Supply chain finance data anomaly detection method and system based on transaction relationship graph

Abstract

The application discloses a supply chain financial data anomaly detection method and system based on a transaction relationship graph, and belongs to the technical field of financial data anomaly detection. The time stamp attribute is sequentially coded, and the joint node representation is obtained based on the sequentially coded time stamp attribute, so that the recent transaction and long-term transaction characteristics can be distinguished during subsequent anomaly detection, the problem that the abnormal mode is difficult to identify can be effectively solved, and the identification sensitivity to the hidden anomaly can be improved. Three parallel heterogeneous base classifiers are used to comprehensively predict the results of the three, so that the fusion anomaly probability value is more stable, the effective identification of the rare abnormal mode can be realized, the initial source and the final destination of the abnormal fund can be quickly located, the conduction process of the abnormal data is clearly displayed, and the application and promotion are facilitated.

Description

Technical Field

[0001] This invention belongs to the field of financial data anomaly detection technology, specifically relating to a supply chain finance data anomaly detection method and system based on transaction relationship graphs. Background Technology

[0002] A supply chain revolves around a core enterprise, connecting upstream suppliers or suppliers of suppliers, and downstream users or users of users. Through the control and flow of information, logistics, capital, and commerce, it moves from the procurement of raw materials to the core enterprise, through production and processing into intermediate or final products, and then the core enterprise delivers the products to the user's designated location through its sales network and logistics transportation. This trajectory from raw materials to finished products and their final destination forms a complete chain.

[0003] Supply chain finance, as a model that relies on genuine trade backgrounds and provides comprehensive financial services to core enterprises and their upstream and downstream partners, has played a significant role in addressing the financing difficulties of SMEs in recent years. However, with the increasing number of participants in the supply chain, the extension of transaction chains, and the increasingly frequent cross-regional capital flows, abnormal behaviors such as fraudulent trade, duplicate financing, forged bills, and idle funds are constantly emerging, posing a severe challenge to the risk control capabilities of financial institutions. Abnormal financial transactions typically refer to transactions that violate or deviate from normal business practices and may involve fraud or credit risk. With the digitalization of financial activities, these methods are becoming increasingly complex and covert, enabling frequent large-scale transactions within a short period, rapid cross-regional capital flows, and concentrated transactions during non-normal business hours. They exhibit non-linear, intermittent, and cross-channel characteristics, and their data manifestations are often weak and unstable, making them difficult to accurately identify using traditional methods.

[0004] Currently, anomaly detection in supply chain finance mainly relies on rule engines and traditional machine learning models. These models screen based on preset thresholds or logical conditions, specifically including sudden changes in transaction amounts, abnormal frequency, and blacklists of related parties. While offering strong interpretability, the rigid rule system struggles to address evolving fraud tactics, leading to a high false positive rate. In machine learning, common methods include logistic regression, support vector machines, random forests, isolation forests, and gradient boosting models like XGBoost. These methods extract statistical features such as transaction amount, frequency, and time intervals for binary classification. However, these methods typically treat each transaction or enterprise as an independent sample, neglecting the complex financial relationships and transmission effects between enterprises in the supply chain. They struggle to uncover collaborative anomaly patterns hidden in multi-hop transaction chains, and they underutilize enterprise textual descriptions and temporal trends. Furthermore, they often rely on a single classifier, which is unstable under fluctuating data distribution or noise interference.

[0005] Therefore, how to provide an effective technical solution to address the problems of traditional methods in existing technologies, such as difficulty in identifying anomalies in supply chain finance data, limited expressive power, unstable cross-scenario generalization performance, reliance on a single classifier, and poor stability, has become an urgent technical challenge to be solved. Summary of the Invention

[0006] The purpose of this invention is to provide a method and system for detecting anomalies in supply chain finance data based on transaction relationship graphs, in order to solve the above-mentioned problems existing in the prior art.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a method for detecting anomalies in supply chain finance data based on transaction relationship graphs, including: Acquire supply chain finance transaction data, construct a transaction relationship graph based on the supply chain finance transaction data, wherein the transaction participants in the supply chain finance transaction data are used as nodes, and the fund transfer relationship between the transaction participants is used as directed edges, wherein the direction of the directed edges is from the fund outflow to the fund inflow, and divide the transaction relationship graph into time steps to obtain a dynamic graph sequence. The timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence is temporally encoded, and the joint node representation is obtained based on the temporally encoded timestamp attribute; The joint node representation is input into three parallel heterogeneous base classifiers to obtain the anomaly probability value corresponding to each heterogeneous base classifier. The three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node. A backtracking analysis is performed on the abnormal node and its associated multi-hop neighbor nodes. The upstream source node and downstream destination node of the abnormal node are traced along the direction of fund flow to obtain the abnormal fund flow path. Based on the abnormal fund flow path, the abnormal transaction detection result is output.

[0008] In one possible design, the transaction relationship graph is divided into time steps to obtain a dynamic graph sequence, including: Associating each directed edge in the transaction relationship graph with the timestamp attribute and transaction amount attribute of the corresponding transaction, a directed dynamic graph with time sequence attributes is obtained; All transaction data is divided into multiple time steps according to a preset time window based on the timestamp attribute of the transaction. Within each time step, a subgraph corresponding to the time window is constructed. All subgraphs are then sorted according to the order of the time steps to obtain a dynamic graph sequence.

