Digital bank monitoring method and system based on model stability dynamic correction

Abstract

The application belongs to the technical field of financial data processing, and particularly relates to a digital bank monitoring method and system based on model stability dynamic correction. The method comprises the following steps: acquiring payment abnormal data and credit approval data; constructing an interaction intensity matrix and determining a coupling relationship value according to a time series decomposition result and an approval time delay; constructing a business relationship graph and performing path propagation analysis according to the interaction intensity matrix and the coupling relationship value to obtain a risk path result; clustering payment abnormal nodes in the risk path to obtain a chain effect quantitative value; determining a model stability according to the coupling relationship value, the risk path result and the chain effect quantitative value, and acquiring expansion attribute data for correction when the model stability is lower than a preset threshold; and verifying and outputting a risk alarm according to a risk priority sequence and in combination with historical business data. The application can improve the timeliness, stability and accuracy of cross-business risk identification.

Description

Technical Field

[0001] This application belongs to the field of financial data processing technology, specifically a digital bank monitoring method and system based on dynamic correction of model stability. Background Technology

[0002] As banking operations continue to evolve towards online, intelligent, and platform-based models, data coupling between account transfers, payment settlements, credit approvals, and risk control is constantly strengthening. The generation, transfer, evaluation, and management of digital assets are increasingly reliant on stable and continuous monitoring capabilities. For financial institutions, the monitoring system not only affects business processing efficiency but also directly impacts the timeliness of risk identification, asset security boundaries, and service continuity.

[0003] In existing technologies, common solutions often focus on monitoring single business indicators, fixed rule thresholds, or localized anomalies. While they can detect explicit faults, they struggle to identify the cross-stage transmission impact of payment anomalies on the approval process. Especially during periods of fluctuating business load, adjustments to approval strategies, channel switching, or changes in account behavior, existing monitoring models typically lack the ability to adaptively correct for changes in business relationships. This often leads to problems such as delayed risk path identification, a coexistence of false positives and false negatives, and inaccurate assessment of the scope of anomaly impact. Due to the lack of combined utilization of multi-business interactions and historical verification results, existing solutions often fail to provide continuous, stable, and traceable monitoring and assessment of potential cascading risks. Summary of the Invention

[0004] To address the above issues, this application provides a digital bank monitoring method and system based on dynamic correction of model stability, which is used to at least solve the problem of how to accurately identify cross-business chain risks between payment anomalies and credit approval in digital banks and to dynamically correct them after business changes.

[0005] To achieve the above objectives, the technical solution adopted in this application is as follows: Firstly, this application provides a digital bank monitoring method based on dynamic correction of model stability, the method comprising: Obtain payment anomaly data and credit approval data; An interaction strength matrix is ​​constructed based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data, and the coupling relationship values ​​are determined. A business relationship graph is constructed based on the interaction strength matrix and coupling relationship values, and path propagation analysis is performed to obtain risk path results; Clustering of payment anomaly nodes in the risk path results yields a quantitative value of the chain reaction. The model stability is determined based on the coupling relationship value, risk path results, and cascading effect quantification value. If the model stability is below a preset threshold, acquire extended attribute data to correct coupling relationship values ​​and risk path results; The risk priority sequence is determined based on the corrected coupling relationship value, risk path results, and cascading impact quantification value. It is then verified using historical business data, and a risk alert is output if the verification results exceed the preset standard.

[0006] In one possible implementation, an interaction strength matrix is ​​constructed based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data. This includes: performing time series decomposition on payment anomaly data to obtain trend components and seasonal components; calculating correlation coefficients based on trend components, seasonal components, and the approval delay of credit approval data; and determining matrix elements in the interaction strength matrix based on the correlation coefficients and interaction frequency.

[0007] In one possible implementation, determining the coupling relationship value includes: aggregating the status of payment anomaly data and credit approval data according to the monitoring time window to obtain business status units; and determining the coupling relationship value based on the matrix elements of the business status units in the interaction intensity matrix and the business transmission relationship reflected by the approval delay.

[0008] In one possible implementation, a business relationship graph is constructed based on the interaction strength matrix and coupling relationship values, and path propagation analysis is performed to obtain risk path results. This includes: constructing a business relationship graph with business state units as nodes and coupling relationship values ​​as edge weights; performing path propagation analysis based on the business relationship graph to obtain the propagation score of each propagation path; and identifying propagation paths with propagation scores higher than a preset path threshold as risk path results.

[0009] In one possible implementation, payment anomaly nodes in the risk path results are clustered to obtain a cascading impact quantification value. This includes: extracting the transaction amount fluctuation characteristics, abnormal transaction frequency, payment retry count, and approval delay lag characteristics corresponding to the payment anomaly nodes; clustering the transaction amount fluctuation characteristics, abnormal transaction frequency, payment retry count, and approval delay lag characteristics; determining high-risk interaction points based on the degree of deviation of the cluster center, the degree of dispersion within the group, and the proportion of abnormal samples; and determining the cascading impact quantification value based on the propagation level of the high-risk interaction points, the number of reachable nodes, and the cumulative value of the weights of each edge in the path.

[0010] In one possible implementation, model stability is determined based on coupling relationship values, risk path results, and cascading effect quantification values. This includes: determining the coupling relationship fluctuation, risk path change, cluster center drift, and validation bias relative to historical monitoring periods. The validation bias indicates the degree of difference between the risk path results of the current monitoring period and the validation results corresponding to historical business data. The model stability is then calculated by comprehensively considering the coupling relationship fluctuation, risk path change, cluster center drift, and validation bias.

[0011] In one possible implementation, when the model stability is below a preset threshold, extended attribute data is obtained, and coupling relationship values ​​and risk path results are corrected. This includes: extracting account attributes, device attributes, channel attributes, and approval context attributes to obtain extended attribute data; constructing an extended interaction strength matrix based on the extended attribute data; correcting coupling relationship values ​​and business relationship diagrams based on the extended interaction strength matrix; and determining risk path results based on the corrected business relationship diagrams.

[0012] In one possible implementation, the risk priority sequence is determined based on the modified coupling relationship value, risk path results, and cascading impact quantification value, including: calculating the impact intensity value of each risk item based on multiple risk items corresponding to the risk path results, combined with the coupling relationship value and cascading impact quantification value; and sorting the risk items according to their impact intensity values ​​to obtain the risk priority sequence.

[0013] In one possible implementation, verification is combined with historical business data, including: determining the risk items to be verified and the verification time window based on the risk priority sequence; determining the credit approval delay offset of the risk items to be verified within the verification time window based on historical business data; and outputting a risk alarm if the credit approval delay offset exceeds a preset standard.

[0014] Secondly, this application provides a digital bank monitoring system based on dynamic model stability correction, used to implement a digital bank monitoring method based on dynamic model stability correction. The system includes: The data acquisition module is used to acquire payment anomaly data and credit approval data; The coupling construction module is used to construct an interaction strength matrix based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data, and to determine the coupling relationship value; The path analysis module is used to construct a business relationship graph based on the interaction strength matrix and coupling relationship values, and to perform path propagation analysis to obtain risk path results. The clustering and quantification module is used to cluster payment anomaly nodes in the risk path results to obtain the quantification value of the chain effect. The stability correction module is used to determine the model stability based on the coupling relationship value, risk path results, and cascading effect quantification value, and to obtain extended attribute data to correct the coupling relationship value and risk path results when the model stability is lower than a preset threshold. The verification alarm module is used to determine the risk priority sequence based on the corrected coupling relationship value, risk path result and chain impact quantification value, and to verify it in combination with historical business data. If the verification result exceeds the preset standard, a risk alarm will be output.

