Method, apparatus, device, medium and product for processing abnormal virtual resource link

Abstract

Embodiments of the present application provide a processing method and device for abnormal virtual resource link, equipment, medium and product, relating to the field of artificial intelligence or financial technology. Virtual resource flow data and interaction behavior flow data of a target account within a preset period are obtained, multi-source fusion is performed to construct global multi-modal joint features, an abnormal probability is output based on decoding processing of an abnormal identification model, a risk label is generated in combination with a determination result, and a corresponding risk disposal scheme is further matched and executed. The method solves the problem of inaccurate identification of abnormal virtual resource links, improves the identification capability of cross-day interval abnormal links by associating virtual resource flow data with user interaction behavior, and further improves the accuracy and timeliness of identification of hidden and long-period abnormal virtual resource links.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence or fintech, and in particular to a method, apparatus, device, medium, and product for processing abnormal virtual resource links. Background Technology

[0002] With the rapid development of fintech, the full online and mobile transformation of banking services has become a mainstream trend. Bank account transaction data is exhibiting massive growth and increasing complexity, and abnormal virtual resource links within accounts have become a core risk threatening the security and compliant operation of banks' virtual resources.

[0003] Existing technologies for identifying virtual resource links mainly fall into two categories: the first is fixed rule identification, which intercepts abnormal transactions by setting preset thresholds and logical conditions (such as virtual resource retention time, transaction frequency, etc.); the second is deep learning time series model identification, such as a classification model built on a recurrent neural network, which identifies anomalies only by recognizing virtual resource transaction data.

[0004] However, both of the above identification schemes have obvious drawbacks. For fixed rule identification methods, the reliance on human experience to set thresholds and judgment logic results in weak generalization ability and difficulty in identifying virtual resource anomaly links with strong concealment and multiple condition combinations. For deep learning time series models, existing models only use transaction data such as virtual resource flow to model, which is not effective in identifying complete abnormal virtual resource links. Summary of the Invention

[0005] This application provides methods, apparatus, devices, media, and products for processing abnormal virtual resource links, in order to solve the problem of inaccurate identification of abnormal virtual resource links.

[0006] In a first aspect, embodiments of this application provide a method for processing abnormal virtual resource links, including:

[0007] Obtain historical virtual resource stream data and historical interaction behavior stream data corresponding to the target account within a preset time period;

[0008] Based on the historical virtual resource flow data and historical interaction behavior flow data, a global multimodal joint feature vector is determined;

[0009] The global multimodal joint feature vector is decoded by the decoder in the anomaly detection model to obtain the anomaly probability score of the target account. The anomaly probability score of the target account is then judged to obtain the target risk label of the target account. The anomaly probability score is used to indicate the probability that the target account has an abnormal virtual resource link within the preset time period.

[0010] Determine the anomaly handling plan for the target risk label and execute the anomaly handling plan.

[0011] In one possible implementation, determining the global multimodal joint feature vector based on the historical virtual resource stream data and the historical interaction behavior stream data includes:

[0012] Determine the virtual resource stream temporal feature vector of the historical virtual resource stream data, and determine the interaction behavior temporal feature vector of the historical interaction behavior stream data;

[0013] The virtual resource stream temporal feature vector and the interaction behavior temporal feature vector are concatenated to obtain the global multimodal joint feature vector.

[0014] In one possible implementation, the anomaly identification model further includes: a virtual resource flow encoder, wherein the historical virtual resource flow data includes: multiple first sampling days, and daily virtual resource flow data corresponding to each first sampling day, and the step of determining the virtual resource flow time-series feature vector of the historical virtual resource flow data includes:

[0015] Feature extraction processing is performed on the daily virtual resource flow data corresponding to each of the first sampling days to obtain the daily virtual resource sample data corresponding to each of the first sampling days.

[0016] The daily virtual resource sample data corresponding to each of the first sampling days is subjected to vector transformation processing to obtain the daily sample feature vector corresponding to each of the first sampling days.

[0017] The daily sample feature vectors corresponding to each of the first sampling days are subjected to extreme value standardization to obtain the daily virtual resource flow feature vectors corresponding to each of the first sampling days.

[0018] The virtual resource stream encoder performs time-series encoding on the single-day virtual resource stream feature vector corresponding to each of the first sampling days to obtain the virtual resource stream time-series feature vector.

[0019] In one possible implementation, the step of performing time-series encoding processing on the daily virtual resource flow feature vectors corresponding to each of the first sampling days through the virtual resource flow encoder to obtain the virtual resource flow time-series feature vectors includes:

[0020] Assign a first position number to the single-day virtual resource flow feature vector corresponding to each of the first sampling days;

[0021] Based on the first position number of each of the single-day virtual resource flow feature vectors, determine the first position encoding vector corresponding to each of the single-day virtual resource flow feature vectors;

[0022] The first fused structural feature is obtained by adding and fusing the feature vectors of each day's virtual resource flow with the first position encoding vectors corresponding to each day's virtual resource flow feature vector.

[0023] The first fusion structure feature is subjected to multi-layer encoding processing to obtain the virtual resource stream temporal feature vector.

[0024] In one possible implementation, the anomaly identification model further includes: a behavior flow encoder, wherein the historical interaction behavior flow data includes: multiple second sampling days, and daily behavior data corresponding to each second sampling day, and the step of determining the interaction behavior temporal feature vector of the historical interaction behavior flow data includes:

[0025] Feature extraction processing is performed on the daily behavioral data corresponding to each of the second sampling days to obtain the daily interaction sample data corresponding to each of the second sampling days;

[0026] The daily interactive sample data corresponding to each of the second sampling days are subjected to vector transformation processing to obtain the daily interactive sample feature vector corresponding to each of the second sampling days.