[0009] In one possible design, each directed edge in the transaction relationship graph is associated with the timestamp attribute and the transaction amount attribute of the corresponding transaction, resulting in a directed dynamic graph with temporal attributes, including: Extract the unique identifiers of all transaction participants from the supply chain finance transaction data, use the unique identifiers of all transaction participants as a set of nodes, and extract the fund outflow identifiers and fund inflow identifiers from all transaction records in the supply chain finance transaction data to obtain a set of directed edges. For each transaction record, the fund outflow party corresponding to the transaction participant in the transaction record is taken as the starting node, and the fund inflow party corresponding to the transaction participant in the transaction record is taken as the ending node, so as to construct a directed edge based on the starting node and the ending node; Use the transaction timestamp in the transaction record as the timestamp attribute of the directed edge, and use the transaction amount in the transaction record as the amount attribute of the directed edge. For each transaction record, a directed edge is constructed with the outflow node of the transaction record as the starting node and the inflow node of the transaction record as the ending node. The transaction timestamp in the transaction record is used as the timestamp attribute of the directed edge, and the transaction amount is used as the amount attribute of the directed edge, resulting in a directed dynamic graph with time sequence attributes.

[0010] In one possible design, before dividing the transaction relationship graph into time steps, the following is also included: For each node in the transaction relationship graph, the original statistical features of the node in the transaction records are extracted. The original statistical features include the total number of transactions, the number of fund transfers out, the number of fund transfers in, the cumulative amount transferred out, and the cumulative amount transferred in. The business scope text of each node is segmented into words to obtain multiple word sequences. The document frequency of each word is calculated based on the word sequences of all nodes, and the weight value of each word is calculated based on the document frequency. The words are sorted based on the weight value of each word, and a specified number of words with the highest weight value are selected as keywords. The weight value corresponding to each keyword is used as the text semantic feature of the node. For each node in the transaction relationship graph, extract the transaction frequency sequence and transaction amount sequence of that node within each preset transaction time window, and calculate the difference sequence of transaction frequency and the difference sequence of transaction amount between adjacent transaction time windows, using the difference sequence as a time series statistical feature; The original statistical features, textual semantic features, and temporal statistical features of each node are used as the multimodal features corresponding to the node. In order to perform standardized preprocessing of the transaction relationship graph based on the multimodal features, the preprocessed transaction relationship graph is divided into time steps to obtain a dynamic graph sequence.

[0011] In one possible design, the transaction relationship graph is standardized and preprocessed based on multimodal features, including: Missing values ​​are detected in the numerical feature fields of the multimodal features to obtain the missing values ​​and corresponding missing rates of the numerical feature fields. Numerical feature fields with missing rates greater than a first preset threshold and those less than or equal to the first preset threshold are removed. The missing values ​​of the numerical feature fields are filled with the mean of the numerical feature fields. The multimodal features after removal or filling are standardized, and the standardized multimodal features are aligned to ensure that the feature column names and arrangement order are consistent.

[0012] In one possible design, the timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence is temporally encoded, and based on the temporally encoded timestamp attribute, the joint node representation is obtained, including: For the current node and its neighboring nodes in the dynamic graph sequence, obtain the current timestamp of the current node at the current time step and the transaction timestamp of the transaction edge between the current node and its neighboring nodes. Based on the current timestamp and the transaction timestamp, calculate the relative time difference of the transaction. Map the relative time difference of transactions to a high-dimensional time embedding vector; The original statistical features, textual semantic features, and temporal statistical features of each node are concatenated to obtain the node static feature vector. The high-dimensional temporal embedding vector and the node static feature vector are then concatenated to obtain the joint node representation.

[0013] In one possible design, three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node, including: Calculate the arithmetic mean of the anomaly probabilities corresponding to the three base classifiers, and use the arithmetic mean as the fused anomaly probability value. Based on the comparison between the preset probability value and the fusion anomaly probability value, if the fusion anomaly probability value is greater than the preset probability value, the corresponding node is determined to be an abnormal node; otherwise, it is determined to be a normal node.

[0014] In one possible design, backtracking analysis is performed on the abnormal node and its associated multi-hop neighbor nodes. The upstream source node and downstream destination node of the abnormal node are traced along the direction of fund flow to obtain the abnormal fund flow path, including: The abnormal node is used as the starting node, and backtracking is performed along the incoming edge direction of the directed edge to obtain all first-order upstream nodes that directly transfer funds to the starting node. Then, backtracking is continued along the incoming edge direction of the first-order upstream nodes to obtain second-order upstream nodes, until the backtracking depth reaches the preset first backtracking depth threshold, thus obtaining the upstream fund traceability chain. Based on the starting node, trace along the outgoing edge of the directed edge to obtain all first-order downstream nodes from which funds are directly transferred out of the starting node. Then, continue tracing along the outgoing edge of the first-order downstream nodes to obtain second-order downstream nodes, until the tracing depth reaches the preset second backtracking depth threshold, thus obtaining the downstream fund destination chain. Arrange the nodes in the upstream fund traceability chain in reverse order of fund flow direction, and then splice them with the nodes in the target node and the downstream fund destination chain arranged in order of fund flow direction to obtain the abnormal fund flow path from the upstream fund source node to the downstream fund destination node.