[0015] Compared with existing technologies, the advantages and beneficial effects of this application are as follows: By modeling the correlation between payment anomaly data and credit approval data, a structured expression of cross-business interaction relationships is realized, which can transform isolated anomalies into analyzable correlation links; By constructing a business relationship graph based on the interaction strength matrix and coupling relationship values, the propagation relationship between the payment link and the approval link is explicitly depicted, which facilitates the identification of the risk transmission direction and the scope of impact. By clustering payment anomaly nodes in the risk path, high-risk anomaly groups can be identified in a centralized manner, which helps to distinguish between occasional anomalies and persistent anomalies. By introducing a quantified value of chain effects, a comprehensive characterization of the depth, scope, and intensity of abnormal propagation is achieved, thereby improving the completeness of the basis for risk ranking. By determining the model stability based on coupling relationship values, risk path results, and chain effect quantification values, dynamic judgment of the consistency and reliability of monitoring results is achieved, avoiding long-term solidification of the monitoring model; By introducing extended attribute data and correcting coupling relationship values ​​and risk path results when the model stability is below a preset threshold, an adaptive correction function for business changes is achieved. By combining historical business data for verification, a secondary confirmation function is achieved before risk alerts are output, reducing the probability of false alarms and enhancing the interpretability of alert results. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the method described in this application; Figure 2 This is a block diagram of the module composition of the system in this application. Detailed Implementation

[0017] To enable those skilled in the art to better understand the technical solution, the present application will be described in detail below with reference to the embodiments. The description in this section is only exemplary and explanatory, and should not be used to limit the scope of protection of the present application in any way.

[0018] like Figure 1As shown, a digital bank monitoring method based on dynamic model stability correction is proposed, which includes: Obtain payment anomaly data and credit approval data; In this embodiment, payment anomaly data and credit approval data are derived from digital banking business logs, transaction records, and approval process records. During execution, data from the payment and approval chains are first extracted and correlated according to a unified business identifier, and then time alignment is completed according to a unified time benchmark, forming a comparable data set within the same monitoring period. Payment anomaly data includes at least event records corresponding to payment failures, duplicate deductions, abnormal refunds, transaction interruptions, and sudden increases in latency. Credit approval data includes at least process records corresponding to approval applications, approval time, approval rejections, manual review, and approval results. After extraction, missing fields, duplicate records, and obviously abnormal formats are cleaned up, and the amount, status, and time fields are standardized to generate payment anomaly sequences and credit approval sequences. These two types of sequences are written into the monitoring data cache as input for constructing the interaction strength matrix and determining coupling relationship values.

[0019] An interaction strength matrix is ​​constructed based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data, and the coupling relationship values ​​are determined. In this embodiment, after payment anomaly data and credit approval data enter the monitoring engine, the engine aligns the two types of data using a unified time benchmark. The payment anomaly data is organized into a sequence of anomaly events arranged continuously by time, and the credit approval data is organized into a sequence of approval delays arranged continuously by the approval process. The monitoring engine performs time series decomposition on the anomaly event sequences to obtain a trend component representing long-term changes and a seasonal component representing cyclical fluctuations. Based on the correlation between the trend component, seasonal component, and approval delay sequence, the monitoring engine generates an interaction strength matrix. Then, combining the distribution of matrix elements in the interaction strength matrix and the business transmission relationship reflected by the approval delays, it determines the coupling relationship value between the payment link and the approval link. The interaction strength matrix and coupling relationship value are written to the monitoring status area of ​​the current monitoring cycle for subsequent business relationship diagram construction and risk path identification.

[0020] An interaction strength matrix is ​​constructed based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data. This includes: performing time series decomposition on payment anomaly data to obtain trend components and seasonal components; calculating correlation coefficients based on trend components, seasonal components, and the approval delay of credit approval data; and determining matrix elements in the interaction strength matrix based on correlation coefficients and interaction frequency.

[0021] In one embodiment, this section adds time alignment rules, correlation calculation methods, and matrix element generation rules in the process of constructing the interaction intensity matrix. These rules are used to limit the interaction intensity matrix to be not a direct counting result of the original logs, but a structured expression of the correlation between abnormal payment fluctuations and approval delay response.

[0022] In practice, the monitoring engine associates and pairs payment anomaly data and credit approval data based on business number, account identifier, transaction serial number, and approval order number, retaining only data pairs falling within the same monitoring time window. If a payment anomaly record lacks transaction time, business number, or anomaly status identifier, the corresponding record is marked as invalid and removed from the current calculation batch. Similarly, if a credit approval record lacks approval initiation time, approval completion time, or approval result identifier, the corresponding record is also excluded from this round of matrix construction. Valid payment anomaly data are sampled at minute or hourly intervals to form an anomaly intensity sequence. This sequence can be obtained from one or more of the following statistics: number of anomalies, percentage of anomaly amounts, number of failed retries, and number of anomaly status occurrences. The monitoring engine performs time series decomposition on the anomaly intensity sequence, extracting long-term changes that are continuously rising or falling as trend components, extracting recurring periodic fluctuations as seasonal components, and retaining discrete disturbances as residual components. These residual components are used to identify occasional spikes and format anomalies and do not participate in matrix element generation, preventing short-term anomalies from amplifying the associated results. Credit approval data is used to calculate approval delay within the same monitoring time window. The approval delay can be the total duration from application to approval completion, or it can be calculated separately for the pre-approval stage, risk control review stage, and manual review stage, and then summarized.

[0023] The monitoring engine uses the median historical approval time as the search center, comparing the consistency of changes in trend components, seasonal components, and approval delays point by point within a preset lag range. The preset lag range is determined based on the average completion time of historical approval processes, typically set to one to three times the average completion time. If multiple lag points simultaneously meet the correlation criteria, the lag point with the highest correlation and the highest frequency of recurrence within the continuous monitoring period is selected as the effective propagation lag.

[0024] Interaction frequency is defined as the number of times payment anomalies and approval delay anomalies occur simultaneously within the same monitoring time window. The interaction frequency threshold is determined based on the quantile statistics of the past thirty monitoring periods. The monitoring engine performs unified dimensional processing on the correlation degree and interaction frequency, and generates matrix elements according to fixed combination rules. The combination rules preserve the correlation direction and superimpose the combined influence of correlation degree and interaction frequency. The larger the matrix element, the stronger the interaction between payment anomaly fluctuations and approval delay changes; a matrix element close to zero indicates a lack of stable interaction between the two types of data. After all matrix elements are determined, the monitoring engine forms an interaction strength matrix and writes the interaction strength matrix into the status cache of the current monitoring period.

[0025] Determining the coupling relationship value includes: aggregating the status of payment anomaly data and credit approval data according to the monitoring time window to obtain business status units; and determining the coupling relationship value based on the matrix elements of the business status units in the interaction strength matrix and the business transmission relationship reflected by the approval delay.

