] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0082] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0083] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for monitoring abnormal financial behavior, characterized in that, Applied to devices monitoring abnormal financial behavior, including a federal coordination node and at least one participating node, the method includes: The participating nodes acquire raw transaction data, train a local model based on the raw transaction data and determine the model gradient, generate an encrypted gradient based on the model gradient, and send the encrypted gradient to the federated coordination node. The raw transaction data includes structured data, text data, and graph data. The encryption gradients are aggregated through the federated coordination node to generate a global model, which is then distributed to the participating nodes. Risk scores for target customers are calculated based on the global model through participating nodes.

2. The method according to claim 1, characterized in that, The step of training a local model based on the original transaction data and determining the model gradient includes: The original transaction data is preprocessed to obtain local features; Obtain a preset basic model structure, and perform local training on the basic model structure based on the local features to obtain a local model; The gradient of the model is obtained by calculating the gradient of the loss function of the local model through the backpropagation algorithm.

3. The method according to claim 2, characterized in that, The preprocessing of the original transaction data to obtain local features includes: Structured data is subjected to sliding window statistics and feature discretization to obtain structured features, wherein the sliding window statistics adopt a preset time window; Entity recognition and semantic vectorization are performed on text data to obtain text features; Neighbor aggregation and graph embedding are performed on the graph data to obtain graph features; The structured features, text features, and graph features are fused to obtain local features.

4. The method according to claim 1, characterized in that, The step of generating encrypted gradients based on the model gradients includes: Differential privacy noise is added to the gradient of the model to generate a noisy gradient; The noisy gradient is encrypted using a homomorphic encryption algorithm to generate an encrypted gradient.

5. The method according to claim 3, characterized in that, The calculation of the risk score for the target customer based on the global model includes: Extract customer features corresponding to the target customer from the local features; The customer characteristics are input into the global model to obtain the risk score of the target customer.

6. The method according to claim 5, characterized in that, The apparatus further includes a decision application layer, and the method further includes: Through the decision application layer, the target risk level corresponding to the risk score is determined, and the timestamp corresponding to the customer characteristic is determined; Calculate the time difference between the timestamp and the current time; Obtain a preset list of time decay coefficients, wherein the list of time decay coefficients includes decay coefficients corresponding to each risk level; The target risk level is matched with the time decay coefficient list to determine the target decay coefficient corresponding to the target risk level; Substitute the target attenuation coefficient and the time difference into the preset time attenuation function to calculate the dynamic weight; The risk score is corrected by the dynamic weights to obtain a corrected risk score.

7. The method according to claim 6, characterized in that, The method further includes: Through the decision application layer, the real-time transaction data of the target customer is detected. When the detected real-time transaction data exceeds a preset threshold, the preset time window is reduced by a specified ratio.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

9. A computer storage medium, characterized in that, The computer storage medium stores computer instructions that are used to cause a processor to execute the method of any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method according to any one of claims 1-7.

Images