[0015] Secondly, this invention provides a supply chain finance data anomaly detection system based on transaction relationship graphs, comprising: The graph construction module is used to acquire supply chain finance transaction data and construct a transaction relationship graph based on the supply chain finance transaction data. In this module, the transaction participants in the supply chain finance transaction data are used as nodes, and the fund transfer relationship between the transaction participants is used as directed edges. The direction of the directed edges is from the fund outflow to the fund inflow. The transaction relationship graph is divided into time steps to obtain a dynamic graph sequence. The encoding representation module is used to perform time-series encoding on the timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence, and obtain the joint node representation based on the time-series encoded timestamp attribute; The anomaly determination module is used to input the joint node representation into three parallel heterogeneous base classifiers to obtain the anomaly probability value corresponding to each heterogeneous base classifier. The three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node. The results output module is used to perform backtracking analysis on abnormal nodes and their associated multi-hop neighbor nodes, trace the upstream source nodes and downstream destination nodes of abnormal nodes along the direction of fund flow, obtain abnormal fund flow paths, and output abnormal transaction detection results based on the abnormal fund flow paths.

[0016] Thirdly, the present invention provides a computer device comprising a memory, a processor, and a transceiver that are sequentially and communicatively connected, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the supply chain finance data anomaly detection method based on transaction relationship graph as described in the first aspect above.

[0017] Fourthly, the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, perform the supply chain finance data anomaly detection method based on transaction relationship graphs as described in the first aspect above.

[0018] Fifthly, the present invention provides a computer program product containing instructions that, when the instructions are executed on a computer, cause the computer to perform the supply chain finance data anomaly detection method based on transaction relationship graphs as described in the first aspect above.

[0019] The beneficial effects of this invention are as follows: This invention discloses a method and system for detecting anomalies in supply chain finance data based on a transaction relationship graph. First, supply chain finance transaction data is acquired. A transaction relationship graph is constructed based on this data, where transaction participants are treated as nodes, and fund transfer relationships between participants are treated as directed edges. The transaction relationship graph is divided into time steps to obtain a dynamic graph sequence. The timestamp attribute of each directed edge in the dynamic graph sequence is time-series encoded, and a joint node representation is obtained based on the time-series encoded timestamp attribute. This joint node representation is input into three parallel heterogeneous base classifiers to obtain anomaly probability values ​​for each classifier. The three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is identified as an anomaly node. Backtracking analysis is performed on the anomaly node and its associated multi-hop neighbor nodes. The upstream fund source node and downstream fund destination node of the anomaly node are traced along the direction of fund flow to obtain the anomaly fund flow path. Based on the anomaly fund flow path, the anomaly transaction detection result is output. This invention uses time-series encoding of timestamp attributes to obtain a joint node representation. This enables the differentiation between recent and distant transaction features during subsequent anomaly detection, effectively addressing the difficulty in identifying anomaly patterns and improving the sensitivity of identifying hidden anomalies. Furthermore, it employs three parallel heterogeneous base classifiers to synthesize the prediction results of the three classes, resulting in a more stable fused anomaly probability value. This allows for the effective identification of scarce anomaly patterns, rapid location of the initial source and final destination of abnormal funds, and clear visualization of the transmission process of anomaly data, facilitating application and promotion. Attached Figure Description

[0020] Figure 1 A flowchart of a supply chain finance data anomaly detection method based on transaction relationship graphs provided in an embodiment of the present invention; Figure 2 This is a block diagram of a supply chain finance data anomaly detection system based on transaction relationship graphs provided in an embodiment of the present invention. Figure 3 A structural diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the present invention will be briefly introduced below in conjunction with the accompanying drawings and descriptions of the embodiments or the prior art. Obviously, the following description of the structure of the accompanying drawings is only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. It should be noted that the description of these embodiments is for the purpose of helping to understand the present invention, but does not constitute a limitation of the present invention.

[0022] It should be understood that although the terms first, second, etc., may be used herein to describe various units, these units should not be limited by these terms. These terms are only used to distinguish one unit from another. For example, a first unit may be referred to as a second unit, and similarly, a second unit may be referred to as a first unit, without departing from the scope of the exemplary embodiments of the invention.

[0023] It should be understood that the term "and / or" that may appear in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, B exists alone, and A and B exist simultaneously. The term " / and" that may appear in this document describes another relationship between related objects, indicating that two relationships can exist. For example, A / and B can mean: A exists alone, and A and B exist alone. In addition, the character " / " that may appear in this document generally indicates that the related objects before and after it are in an "or" relationship.