[0026] In one embodiment, this section adds a state aggregation caliber, a business state unit composition method, and a business transmission relationship judgment logic in the process of determining the coupling relationship value. This is used to limit the coupling relationship value to not directly use a single matrix element in the interaction strength matrix, but to obtain a comprehensive relationship quantity based on time window aggregation and business transmission judgment.

[0027] In practice, the monitoring engine aggregates the status of payment anomaly data and credit approval data according to monitoring time windows. The length of the monitoring time window is determined based on the load cycle of digital banking business; it can be set to five to thirty minutes in high-frequency payment business scenarios, and one hour to one working day in scenarios with longer approval processing spans. Within each monitoring time window, the monitoring engine jointly merges the payment link status and approval link status around the same business number, the same account identifier, or the same customer identifier to form a business status unit. The business status unit includes at least payment anomaly status, approval delay status, interaction frequency status, and time window identifier. Among them, the payment anomaly status is used to characterize the anomaly level of the payment link within the current window, the approval delay status is used to characterize the duration change level of the approval link, and the interaction frequency status is used to characterize the activity level of the co-occurrence of payment anomalies and approval delays. The monitoring engine reads the matrix elements of the business status unit in the interaction intensity matrix and determines the coupling relationship value by combining the business transmission relationship reflected by the approval delay.

[0028] Business transmission relationships are determined based on three aspects: first, whether the payment anomaly occurred earlier than the approval delay rise time; second, whether there is a common business identifier, common account identifier, or common approval context between the payment anomaly record and the approval record; and third, whether the approval delay falls back within the preset recovery range after the payment anomaly disappears. When all three conditions are met, the business transmission relationship is determined to be a strong transmission relationship; when two conditions are met, it is determined to be a medium transmission relationship; when only one condition is met, it is determined to be a weak transmission relationship; when none are met, a valid transmission relationship is not established. When a matrix element reaches the interaction threshold and the business transmission relationship is strong, the monitoring engine raises the coupling relationship value between the corresponding business state units to a high coupling level; when the matrix element is in the middle range and the business transmission relationship is medium, the coupling relationship value remains at a medium coupling level; when the matrix element is low or only a weak transmission relationship occurs, the coupling relationship value drops to a low coupling level; when the matrix element is below the minimum interaction threshold, the coupling relationship value is directly recorded as no coupling.

[0029] To avoid coupling determination deviations caused by occasional anomalies in a single window, the monitoring engine also checks the continuity of coupling relationship values ​​within adjacent monitoring time windows. If the same business status unit maintains the same coupling level across multiple consecutive monitoring time windows, this coupling level is used as the final coupling relationship value for the current monitoring period. If the coupling level fluctuates significantly within adjacent windows, the coupling level of the most recent window is used as the basis, combined with the coupling level of the previous window, for a smooth update to generate a stable output coupling relationship value. The determined coupling relationship value is written into the business status mapping table for use in subsequent business relationship graph construction phases.

[0030] A business relationship graph is constructed based on the interaction strength matrix and coupling relationship values, and path propagation analysis is performed to obtain risk path results; In this embodiment, the monitoring engine reads the interaction strength matrix and coupling relationship values, and constructs a business relationship graph according to the business state units formed within the current monitoring period. Nodes in the business relationship graph represent the payment link status and the credit approval link status, while edges represent the transmission relationships between business state units, with edge weights based on the coupling relationship values. The monitoring engine performs path propagation analysis along the direction from payment anomalies to approval anomalies in the business relationship graph, obtaining propagation scores for each propagation path, and identifying propagation paths with scores higher than the path threshold as risk path results. Risk path results are written to the risk path cache for subsequent processing in payment anomaly node clustering and cascading impact quantification.

[0031] Based on the interaction strength matrix and coupling relationship values, a business relationship graph is constructed and path propagation analysis is performed to obtain risk path results, including: constructing a business relationship graph with business state units as nodes and coupling relationship values ​​as edge weights; performing path propagation analysis based on the business relationship graph to obtain the propagation score of each propagation path; and identifying propagation paths with propagation scores higher than a preset path threshold as risk path results.

[0032] In one embodiment, this section adds node generation rules, edge establishment rules, propagation score formation methods, and path threshold setting methods during the business relationship graph construction process. These are used to limit the risk path results to be effective propagation paths that meet the requirements of business transmission relationships and propagation strength, rather than arbitrary connected paths.

[0033] In practice, the monitoring engine reads all business status units from the business status mapping table and sorts them by business number, account identifier, and monitoring time window. Each business status unit generates a graph node, and the node content includes at least a node identifier, business type, anomaly level, time window position, and matrix element position. The node identifier is used to uniquely locate the node, the business type is used to distinguish between payment-side nodes and approval-side nodes, the anomaly level is used to reflect the degree of anomaly of the current status unit, the time window position is used to limit the propagation direction, and the matrix element position is used to trace the source of interaction between nodes.

[0034] The monitoring engine establishes directed edges between nodes based on coupling relationship values. If a valid coupling relationship exists between the payment-side node and the approval-side node, and the payment anomaly occurs before the approval delay change time, a directed edge is established between them, pointing from the payment-side node to the approval-side node. If the time sequence cannot be confirmed, or the coupling relationship value is below the edge establishment threshold, no propagation edge is established, and only the association record is retained. The edge establishment threshold is determined based on the distribution of edge weights corresponding to historically confirmed risk paths, and corrected by combining the quantile distribution of coupling relationship values ​​within the current monitoring period. Edge attributes include at least edge weight, propagation duration, and interaction frequency. Propagation duration reflects the time span by which a node influences subsequent nodes, and interaction frequency reflects the activity level of the edge within the current monitoring period.

[0035] After the business relationship graph is constructed, the monitoring engine uses payment-side nodes whose anomaly levels reach the starting threshold as the propagation starting point. The starting threshold is determined based on the anomaly level distribution of payment anomaly nodes corresponding to historically confirmed risk events, and corrected by the quantile distribution of payment anomaly levels within the current monitoring period. Subsequent nodes are searched layer by layer along directed edges, and the node sequence, edge sequence, and cumulative propagation duration of each candidate path are recorded. The propagation score is determined based on the cumulative weights of each edge in the path, the continuity of node anomaly levels, and the match between the cumulative propagation duration and the allowed propagation duration. Higher edge weights, more continuous anomaly levels, and a cumulative propagation duration closer to the historical effective propagation duration range result in a higher propagation score. The minimum retention threshold is determined based on the lower quantile of the edge weights corresponding to historically effective risk paths, and the maximum allowed propagation duration is determined based on the historical average completion time of approval processes and the average duration of payment anomalies. If, during the search process, the time order is reversed, the node type jumps back, the edge weight is lower than the minimum retention threshold, or the cumulative propagation time exceeds the maximum allowed propagation time, the current path will stop expanding and be removed from the candidate set. The path threshold is determined based on the distribution of propagation scores of paths corresponding to historically confirmed risk events. The lower quantile of the propagation scores of historically valid risk paths can be used as the lower limit for screening, or the average interval of the propagation scores of stable risk paths over several recent monitoring periods can be used as the screening basis.