[0024] Example: like Figure 1 As shown, the first aspect of this embodiment provides a method for detecting anomalies in supply chain finance data based on transaction relationship graphs. This method can be executed, but is not limited to, by a computer device or virtual machine with certain computing resources, such as a personal computer or smartphone, or by a virtual machine. The method for detecting anomalies in supply chain finance data includes, but is not limited to, the following steps: S1. Obtain supply chain finance transaction data, construct a transaction relationship graph based on the supply chain finance transaction data, wherein the transaction participants in the supply chain finance transaction data are used as nodes, and the fund transfer relationship between the transaction participants is used as directed edges, wherein the direction of the directed edges is from the fund outflow to the fund inflow, and the transaction relationship graph is divided into time steps to obtain a dynamic graph sequence. In practice, the sources of supply chain finance transaction data are diverse, including internal risk management systems of financial institutions, third-party payment platforms, enterprise resource planning systems, or dedicated supply chain management platforms. In this embodiment, supply chain finance transaction data can be retrieved in real time through standardized application programming interfaces, historical transaction records can be exported in batches from relational databases through structured query language, or formatted data files pushed by partners can be obtained through file transfer protocols. This embodiment does not impose specific limitations on these methods.

[0025] It should be noted that the supply chain finance transaction data includes, but is not limited to, the address identifiers of the transacting parties, the transaction timestamp, the transaction amount, the transaction frequency, the transaction direction, and multi-dimensional attribute information of the enterprises. The address identifiers of the transacting parties can use the unified social credit code of the enterprise as the address identifier for transactions between enterprises, the bank account number as the address identifier for fund transfers between accounts, the digital wallet address as the address identifier for supply chain finance transactions in a blockchain environment, or the unique user number assigned to each registered user within the supply chain finance platform. The transaction timestamp accuracy must reach the second level to effectively distinguish the temporal order and relative time intervals between transactions during subsequent time-series coding. The transaction direction is used to represent the direction of fund transfer from the outflow node to the inflow node. The multi-dimensional attribute information of the enterprises in actual supply chain finance business includes, but is not limited to, the enterprise's registration date, annual report submission records, business registration changes, tax payment details, and a textual description of its business scope.

[0026] In a preferred embodiment, after acquiring supply chain finance transaction data, an initial data verification is performed on the supply chain finance transaction data. The verification rules include checking whether the address identifiers of the two parties to the transaction are empty, and / or whether the transaction amount is positive, and / or whether the timestamp is correct. For supply chain finance transaction data that fails the verification, it is recorded according to the error type.

[0027] Specifically, in step S1, the transaction relationship graph is divided into time steps to obtain a dynamic graph sequence, including: S11. Associate each directed edge in the transaction relationship graph with the timestamp attribute and transaction amount attribute of the corresponding transaction to obtain a directed dynamic graph with time sequence attributes; S12. Divide all transaction data into multiple time steps according to a preset time window based on the timestamp attribute of the transaction; S13. Construct a subgraph corresponding to the time window within each time step, and sort all the subgraphs according to the order of the time steps to obtain a dynamic graph sequence.

[0028] It should be noted that, firstly, the complete timeline covered by all transaction data is determined, that is, the time span from the earliest timestamp to the latest transaction timestamp. Then, the complete timeline is divided into multiple continuous and non-overlapping time intervals according to a preset time window. These time intervals are called time steps. The preset time window can be set according to the actual situation, and is not specifically limited in this embodiment. If a node does not have any transactions within the preset time window, it is still retained as an isolated node in the subgraph of that time step. At the same time, its node characteristics can be filled with the feature values ​​or moving averages of the previous time step, thereby maintaining the continuity of the node's identity in the dynamic graph sequence and avoiding information breaks caused by temporary inactivity of the node.

[0029] In a preferred embodiment, step S11 involves associating each directed edge in the transaction relationship graph with the timestamp attribute and transaction amount attribute of the corresponding transaction, resulting in a directed dynamic graph with temporal attributes, including: S11.1. Extract the unique identifiers of all transaction participants from the supply chain finance transaction data, use the unique identifiers of all transaction participants as a set of nodes, and extract the fund outflow identifiers and fund inflow identifiers from all transaction records in the supply chain finance transaction data to obtain a set of directed edges. S11.2. For each transaction record, take the fund outflow party corresponding to the transaction participant in the transaction record as the starting node and the fund inflow party corresponding to the transaction participant in the transaction record as the ending node, and construct a directed edge based on the starting node and the ending node. S11.2. Use the transaction timestamp in the transaction record as the timestamp attribute of the directed edge, and use the transaction amount in the transaction record as the amount attribute of the directed edge; S11.3. For each transaction record, construct a directed edge with the fund outflow node as the starting node and the fund inflow node as the ending node. Use the transaction timestamp in the transaction record as the timestamp attribute of the directed edge and the transaction amount as the amount attribute of the directed edge to obtain a directed dynamic graph with time sequence attributes.

[0030] It should be noted that the same enterprise may appear repeatedly in the fund outflow and fund inflow of transaction data. Therefore, it is necessary to deduplicate and merge the fund outflow and fund inflow in the transaction records to form a set of unique nodes. At the same time, the fund outflow and fund inflow of each transaction record are extracted from all transaction records and used as pairs to form a candidate set of directed edges. The fund outflow in the transaction record is used as the starting node and the fund inflow is used as the ending node of the directed edge, thus forming a directed edge from the starting node to the ending node.

[0031] In practice, the transaction timestamp in the transaction record is used as the timestamp attribute of the directed edge, accurately recording the precise moment the transaction occurred. The transaction amount in the transaction record is used as the amount attribute of the directed edge, thus recording the detailed amount of funds transferred in the transaction, ensuring that each directed edge carries complete transaction information. Specifically, each directed edge can be represented by a four-tuple, including the start node, end node, timestamp attribute, and amount attribute, facilitating quick access to edge attributes later.

[0032] Furthermore, before dividing the transaction relationship graph into time steps, it also includes: S14. For each node in the transaction relationship graph, extract the original statistical features of the node in the transaction records. The original statistical features include the total number of transactions, the number of fund transfers out, the number of fund transfers in, the cumulative amount transferred out, and the cumulative amount transferred in. S15. Perform word segmentation on the business scope text of each node to obtain multiple word sequence. Calculate the document frequency of each word based on the word sequence of all nodes, and calculate the weight value of each word based on the document frequency of each word. Sort the words based on the weight value of each word, select the top specified number of words with the highest weight values ​​as keywords, and use the weight value corresponding to each keyword as the text semantic feature of the node. S16. For each node in the transaction relationship graph, extract the transaction frequency sequence and transaction amount sequence of that node in each preset transaction time window, and calculate the difference sequence of transaction frequency and the difference sequence of transaction amount between adjacent transaction time windows, and use the difference sequence as a time series statistical feature; S17. The original statistical features, textual semantic features, and temporal statistical features of each node are used as the multimodal features corresponding to the node. In order to perform standardized preprocessing on the transaction relationship graph based on the multimodal features, and to divide the preprocessed transaction relationship graph into time steps to obtain a dynamic graph sequence.

[0033] In step S17, the transaction relationship graph is standardized and preprocessed based on multimodal features, including: S17.1. Perform missing value detection on the numerical feature fields in the multimodal features to obtain the missing values ​​and corresponding missing rates of the numerical feature fields. Remove the numerical feature fields with missing rates greater than the first preset threshold and the numerical feature fields with missing rates less than or equal to the first preset threshold. Fill the missing values ​​of the numerical feature fields with the mean of the numerical feature fields. S17.2. Standardize the multimodal features after removal or filling, and align the standardized multimodal features to ensure that the feature column names and arrangement order are consistent.

[0034] It should be noted that in this embodiment, the first preset threshold is 60%. That is, when the missing rate of a certain numerical feature field exceeds 60%, it means that the data quality of the field is poor and it is difficult to recover effective information through imputation. Therefore, the numerical feature field is removed. When the missing rate of a certain numerical feature field does not exceed 60%, other non-missing value features are used to fill it.

[0035] S2. Perform time-series encoding on the timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence, and obtain the joint node representation based on the time-series encoded timestamp attribute; Specifically, in step S2, the timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence is time-series encoded, and based on the time-series encoded timestamp attribute, the joint node representation is obtained, including: S21. For the current node and its neighboring nodes in the dynamic graph sequence, obtain the current timestamp of the current node at the current time step and the transaction timestamp of the transaction edge between the current node and its neighboring nodes. Based on the current timestamp and the transaction timestamp, calculate the relative time difference of the transaction. S22. Map the relative time difference of transactions to a high-dimensional time embedding vector; S23. Concatenate the original statistical features, textual semantic features, and temporal statistical features of each node to obtain the node static feature vector. Concatenate the high-dimensional temporal embedding vector and the node static feature vector to obtain the joint node representation.

[0036] It should be noted that the relative time difference of a transaction is obtained by subtracting the transaction timestamp from the current timestamp. This relative time difference is used to characterize how close the time of the occurrence of the neighbor's transaction is to the current time. The smaller the relative time difference, the closer the time of the transaction is to the current time, and the greater its influence on the evaluation of the current node's state. The larger the relative time difference, the further back the time of the transaction, and the lower its reference value.

[0037] S3. Input the joint node representation into three parallel heterogeneous base classifiers to obtain the anomaly probability value corresponding to each heterogeneous base classifier. Based on a preset fusion strategy, fuse the three anomaly probability values ​​to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node. Specifically, in step S3, the three abnormal probability values ​​are fused based on a preset fusion strategy to obtain a fused abnormal probability value. When the fused abnormal probability value exceeds a preset threshold, the corresponding node is determined to be an abnormal node, including: S31. Calculate the arithmetic mean of the anomaly probabilities corresponding to the three base classifiers, and use the arithmetic mean as the fused anomaly probability value; S32. Based on the comparison between the preset probability value and the fusion anomaly probability value, if the fusion anomaly probability value is greater than the preset probability value, the corresponding node is determined to be an abnormal node; otherwise, it is determined to be a normal node.

[0038] It should be noted that the three base classifiers are Extreme Gradient Boosting (XGBoost), Light Gradient Boosting Machine (LightGBM), and Gradient Boosting Decision Trees (GBDT).

[0039] S4. Perform backtracking analysis on the abnormal node and its associated multi-hop neighbor nodes, trace the upstream source node and downstream destination node of the abnormal node along the direction of fund flow, obtain the abnormal fund flow path, and output the abnormal transaction detection result based on the abnormal fund flow path.