[0036] After the monitoring engine calculates the propagation score for all candidate paths, it identifies propagation paths with a propagation score higher than the path threshold and whose endpoint is an approval anomaly node as risk paths. Propagation paths whose propagation score does not reach the path threshold, or whose endpoint is not an approval anomaly node, are not included in the risk path results. Risk path results include at least the path identifier, starting node, ending node, propagation node sequence, propagation score, and cumulative propagation duration, and are written to the risk path cache.

[0037] Clustering of payment anomaly nodes in the risk path results yields a quantitative value of the chain reaction. In this embodiment, after the risk path results are generated, the monitoring engine extracts payment anomaly nodes from the results and constructs anomaly feature sets around each node. The anomaly feature sets include at least transaction amount fluctuation characteristics, abnormal transaction frequency, payment retries, and approval delay characteristics. The monitoring engine clusters the payment anomaly nodes based on the anomaly feature sets, resulting in multiple anomaly node groups. The monitoring engine identifies high-risk interaction points by combining the center deviation, intra-group dispersion, and anomaly sample proportion of each anomaly node group. Then, based on the propagation level of the high-risk interaction point in the risk path, the number of reachable nodes, and the cumulative weights of each edge in the path, a cascading impact quantification value is generated. This cascading impact quantification value is written to the impact assessment cache for subsequent model stability determination and risk priority ranking.

[0038] Clustering of payment anomaly nodes in the risk path results yields a quantified value of the cascading impact, including: extracting transaction amount fluctuation characteristics, abnormal transaction frequency, payment retry count, and approval delay lag characteristics corresponding to the payment anomaly nodes; clustering these characteristics into groups; identifying high-risk interaction points based on the degree of deviation of cluster centers, the degree of dispersion within groups, and the proportion of anomaly samples; and determining the quantified value of the cascading impact based on the propagation level of the high-risk interaction points, the number of reachable nodes, and the cumulative value of the weights of each edge in the path.

[0039] In one embodiment, this section adds abnormal feature extraction criteria, clustering grouping methods, high-risk interaction point identification rules, and chain effect quantification value generation rules to limit payment abnormal nodes from being roughly grouped based on a single transaction abnormality, but rather forming calculable risk impact units based on transaction fluctuations, abnormal activity levels, and cross-business lag relationships.

[0040] In practice, the monitoring engine reads all risk path results from the risk path cache and locates abnormal payment nodes along each risk path. Each abnormal payment node corresponds to a set of transaction records and a set of approval-related records. Transaction amount fluctuation characteristics are used to reflect the deviation of abnormal transaction amounts from a benchmark amount within the current monitoring time window. The benchmark amount can be the average or median transaction amount of the same account, the same business type, or the same payment scenario over a historical stable period. Abnormal transaction frequency reflects the number of times abnormal events such as payment failures, duplicate deductions, abnormal refunds, and transaction interruptions occur within the current monitoring time window. Payment retries reflect the number of times the same transaction serial number or the same business order number is repeatedly initiated within a short period of time.

[0041] The approval delay lag feature reflects the time interval and duration of the increased approval delay after a payment anomaly occurs. The monitoring engine cleans up missing values, duplicate records, and time-conflicting records before feature extraction. When the transaction amount field is missing, the corresponding node does not participate in the amount fluctuation calculation, but it is still included in the abnormal transaction frequency and payment retry statistics. When the approval record lacks the approval initiation time or approval completion time, the corresponding node does not participate in the approval delay lag feature calculation.

[0042] After all features are extracted, the monitoring engine performs uniform dimensionality processing on each feature to avoid direct impact of differences in transaction amount magnitude and order of magnitude on the grouping results. Dimensional processing can employ segmented normalization, with the normalization interval determined based on the distribution range of each feature over the past thirty monitoring periods. The monitoring engine then performs clustering based on the processed feature set. Clustering can use K-means clustering, with the number of clusters determined based on the silhouette coefficient, the degree of inter-group difference, or the distribution of historical risk samples. Alternatively, a pre-set grouping upper limit can be used and adaptively adjusted based on the current number of nodes.

[0043] After grouping, the monitoring engine calculates the cluster center deviation, intra-group dispersion, and abnormal sample ratio for each group. Cluster center deviation reflects the level of deviation of the overall abnormal pattern of the current group relative to the normal payment pattern. Specifically, the monitoring engine extracts payment node samples that have not entered the risk path and have remained in a normal state within a historical stable monitoring period, forming a reference center for normal payment nodes. Then, based on the average feature position of all abnormal payment nodes within the current group in terms of transaction amount fluctuation characteristics, abnormal transaction frequency, payment retry count, and approval delay lag characteristics, a group center is formed, and the cluster center deviation is determined based on the distance between the group center and the normal payment node reference center. Intra-group dispersion reflects the level of consistency among abnormal payment nodes within the same group. Specifically, the monitoring engine compares the deviation of each abnormal payment node within a group from the group center and statistically analyzes the distribution range of features within the group; the more concentrated the nodes within a group, the lower the intra-group dispersion; the greater the difference between nodes within a group, the higher the intra-group dispersion. The abnormal sample ratio reflects the concentration of high-abnormality nodes within the current group. In practice, the monitoring engine marks each payment anomaly node in the group with an anomaly level based on the severity of the transaction failure, the density of payment retry, the deviation of the abnormal amount, and the impact of the approval delay. The proportion of abnormal samples is determined by the ratio of the number of nodes with high anomaly levels to the total number of nodes in the group.

[0044] After calculating the three indicators, the monitoring engine compares the cluster center deviation, intra-group dispersion, and abnormal sample proportion with the deviation threshold, dispersion threshold, and proportion threshold, respectively. The deviation threshold limits the minimum deviation of the group center from the normal payment pattern; the dispersion threshold limits the maximum allowable fluctuation range of the characteristic distribution within the group; and the proportion threshold limits the minimum concentration of high-anomaly nodes. Each threshold can be determined based on historically confirmed risk event samples or dynamically set using quantile values ​​in conjunction with the current business load level. When the cluster center deviation exceeds the deviation threshold, the intra-group dispersion is below the dispersion threshold, and the abnormal sample proportion exceeds the proportion threshold, the monitoring engine classifies the current group as a high-risk group and identifies the payment anomaly node in the current group that is closest to the group center and has the highest propagation intensity in the risk path as a high-risk interaction point. If multiple payment anomaly nodes meet the conditions within the same group, the priority order of the high-risk interaction points is determined based on the propagation level, the number of reachable nodes, and the cumulative value of the weights of each edge in the path. In this way, the clustering results not only reflect the distribution characteristics of payment anomaly nodes but also provide a stable and consistent high-risk node foundation for the subsequent generation of cascading impact quantification values.

[0045] The model stability is determined based on the coupling relationship value, risk path results, and cascading effect quantification value. In this embodiment, the monitoring engine reads the coupling relationship value, risk path result, and chain effect quantification value of the current monitoring period, and retrieves the corresponding data saved in historical monitoring periods to generate coupling relationship fluctuation, risk path change, cluster center drift, and verification deviation. The monitoring engine determines the model stability based on the comprehensive result of the four types of quantities. In specific execution, the monitoring engine first performs unified dimension processing on the four types of quantities to bring results from different sources and of different orders of magnitude into the same judgment range, and then generates a comprehensive stability evaluation result according to a pre-set weight combination rule. The weight combination rule is jointly determined based on historical confirmed risk event samples, historical stable monitoring period samples, and the current business load level, and is used to reflect the degree of influence of different basic quantities on stability judgment. Coupling relationship fluctuation and risk path change are used to reflect whether the business association structure has changed significantly, cluster center drift is used to reflect whether the payment anomaly pattern deviates from the historical stable pattern, and verification deviation is used to reflect the consistency between the current identification result and the historical verification conclusion. The monitoring engine maps the comprehensive stability evaluation result to high stability level, medium stability level, and low stability level, and outputs the model stability based on the mapping result. When all four variables are in the low volatility range, the model stability remains high; when any two variables enter the medium-to-high volatility range, the model stability drops to the middle range; when three or more variables enter the high volatility range, or when the validation deviation alone reaches the warning limit, the model stability drops to low. Model stability characterizes the degree of stability of risk identification results within the current monitoring period relative to historical monitoring periods. The lower the model stability, the more significant the deviation between the current risk identification results and historical stable patterns; the higher the model stability, the stronger the consistency between the current risk identification results and historical stable patterns. Model stability is written to the stability cache for subsequent dynamic correction processing.

[0046] The model stability is determined based on the coupling relationship value, risk path results, and cascading effect quantification value. This includes: determining the coupling relationship fluctuation, risk path change, cluster center drift, and validation deviation of the current monitoring period relative to historical monitoring periods. The validation deviation is used to indicate the degree of difference between the risk path results of the current monitoring period and the validation results corresponding to historical business data. The model stability is obtained by comprehensively calculating the coupling relationship fluctuation, risk path change, cluster center drift, and validation deviation.

[0047] In one embodiment, this section adds four types of basic quantity generation rules, unified dimension rules, comprehensive judgment rules, and stability threshold setting basis in the model stability determination process. These rules are used to limit the model stability to be a comprehensive representation of the overall identification status of the current monitoring period, rather than a direct judgment result of a single indicator.

[0048] In practice, the monitoring engine reads all coupling relationship values ​​for the current monitoring period from the coupling status mapping table and extracts historical coupling relationship values ​​corresponding to the same business number, account identifier, or approval link from historical monitoring periods. Coupling relationship fluctuation reflects the magnitude of change in the current coupling relationship value relative to historical coupling relationship values. If the same business unit maintains a high coupling level within consecutive historical monitoring periods, but drops to a low coupling level or no coupling state in the current monitoring period, the corresponding coupling relationship fluctuation increases; if the current coupling relationship value only changes slightly within the historical fluctuation range, the corresponding coupling relationship fluctuation remains low.

[0049] The risk path change measure reflects the degree of structural change in the current risk path outcome relative to historical risk path outcomes. The monitoring engine compares the starting point, ending point, propagation level, cumulative propagation duration, and propagation score of each path. When a new propagation chain not previously seen appears in the current monitoring period, or when an existing high-frequency propagation chain disappears, the corresponding risk path change measure increases. When the current risk path outcome and historical risk path outcome only show tolerable fluctuations in local node positions or propagation duration, the corresponding risk path change measure remains low. The cluster center drift measure reflects the degree of center shift of the current payment anomaly node clustering results relative to historical clustering results. The monitoring engine reads the center position of each anomaly node group in the current monitoring period and compares it with the center position of the corresponding group in historical stable monitoring periods. The larger the center position shift, the more the current payment anomaly pattern deviates from the historical stable pattern, and the higher the cluster center drift measure. The verification deviation measure reflects the degree of difference between the current risk path outcome and the corresponding verification results of historical business data. Verification results can come from historical approval delay anomaly confirmation records, manual review records, or automatic alarm confirmation records. When high-risk paths identified in the current monitoring cycle lack corresponding support in historical verification samples, or when previously confirmed effective propagation patterns are not identified in the current monitoring cycle, the verification bias increases.

[0050] After determining the four basic quantities, the monitoring engine performs unified dimensional processing on these quantities, enabling results from different sources and of different orders of magnitude to enter the same comprehensive judgment process. Unified dimensional processing can employ a segmented mapping method, mapping each basic quantity to a preset stable interval. The boundaries of each interval are determined based on the distribution range of samples from historical stable monitoring periods. When the fluctuations in coupling relationships, changes in risk paths, cluster center drift, and validation bias are all in the low interval, the model stability is determined to be at a high stability level; when any two basic quantities enter the medium-high interval, the model stability is determined to be at a medium stability level; when three or more basic quantities enter the high interval, or when the validation bias alone reaches the warning upper limit, the model stability is determined to be at a low stability level.

[0051] To avoid misjudgments caused by occasional anomalies in a single monitoring period, the monitoring engine also checks the continuous changes in model stability within adjacent monitoring periods. If the model stability decreases in the current monitoring period, but remains stable in the preceding and following monitoring periods, the current model stability is output according to the gradual decrease rule; if the model stability decreases in multiple consecutive monitoring periods, the current model stability is output according to the actual judgment result. The stability threshold is determined based on the distribution of model stability in historical stable monitoring periods. It can be triggered by using the lower boundary of the model stability of historical stable samples or by using the low quantile value of the stable interval of recent multiple monitoring periods. When the model stability is lower than the stability threshold, the monitoring engine marks the current monitoring period as a period to be corrected and writes the coupling relationship value, risk path result, and chain effect quantification value into the correction input area; when the model stability is not lower than the stability threshold, the monitoring engine marks the current monitoring period as a stable period and directly writes the model stability result into the risk ranking processing area.

[0052] If the model stability is below a preset threshold, acquire extended attribute data to correct coupling relationship values ​​and risk path results; In this embodiment, after obtaining the model stability, the monitoring engine compares the model stability with a stability threshold. When the model stability is lower than the stability threshold, it is determined that the existing coupling relationship values ​​and risk path results within the current monitoring period are insufficient to reflect actual business changes. The monitoring engine then extracts extended attribute data from real-time business records and approval process records. This extended attribute data supplements the associated information beyond payment anomaly data and credit approval data, and includes at least account attributes, device attributes, channel attributes, and approval context attributes. The monitoring engine constructs an extended interaction strength matrix based on the extended attribute data, updates the coupling relationship values ​​and business relationship graph based on the extended interaction strength matrix, and then re-executes path propagation analysis based on the updated business relationship graph to obtain the corrected risk path results. The corrected coupling relationship values ​​and risk path results are written to the correction result cache for subsequent risk priority sequence determination and risk alarm triggering processing.

[0053] If the model stability is below a preset threshold, acquire extended attribute data and correct coupling relationship values ​​and risk path results, including: extracting account attributes, device attributes, channel attributes, and approval context attributes to obtain extended attribute data; constructing an extended interaction strength matrix based on the extended attribute data; correcting coupling relationship values ​​and business relationship diagrams based on the extended interaction strength matrix; and determining risk path results based on the corrected business relationship diagrams.

[0054] In one embodiment, this section adds criteria for triggering a stability threshold, an expanded range for extracting attribute data, rules for constructing an expanded interaction strength matrix, methods for updating coupling relationship values, and conditions for recalculating risk paths. These are used to ensure that dynamic correction does not simply overwrite the original results, but rather completes secondary identification by supplementing richer correlation information when the business state deviates significantly. Specifically, during execution, the monitoring engine first reads the model stability for the current monitoring period from the stability cache, and then reads the model stability distribution corresponding to stable monitoring samples from historical monitoring periods. The stability threshold can be the lower quantile of the model stability of historical stable monitoring samples, or it can be determined in conjunction with the business-side requirements for allowed false positive and false negative rates.