[0040] Specifically, in step S4, a backtracking analysis is performed on the abnormal node and its associated multi-hop neighbor nodes. The upstream source node and downstream destination node of the abnormal node are traced along the direction of fund flow to obtain the abnormal fund flow path, including: S41. Take the abnormal node as the starting node and backtrack along the direction of the incoming edge of the directed edge to obtain all first-order upstream nodes that directly transfer funds to the starting node. Then, continue backtracking along the direction of the incoming edge of the first-order upstream nodes to obtain second-order upstream nodes until the backtracking depth reaches the preset first backtracking depth threshold to obtain the upstream fund traceability chain. S42. Based on the starting node, trace along the outgoing edge direction of the directed edge to obtain all first-order downstream nodes from which the starting node directly transfers funds. Then, continue tracing along the outgoing edge direction of the first-order downstream nodes to obtain second-order downstream nodes, until the tracing depth reaches the preset second backtracking depth threshold, and obtain the downstream fund destination chain. S43. Arrange each node in the upstream fund traceability chain in reverse order of fund flow direction, and splice them with each node in the target node and downstream fund destination chain in order of fund flow direction to obtain the abnormal fund flow path from the upstream fund source node to the downstream fund destination node.

[0041] It should be noted that the incoming edge direction is the directed edge pointing to the node, that is, the transaction relationship where funds flow from other nodes into the node. By querying all incoming edges of the starting node, all nodes that directly transfer funds to the node at any given time can be obtained. These nodes constitute the first-order upstream node set. Subsequently, taking each first-order upstream node in the first-order upstream node set as a new starting point, backtracking along its incoming edge direction, and obtaining the second-order upstream node set that transfers funds to it, repeating the above backtracking process until the number of hops reaches the preset first backtracking speed threshold. Since funds usually complete multi-level circulation within 3 to 5 hops, the preset first backtracking speed threshold is 3 in this embodiment. The preset first backtracking speed threshold can be set according to the actual business scenario. During the backtracking process, each directed edge traversed and its associated transaction amount and timestamp are recorded so as to generate a complete path later. Then, using the same target node as the starting node, downstream tracing is performed along the outgoing edge direction of the directed edge. The outgoing edge direction refers to the directed edge pointed out by the node, that is, the transaction relationship where funds flow from the node to other nodes. All outgoing edges of the starting node are queried to obtain all first-order downstream nodes into which funds are directly transferred. Then, each first-order downstream node is used as a new starting point to continue tracing its outgoing edge to obtain second-order downstream nodes, and so on, until the tracing depth reaches the preset second backtracking depth threshold. The second backtracking depth threshold can be set to the same as the first backtracking depth threshold, or it can be set to a different value according to the typical length of funds spreading downstream.

[0042] In practice, the nodes in the upstream fund tracing chain are arranged in reverse order of fund flow direction. Specifically, the upstream node sequence obtained by backtracking is recorded in a step-by-step upward direction from the starting node, that is, tracing upstream level by level from the target node. The resulting sequence order is target node, first-order upstream node, and second-order upstream node. In the final output path, this order needs to be reversed so that the starting point of the path is the farthest fund source node, passing through the intermediate upstream nodes at each level in sequence, and reaching the target node, forming a forward order of fund flow from the source to the target node. Then, the reversed upstream node sequence, the target node itself, and the nodes in the downstream fund destination chain are spliced ​​together in the forward order of fund flow direction to obtain the abnormal fund flow path.

[0043] In a preferred embodiment, during the backtracking process, if a node with multiple rounds of indirect transaction relationships with an abnormal node is found, such as a node that is reached after more than two hops from an abnormal node, and the cumulative transaction amount between the node and the abnormal node exceeds a preset amount threshold, then the node and its associated path are considered to have a high risk correlation. Even if its number of hops has reached or exceeded a preset depth threshold, it is still included in the scope of abnormal fund flow path to ensure that important large-amount indirect related transactions are not missed. The preset amount threshold can be set according to the actual situation.

[0044] like Figure 2 As shown, the second aspect of this embodiment provides a supply chain finance data anomaly detection system based on transaction relationship graphs, including: The graph construction module is used to acquire supply chain finance transaction data and construct a transaction relationship graph based on the supply chain finance transaction data. In this module, the transaction participants in the supply chain finance transaction data are used as nodes, and the fund transfer relationship between the transaction participants is used as directed edges. The direction of the directed edges is from the fund outflow to the fund inflow. The transaction relationship graph is divided into time steps to obtain a dynamic graph sequence. The encoding representation module is used to perform time-series encoding on the timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence, and obtain the joint node representation based on the time-series encoded timestamp attribute; The anomaly determination module is used to input the joint node representation into three parallel heterogeneous base classifiers to obtain the anomaly probability value corresponding to each heterogeneous base classifier. The three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node. The results output module is used to perform backtracking analysis on abnormal nodes and their associated multi-hop neighbor nodes, trace the upstream source nodes and downstream destination nodes of abnormal nodes along the direction of fund flow, obtain abnormal fund flow paths, and output abnormal transaction detection results based on the abnormal fund flow paths.

[0045] The working process, working details, and technical effects of the supply chain finance data anomaly detection system based on transaction relationship graphs provided in the second aspect of this embodiment can be found in the supply chain finance data anomaly detection method based on transaction relationship graphs described in the first aspect, and will not be repeated here.