[0055] When the current model stability falls below the stability threshold, the monitoring engine marks the current monitoring period as a period to be corrected and initiates the extended attribute extraction process. Account attributes reflect the identity level, account status, and historical risk labels of transaction accounts, credit accounts, or customer accounts; device attributes reflect terminal device identification, device changes, and device access stability; channel attributes reflect payment entry points, application entry points, access channels, and channel switching; and approval context attributes reflect approval processes, risk control review status, manual intervention records, and the location of the approval chain. The extraction scope of extended attribute data primarily focuses on accounts, transactions, and approval records that have entered the risk path results or have business connections with the risk path results within the current monitoring period, avoiding irrelevant attributes from entering the correction process.

[0056] After the monitoring engine completes the extraction of extended attributes, it normalizes the attribute values. Attribute fields with excessively high missing rates, unverifiable sources, or no corresponding relationship with the current business number are removed and do not participate in subsequent matrix construction. The extended interaction strength matrix adds an attribute association dimension to the original interaction strength matrix to reflect the interaction strength between payment anomaly nodes and approval nodes in terms of account consistency, device co-occurrence, channel switching, and approval context continuity. When account attributes and device attributes repeatedly co-occur within multiple monitoring periods, the corresponding matrix elements are enhanced according to the enhancement rules; when channel attributes change frequently and occur synchronously with approval delay anomalies, the corresponding matrix elements are enhanced according to the risk-weighted rules; when approval context attributes indicate that abnormal transactions have entered the same review stage or the same return stage multiple times, the corresponding matrix elements are enhanced according to the path correction rules.

[0057] After the matrix update, the monitoring engine recalculates the coupling relationship values ​​between business state units based on the extended interaction strength matrix. When both the original coupling relationship value and the extended interaction strength matrix point to a high coupling level, the corresponding edge weight is directly increased; when the original coupling relationship value is low but the extended interaction strength matrix shows a stable attribute association, the corresponding edge weight is increased to compensate for the intermediate level; when the extended attribute data cannot support the original high coupling relationship, the corresponding edge weight is processed according to the weight reduction rule. The business relationship graph is updated synchronously with the edge weights, adding node connections that meet the edge establishment conditions and deleting weak connection edges that have failed and have not reappeared for multiple consecutive monitoring periods.

[0058] After the business relationship graph is updated, the monitoring engine re-executes the path propagation analysis. The propagation starting point is still the node whose payment-side anomaly level reaches the starting threshold, and the propagation endpoint is still limited to the approval-side anomaly node. However, the calculation of the propagation score will introduce the influence of extended attribute associations. After recalculation, paths whose propagation scores reach the path threshold are retained as the corrected risk path results. Old paths whose propagation scores drop below the path threshold are removed from the risk path set, and newly emerging propagation paths that meet the path threshold are added to the risk path set. After the correction process is completed, the monitoring engine writes the corrected coupling relationship values, the updated business relationship graph, and the corrected risk path results to the correction result cache, and retains the difference records before and after the correction for subsequent verification result comparison and risk priority adjustment.

[0059] The risk priority sequence is determined based on the corrected coupling relationship value, risk path results, and cascading impact quantification value. It is then verified using historical business data, and a risk alert is output if the verification results exceed the preset standard.

[0060] In this embodiment, the monitoring engine reads the coupling relationship value, risk path result, and cascading impact quantification value within the current monitoring period, and generates multiple risk entries based on the risk path result. Each risk entry corresponds to at least one valid path propagating from the payment anomaly node to the approval anomaly node. The monitoring engine combines the coupling relationship value and the cascading impact quantification value to determine the impact intensity value of each risk entry, and forms a risk priority sequence according to the impact intensity value from high to low. After the risk priority sequence is generated, the monitoring engine retrieves historical business data for verification. The verification content includes at least the credit approval delay offset corresponding to the risk entry to be verified within the verification time window. When the credit approval delay offset exceeds a preset standard, the monitoring engine outputs a risk alarm and marks the corresponding risk entry as a confirmed risk.

[0061] In practice, the monitoring engine reads all risk path results within the current monitoring period from the risk path cache and generates a risk entry based on each risk path that meets the path threshold requirements. For complex propagation paths containing multiple payment anomaly nodes and multiple approval anomaly nodes, the monitoring engine can also split the same path into multiple sub-risk entries according to different propagation levels or endpoint approval nodes, so that each risk entry corresponds to a clear risk source, propagation link, and affected approval object. Each risk entry includes at least the path identifier, starting payment anomaly node, ending approval anomaly node, propagation node sequence, propagation level, cumulative propagation duration, propagation score, cumulative weight of each side in the path, and corresponding quantified value of chain reaction impact. Path identifiers are used to uniquely mark risk entries. The starting payment anomaly node indicates the source of risk propagation, the ending approval anomaly node indicates the approval stage where the risk ultimately affects the system, the propagation node sequence records the specific transmission process of the risk in the business relationship diagram, the propagation level reflects the depth of risk diffusion, the cumulative propagation duration reflects the time span from the payment side to the approval side, and the cumulative value of the propagation score and the weights of each edge in the path reflects the propagation strength and correlation strength of the risk entry. After forming risk entries, the monitoring engine also checks whether there are duplicate endpoints, duplicate path segments, or duplicate anomaly sources among different risk entries. If multiple risk entries correspond to the same ending approval anomaly node and originate from the same payment anomaly node, the risk entry with the highest propagation score and the largest chain impact quantification value is determined as the main risk entry, and the remaining risk entries are retained as related risk entries. If multiple risk entries only overlap in local path segments, but the starting payment anomaly node or the ending approval anomaly node is different, each risk entry is retained and independently participates in the subsequent impact strength value calculation. The resulting multiple risk entries can transform the risk path results into sortable, comparable, and verifiable risk units, providing direct input for subsequent calculation of the impact intensity value of each risk entry by combining coupling relationship values ​​and chain effect quantification values.

[0062] In one embodiment, this section adds a risk entry formation method, impact intensity value calculation rules, sorting criteria, and risk priority sequence output format to limit the risk priority sequence to not being a simple list of risk path results, but a comprehensive sorting result of risk propagation intensity, propagation scope, and business impact.

[0063] In practice, the monitoring engine reads all risk path results from the risk path cache and generates a risk entry for each risk path based on its path identifier. A risk entry includes at least the path identifier, the starting payment anomaly node, the ending approval anomaly node, the propagation level, the cumulative propagation duration, the propagation score, the quantified value of the chain reaction impact, and the coupling relationship value range. The starting payment anomaly node identifies the source of the risk, the ending approval anomaly node identifies the actual affected approval stage, the propagation level reflects the depth of risk diffusion in the business relationship diagram, and the cumulative propagation duration reflects the time span from the payment side to the approval side. The monitoring engine generates an impact strength value for each risk entry based on the impact strength mapping rules. When the coupling relationship value reaches a high coupling level, the corresponding risk entry receives a high base strength; when the coupling relationship value is at a medium coupling level, the corresponding risk entry receives a medium base strength; when the coupling relationship value is at a low coupling level, only the basic marker is retained, and it is not prioritized for processing.