[0046] like Figure 3As shown, the third aspect of this embodiment provides a computer device, including a memory, a processor, and a transceiver connected in sequence. The memory stores a computer program, the transceiver sends and receives messages, and the processor reads the computer program to execute the supply chain finance data anomaly detection method based on transaction relationship graphs as described in the first aspect. Specifically, the memory may include, but is not limited to, random access memory (RAM), read-only memory (ROM), flash memory, first-in-first-out (FIFO) memory, and / or first-in-last-out (FILO) memory, etc.; the processor may include, but is not limited to, a microprocessor of the STM32F105 series. Furthermore, the computer device may also include, but is not limited to, a power module, a display screen, and other necessary components.

[0047] The working process, working details and technical effects of the aforementioned computer equipment provided in the third aspect of this embodiment can be found in the supply chain finance data anomaly detection method based on transaction relationship graph described in the first aspect, and will not be repeated here.

[0048] The fourth aspect of this embodiment provides a computer-readable storage medium, wherein the computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the supply chain finance data anomaly detection method based on transaction relationship graphs as described in the first aspect is performed. The computer-readable storage medium refers to a data storage medium, which may include, but is not limited to, floppy disks, optical disks, hard disks, flash memory, USB flash drives, and / or Memory Sticks. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices.

[0049] The working process, working details and technical effects of the aforementioned computer-readable storage medium provided in the fourth aspect of this embodiment can be found in the supply chain finance data anomaly detection method based on transaction relationship graph as described in the first aspect, and will not be repeated here.

[0050] The fifth aspect of this embodiment provides a computer program product, including a computer program or instructions, which, when executed by a computer, are used to implement the supply chain finance data anomaly detection method based on transaction relationship graphs as described in the first aspect.

[0051] The working process, working details, and technical effects of the aforementioned computer program product provided in this embodiment can be found in the Supply Chain Finance Data Anomaly Detection Method based on Transaction Relationship Graph as described in the first aspect, and will not be repeated here.

[0052] Finally, it should be noted that the above description is merely a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in supply chain finance data based on transaction relationship graphs, characterized in that, include: Acquire supply chain finance transaction data, construct a transaction relationship graph based on the supply chain finance transaction data, wherein the transaction participants in the supply chain finance transaction data are used as nodes, and the fund transfer relationship between the transaction participants is used as directed edges, wherein the direction of the directed edges is from the fund outflow to the fund inflow, and divide the transaction relationship graph into time steps to obtain a dynamic graph sequence. The timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence is temporally encoded, and the joint node representation is obtained based on the temporally encoded timestamp attribute; The joint node representation is input into three parallel heterogeneous base classifiers to obtain the anomaly probability value corresponding to each heterogeneous base classifier. The three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node. A backtracking analysis is performed on the abnormal node and its associated multi-hop neighbor nodes. The upstream source node and downstream destination node of the abnormal node are traced along the direction of fund flow to obtain the abnormal fund flow path. Based on the abnormal fund flow path, the abnormal transaction detection result is output.

2. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 1, characterized in that, Dividing the transaction relationship graph into time steps yields a dynamic graph sequence, including: Associating each directed edge in the transaction relationship graph with the timestamp attribute and transaction amount attribute of the corresponding transaction, a directed dynamic graph with time sequence attributes is obtained; All transaction data is divided into multiple time steps according to a preset time window based on the timestamp attribute of the transaction. Within each time step, a subgraph corresponding to the time window is constructed. All subgraphs are then sorted according to the order of the time steps to obtain a dynamic graph sequence.

3. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 2, characterized in that, Associating each directed edge in the transaction relationship graph with the timestamp and transaction amount attributes of the corresponding transaction, we obtain a directed dynamic graph with temporal attributes, including: Extract the unique identifiers of all transaction participants from the supply chain finance transaction data, use the unique identifiers of all transaction participants as a set of nodes, and extract the fund outflow identifiers and fund inflow identifiers from all transaction records in the supply chain finance transaction data to obtain a set of directed edges. For each transaction record, the fund outflow party corresponding to the transaction participant in the transaction record is taken as the starting node, and the fund inflow party corresponding to the transaction participant in the transaction record is taken as the ending node, so as to construct a directed edge based on the starting node and the ending node; Use the transaction timestamp in the transaction record as the timestamp attribute of the directed edge, and use the transaction amount in the transaction record as the amount attribute of the directed edge. For each transaction record, a directed edge is constructed with the outflow node of the transaction record as the starting node and the inflow node of the transaction record as the ending node. The transaction timestamp in the transaction record is used as the timestamp attribute of the directed edge, and the transaction amount is used as the amount attribute of the directed edge, resulting in a directed dynamic graph with time sequence attributes.

4. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 1, characterized in that, Before dividing the transaction relationship graph into time steps, the following is also included: For each node in the transaction relationship graph, the original statistical features of the node in the transaction records are extracted. The original statistical features include the total number of transactions, the number of fund transfers out, the number of fund transfers in, the cumulative amount transferred out, and the cumulative amount transferred in. The business scope text of each node is segmented into words to obtain multiple word sequences. The document frequency of each word is calculated based on the word sequences of all nodes, and the weight value of each word is calculated based on the document frequency. The words are sorted based on the weight value of each word, and a specified number of words with the highest weight value are selected as keywords. The weight value corresponding to each keyword is used as the text semantic feature of the node. For each node in the transaction relationship graph, extract the transaction frequency sequence and transaction amount sequence of that node within each preset transaction time window, and calculate the difference sequence of transaction frequency and the difference sequence of transaction amount between adjacent transaction time windows, using the difference sequence as a time series statistical feature; The original statistical features, textual semantic features, and temporal statistical features of each node are used as the multimodal features corresponding to the node. In order to perform standardized preprocessing of the transaction relationship graph based on the multimodal features, the preprocessed transaction relationship graph is divided into time steps to obtain a dynamic graph sequence.

5. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 4, characterized in that, The transaction relationship graph is standardized and preprocessed based on multimodal features, including: Missing values ​​are detected in the numerical feature fields of the multimodal features to obtain the missing values ​​and corresponding missing rates of the numerical feature fields. Numerical feature fields with missing rates greater than a first preset threshold and those less than or equal to the first preset threshold are removed. The missing values ​​of the numerical feature fields are filled with the mean of the numerical feature fields. The multimodal features after removal or filling are standardized, and the standardized multimodal features are aligned to ensure that the feature column names and arrangement order are consistent.

6. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 4, characterized in that, The timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence is temporally encoded, and based on the temporally encoded timestamp attribute, the joint node representation is obtained, including: For the current node and its neighboring nodes in the dynamic graph sequence, obtain the current timestamp of the current node at the current time step and the transaction timestamp of the transaction edge between the current node and its neighboring nodes. Based on the current timestamp and the transaction timestamp, calculate the relative time difference of the transaction. Map the relative time difference of transactions to a high-dimensional time embedding vector; The original statistical features, textual semantic features, and temporal statistical features of each node are concatenated to obtain the node static feature vector. The high-dimensional temporal embedding vector and the node static feature vector are then concatenated to obtain the joint node representation.

7. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 1, characterized in that, Three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node, including: Calculate the arithmetic mean of the anomaly probabilities corresponding to the three base classifiers, and use the arithmetic mean as the fused anomaly probability value. Based on the comparison between the preset probability value and the fusion anomaly probability value, if the fusion anomaly probability value is greater than the preset probability value, the corresponding node is determined to be an abnormal node; otherwise, it is determined to be a normal node.

8. The method for detecting anomalies in supply chain finance data based on transaction relationship graphs according to claim 1, characterized in that, A backtracking analysis is performed on the abnormal node and its associated multi-hop neighbor nodes. By tracing the upstream source node and downstream destination node of the abnormal node along the direction of fund flow, the abnormal fund flow path is obtained, including: The abnormal node is used as the starting node, and backtracking is performed along the incoming edge direction of the directed edge to obtain all first-order upstream nodes that directly transfer funds to the starting node. Then, backtracking is continued along the incoming edge direction of the first-order upstream nodes to obtain second-order upstream nodes, until the backtracking depth reaches the preset first backtracking depth threshold, thus obtaining the upstream fund traceability chain. Based on the starting node, trace along the outgoing edge of the directed edge to obtain all first-order downstream nodes from which funds are directly transferred out of the starting node. Then, continue tracing along the outgoing edge of the first-order downstream nodes to obtain second-order downstream nodes, until the tracing depth reaches the preset second backtracking depth threshold, thus obtaining the downstream fund destination chain. Arrange the nodes in the upstream fund traceability chain in reverse order of fund flow direction, and then splice them with the nodes in the target node and the downstream fund destination chain arranged in order of fund flow direction to obtain the abnormal fund flow path from the upstream fund source node to the downstream fund destination node.

9. A supply chain finance data anomaly detection system based on transaction relationship graphs, used to implement the method according to any one of claims 1 to 8, characterized in that, include: The graph construction module is used to acquire supply chain finance transaction data and construct a transaction relationship graph based on the supply chain finance transaction data. In this module, the transaction participants in the supply chain finance transaction data are used as nodes, and the fund transfer relationship between the transaction participants is used as directed edges. The direction of the directed edges is from the fund outflow to the fund inflow. The transaction relationship graph is divided into time steps to obtain a dynamic graph sequence. The encoding representation module is used to perform time-series encoding on the timestamp attribute of the transaction corresponding to each directed edge in the dynamic graph sequence, and obtain the joint node representation based on the time-series encoded timestamp attribute; The anomaly determination module is used to input the joint node representation into three parallel heterogeneous base classifiers to obtain the anomaly probability value corresponding to each heterogeneous base classifier. The three anomaly probability values ​​are fused based on a preset fusion strategy to obtain a fused anomaly probability value. When the fused anomaly probability value exceeds a preset threshold, the corresponding node is determined to be an anomaly node. The results output module is used to perform backtracking analysis on abnormal nodes and their associated multi-hop neighbor nodes, trace the upstream source nodes and downstream destination nodes of abnormal nodes along the direction of fund flow, obtain abnormal fund flow paths, and output abnormal transaction detection results based on the abnormal fund flow paths.

10. A computer device, characterized in that, The device includes a memory, a processor, and a transceiver that are sequentially and communicatively connected. The memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the supply chain finance data anomaly detection method based on transaction relationship graphs as described in any one of claims 1 to 8.

Images