[0064] When the cascading impact quantification value reaches a high range, the monitoring engine increases the base strength; when the cascading impact quantification value is in a low range, only the original base strength is retained. Risk entries with deep propagation levels, high propagation scores, and a large number of abnormal endpoint approval nodes in the risk path results indicate that the risk can continue to spread along multi-level business chains, and the corresponding impact strength value continues to increase. Risk entries with shallow propagation levels, average propagation scores, or only affecting a single approval node have their impact strength values ​​kept in a low range. To prevent occasional anomalies from entering the high-priority area within a single monitoring period, the monitoring engine also checks whether the same path identifier persists in adjacent monitoring periods.

[0065] Risk items that recur over multiple monitoring periods and whose impact intensity value continuously increases are marked as persistent risk items; risk items that appear only once and do not reappear subsequently are marked as temporary risk items. Persistent risk items take precedence over temporary risk items during sorting. During sorting, the monitoring engine sorts items from highest to lowest impact intensity value; if impact intensity values ​​are the same, they are sorted from highest to lowest cascading impact quantification value; if cascading impact quantification values ​​are still the same, they are sorted from shortest to longest cumulative propagation time, ensuring that risk items that impact the approval chain more quickly are prioritized. A risk priority sequence is generated after sorting. The risk priority sequence includes at least the risk item identifier, sorting position, impact intensity value, risk level, and verification flag. Risk levels can be divided into high-risk, medium-risk, and low-risk levels, with level boundaries determined based on the distribution of impact intensity values ​​corresponding to historically confirmed risk events. The risk priority sequence is written to the sorting result cache, providing direct input for subsequent historical business data verification and risk alarm triggering.

[0066] Verification is performed using historical business data, including: determining the risk items to be verified and the verification time window based on the risk priority sequence; determining the credit approval delay offset of the risk items to be verified within the verification time window based on historical business data; and outputting a risk alert if the credit approval delay offset exceeds the preset standard.

[0067] In one embodiment, this section adds a historical business data verification process, a verification time window determination method, a credit approval delay offset formation method, a preset standard setting basis, and post-verification handling rules to limit the risk alarm output to be triggered not only based on the sorting result, but also to complete a secondary confirmation in combination with historical business data.

[0068] In practice, the monitoring engine reads the risk priority sequence from the sorting result cache and selects risk items to be verified according to risk level and sorting position. The risk items to be verified can be all high-risk items or risk items ranked at the top of the sorting list. The verification time window is determined jointly based on the cumulative propagation time of the risk path and the historical processing cycle of the approval process. The cumulative propagation time of the risk path reflects the actual time taken for the risk to be transmitted from the payment side to the approval side, while the historical processing cycle of the approval process reflects the completion range of similar approval transactions under normal conditions. The monitoring engine uses the occurrence time of the risk path as the starting point as the baseline, adding an approval process buffer space to the cumulative propagation time to generate the verification time window. The buffer space is determined based on the duration fluctuation range of similar approval transactions within a stable period. Historical business data includes at least historical payment records, historical approval logs, manual review records, and approval result records. Within the verification time window, the monitoring engine extracts the approval records corresponding to the risk items to be verified and determines the credit approval delay offset.

[0069] The credit approval delay offset reflects the deviation of the actual processing time of the current risk item's corresponding approval process from the historical normal processing time. The historical normal processing time can be the average or median processing time for the same business type, approval stage, and customer level within a stable monitoring period. When the current approval time is significantly higher than the historical normal processing time, it indicates that the payment anomaly has had a substantial impact on the approval process. A preset standard is used to determine whether this impact meets the risk alarm triggering conditions. The preset standard can be set based on the lower boundary of the approval delay offset in historically confirmed risk events, or based on the business side's tolerance upper limit for approval timeliness. When the credit approval delay offset exceeds the preset standard, the monitoring engine outputs a risk alarm. The risk alarm includes at least the risk item identifier, corresponding business number, approval stage identifier, verification time window, credit approval delay offset, and risk level.

[0070] When the credit approval delay offset does not exceed the preset standard, the monitoring engine marks the corresponding risk item as an item to be observed and lowers its priority level in subsequent monitoring cycles. If the same item to be observed repeatedly enters the verification stage in multiple consecutive monitoring cycles, and the credit approval delay offset continues to approach the preset standard, the monitoring engine upgrades it to a key observation item and performs verification with priority in the next monitoring cycle. After the verification process is completed, the monitoring engine writes the verification results to the verification result cache and writes the risk items that have triggered risk alarms to the alarm record table for subsequent model stability calculations, review of correction results, and manual handling.

[0071] like Figure 2 As shown, a digital bank monitoring system based on dynamic model stability correction is used to implement a digital bank monitoring method based on dynamic model stability correction. The system includes: The data acquisition module is used to acquire payment anomaly data and credit approval data. The data acquisition module consists of a network communication unit, an interface control circuit, a data buffer, and a processor. The network communication unit is used to receive business data streams sent by the payment system and the credit approval system. The interface control circuit is used to complete the access control and protocol conversion of different data sources. The data buffer is used to temporarily store the received payment anomaly data and credit approval data. The processor is used to perform time alignment, field sorting, and validity checks on the received data.

[0072] The coupling construction module is used to construct an interaction strength matrix based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data, and to determine the coupling relationship value. The coupling construction module consists of a processor, a computing acceleration unit, a memory, and a matrix generation circuit. The processor is used to perform time series decomposition and approval delay extraction, the computing acceleration unit is used to complete the correlation strength calculation and parallel data processing, the memory is used to store the decomposition results, intermediate statistical results, and historical window data, and the matrix generation circuit is used to generate the interaction strength matrix and output the coupling relationship value.

[0073] The path analysis module is used to construct a business relationship graph based on the interaction strength matrix and coupling relationship values, and to perform path propagation analysis to obtain risk path results. The path analysis module consists of a graph computing processor, a graph storage unit, an edge weight loading circuit, and a path search circuit. The graph storage unit is used to store node information and edge information in the business relationship graph. The edge weight loading circuit is used to write the coupling relationship values ​​into the corresponding edge weights. The graph computing processor is used to organize graph structure calculations. The path search circuit is used to perform path propagation analysis and output risk path results.

[0074] The clustering and quantification module is used to cluster payment anomaly nodes in the risk path results to obtain quantified values ​​of cascading impact. The clustering and quantification module consists of a feature extraction circuit, a clustering processor, a parameter storage, and a quantification calculation circuit. The feature extraction circuit is used to extract the transaction amount fluctuation characteristics, abnormal transaction frequency, payment retry count, and approval delay lag characteristics corresponding to the payment anomaly nodes. The clustering processor is used to cluster and group the abnormal features. The parameter storage is used to store the clustering threshold and grouping parameters. The quantification calculation circuit is used to generate quantified values ​​of cascading impact based on the propagation level of high-risk interaction points, the number of reachable nodes, and the cumulative edge weight results.

[0075] The stability correction module is used to determine the model stability based on the coupling relationship value, risk path result, and cascading effect quantification value. When the model stability is lower than a preset threshold, it acquires extended attribute data to correct the coupling relationship value and risk path result. The stability correction module consists of a state comparison circuit, an attribute acquisition unit, an update processor, and a result write-back circuit. The state comparison circuit is used to determine the model stability based on the coupling relationship value, risk path result, and cascading effect quantification value. The attribute acquisition unit is used to acquire extended attribute data when the model stability is lower than a preset threshold. The update processor is used to correct the coupling relationship value and risk path result based on the extended attribute data. The result write-back circuit is used to write the correction result to the business relationship graph and the cache.

[0076] The verification and alarm module determines the risk priority sequence based on the corrected coupling relationship value, risk path result, and cascading impact quantification value, and verifies it using historical business data. It outputs a risk alarm if the verification result exceeds a preset standard. The module consists of a sorting processor, a historical data storage unit, a verification comparison circuit, and an alarm output unit. The sorting processor determines the risk priority sequence based on the corrected coupling relationship value, risk path result, and cascading impact quantification value. The historical data storage unit stores historical business data. The verification comparison circuit performs verification based on the historical business data and determines whether the verification result exceeds a preset standard. The alarm output unit outputs a risk alarm when trigger conditions are met.

[0077] It should be noted that, in this document, the terms "comprising," "including," and any other variations are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Specific examples have been used in this document to illustrate the principles and implementation methods of the technical solutions of this application. The above examples are only for the purpose of helping to understand the methods and core ideas of this application. The above descriptions are merely preferred embodiments of this application. It should be pointed out that, due to the limitations of written expression and the objective existence of infinite specific structures, those skilled in the art can make several improvements, modifications, or changes without departing from the principles of this application, and can also combine the above technical features in an appropriate manner; these improvements, modifications, changes, or combinations, or the direct application of the concept and technical solutions of this application to other situations without modification, should all be considered within the scope of protection of this application.

Claims

1. A digital bank monitoring method based on dynamic correction of model stability, characterized in that, The method includes: Obtain payment anomaly data and credit approval data; An interaction strength matrix is ​​constructed based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data, and the coupling relationship values ​​are determined. Based on the interaction strength matrix and the coupling relationship values, a business relationship graph is constructed and path propagation analysis is performed to obtain risk path results; Clustering of payment anomaly nodes in the risk path results yields a quantified value of the chain reaction effect; The model stability is determined based on the coupling relationship value, the risk path result, and the cascading effect quantification value. If the model stability is lower than a preset threshold, obtain extended attribute data and correct the coupling relationship value and the risk path result; The risk priority sequence is determined based on the corrected coupling relationship value, the risk path result, and the chain effect quantification value. It is then verified using historical business data, and a risk alert is output if the verification result exceeds the preset standard.

2. The method according to claim 1, characterized in that, The step of constructing an interaction strength matrix based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data includes: The payment anomaly data is decomposed into time series components to obtain trend components and seasonal components; The correlation coefficient is calculated based on the trend component, the seasonal component, and the approval delay of the credit approval data; The matrix elements in the interaction intensity matrix are determined based on the correlation coefficient and the interaction frequency.

3. The method according to claim 2, characterized in that, The determination of the coupling relationship value includes: The payment anomaly data and the credit approval data are aggregated according to the monitoring time window to obtain a business status unit; The coupling relationship value is determined based on the matrix elements of the business status unit in the interaction intensity matrix and the business transmission relationship reflected by the approval delay.

4. The method according to claim 3, characterized in that, The step of constructing a business relationship graph based on the interaction strength matrix and the coupling relationship values, and performing path propagation analysis to obtain risk path results includes: The business relationship graph is constructed using the business status unit as a node and the coupling relationship value as the edge weight. Based on the business relationship diagram, path propagation analysis is performed to obtain the propagation score for each propagation path; The propagation paths with propagation scores higher than a preset path threshold are identified as the risk path results.

5. The method according to claim 4, characterized in that, The process of clustering payment anomaly nodes in the risk path results to obtain quantified cascading impact values ​​includes: Extract the transaction amount fluctuation characteristics, abnormal transaction frequency, payment retry count, and approval delay characteristics corresponding to the payment anomaly nodes; Clustering and grouping are performed on the transaction amount fluctuation characteristics, the frequency of abnormal transactions, the number of payment retries, and the approval delay characteristics. High-risk interaction points are determined based on the degree of deviation of cluster centers, the degree of dispersion within groups, and the proportion of outlier samples. The cascading effect quantification value is determined based on the propagation level of the high-risk interaction point, the number of reachable nodes, and the cumulative value of the weights of each edge in the path.

6. The method according to claim 5, characterized in that, The step of determining model stability based on the coupling relationship value, the risk path result, and the cascading effect quantification value includes: The coupling relationship fluctuation, risk path change, cluster center drift, and verification deviation of the current monitoring period relative to the historical monitoring period are determined. The verification deviation is used to indicate the degree of difference between the risk path results of the current monitoring period and the verification results corresponding to the historical business data. The model stability is obtained by comprehensively calculating the coupling relationship fluctuation, the risk path change, the cluster center drift, and the validation bias.

7. The method according to claim 6, characterized in that, When the model stability is lower than a preset threshold, the step of acquiring extended attribute data and correcting the coupling relationship value and the risk path result includes: Extract account attributes, device attributes, channel attributes, and approval context attributes to obtain the extended attribute data; Construct an extended interaction strength matrix based on the extended attribute data; The coupling relationship value and the business relationship graph are corrected based on the extended interaction strength matrix; The risk path results are determined based on the revised business relationship diagram.

8. The method according to claim 1, characterized in that, The step of determining the risk priority sequence based on the coupling relationship value, the risk path result, and the cascading effect quantification value includes: Based on the multiple risk items corresponding to the risk path results, and combining the coupling relationship value and the chain effect quantification value, the influence intensity value of each risk item is calculated; The risk priority sequence is obtained by sorting the risk items according to their impact intensity values.

9. The method according to claim 8, characterized in that, The verification based on historical business data includes: The risk items to be verified and the verification time window are determined based on the risk priority sequence. Based on the historical business data, determine the credit approval delay offset of the risk item to be verified within the verification time window; If the credit approval delay offset exceeds the preset standard, the risk alert will be output.

10. A digital bank monitoring system based on dynamic model stability correction, used to implement the digital bank monitoring method based on dynamic model stability correction as described in any one of claims 1-9, characterized in that, The system includes: The data acquisition module is used to acquire payment anomaly data and credit approval data; The coupling construction module is used to construct an interaction strength matrix based on the time series decomposition results of payment anomaly data and the approval delay of credit approval data, and to determine the coupling relationship value; The path analysis module is used to construct a business relationship graph based on the interaction strength matrix and the coupling relationship value, and to perform path propagation analysis to obtain risk path results. The clustering and quantification module is used to cluster payment anomaly nodes in the risk path results to obtain quantified values ​​of chain effects. The stability correction module is used to determine the model stability based on the coupling relationship value, the risk path result, and the chain effect quantification value, and to obtain extended attribute data to correct the coupling relationship value and the risk path result when the model stability is lower than a preset threshold. The verification alarm module is used to determine the risk priority sequence based on the coupling relationship value, the risk path result, and the chain effect quantification value, and to verify it in conjunction with historical business data. If the verification result exceeds the preset standard, a risk alarm is output.

Images