[0027] The daily interaction sample feature vectors corresponding to each of the second sampling days are subjected to extreme value standardization to obtain the daily behavior feature vectors corresponding to each of the second sampling days.

[0028] The behavior flow encoder performs time-series encoding on the daily behavior feature vectors corresponding to each of the second sampling days to obtain the interaction behavior time-series feature vectors.

[0029] In one possible implementation, the step of performing time-series encoding processing on the daily behavior feature vectors corresponding to each of the second sampling days through the behavior flow encoder to obtain the interaction behavior time-series feature vector includes:

[0030] Assign a second position number to the daily behavior feature vector corresponding to each of the second sampling days;

[0031] Based on the second position number of each of the single-day behavior feature vectors, determine the second position encoding vector of each of the single-day behavior feature vectors;

[0032] The single-day behavior feature vectors are added to and fused with the second position encoding vectors of the single-day behavior feature vectors to obtain the second fused structural feature.

[0033] The second fusion structure feature is subjected to multi-layer encoding processing to obtain the temporal feature vector of the interaction behavior.

[0034] In one possible implementation, the decoder includes: a feedforward neural network layer, a residual connection and normalization layer, a fully connected layer, and an activation layer. The step of decoding the global multimodal joint feature vector through the decoder in the anomaly detection model to obtain the anomaly probability score of the target account includes:

[0035] The global multimodal joint feature vector is input into the feedforward neural network layer to obtain the first feature vector;

[0036] The first feature vector is input into the residual connection and normalization layer to obtain the second feature vector;

[0037] The second feature vector is input into the fully connected layer to obtain a one-dimensional predicted feature value;

[0038] The single-dimensional predicted feature value is input into the activation layer to obtain the anomaly probability score of the target account.

[0039] In one possible implementation, the decoder further includes: a risk assessment layer, wherein the process of assessing the anomaly probability score of the target account to obtain a target risk label for the target account includes:

[0040] The anomaly probability score is input into the risk assessment layer, which compares the anomaly probability score with multiple preset score ranges to obtain the target risk label for the target account.

[0041] Secondly, embodiments of this application provide a processing apparatus for abnormal virtual resource links, comprising:

[0042] The acquisition module is used to acquire historical virtual resource stream data and historical interaction behavior stream data corresponding to the target account within a preset time period;

[0043] The determination module is used to determine a global multimodal joint feature vector based on the historical virtual resource flow data and the historical interaction behavior flow data;

[0044] The processing module is used to decode the global multimodal joint feature vector through the decoder in the anomaly recognition model to obtain the anomaly probability score of the target account, and to judge the anomaly probability score of the target account to obtain the target risk label of the target account; the anomaly probability score is used to indicate the probability that the target account has an abnormal virtual resource link within the preset time period;

[0045] The determining module is also used to determine the anomaly handling scheme for the target risk label;

[0046] The execution module is used to execute the exception handling scheme.

[0047] In one possible implementation, the determining module is further configured to determine the virtual resource stream temporal feature vector of the historical virtual resource stream data and the interaction behavior temporal feature vector of the historical interaction behavior stream data.

[0048] The processing module is specifically used to concatenate the virtual resource stream temporal feature vector with the interaction behavior temporal feature vector to obtain the global multimodal joint feature vector.

[0049] In one possible implementation, the processing module is further configured to perform feature extraction processing on the daily virtual resource flow data corresponding to each of the first sampling days to obtain daily virtual resource sample data corresponding to each of the first sampling days.

[0050] The processing module is further configured to perform vector conversion processing on the daily virtual resource sample data corresponding to each of the first sampling days to obtain the daily sample feature vector corresponding to each of the first sampling days.

[0051] The processing module is further configured to perform extreme value standardization processing on the daily sample feature vector corresponding to each of the first sampling days to obtain the daily virtual resource flow feature vector corresponding to each of the first sampling days.

[0052] The processing module is specifically used to perform time-series encoding processing on the single-day virtual resource stream feature vector corresponding to each of the first sampling days through the virtual resource stream encoder, so as to obtain the virtual resource stream time-series feature vector.

[0053] In one possible implementation, the device further includes: a distribution module;

[0054] The allocation module is used to assign a first position number to the single-day virtual resource flow feature vector corresponding to each of the first sampling days;

[0055] The determining module is further configured to determine the first position encoding vector corresponding to each of the single-day virtual resource flow feature vectors based on the first position number of each single-day virtual resource flow feature vector;

[0056] The processing module is further configured to add and fuse each of the single-day virtual resource flow feature vectors with the first position encoding vector corresponding to each of the single-day virtual resource flow feature vectors to obtain a first fused structure feature;

[0057] The processing module is specifically used to perform multi-layer encoding processing on the first fusion structure features to obtain the virtual resource stream temporal feature vector.

[0058] In one possible implementation, the processing module is further configured to perform feature extraction processing on the daily behavior data corresponding to each of the second sampling days to obtain daily interaction sample data corresponding to each of the second sampling days;

[0059] The processing module is also used to perform vector transformation processing on the daily interactive sample data corresponding to each of the second sampling days to obtain the daily interactive sample feature vector corresponding to each of the second sampling days.

[0060] The processing module is also used to perform extreme value standardization processing on the single-day interactive sample feature vector corresponding to each second sampling day to obtain the single-day behavioral feature vector corresponding to each second sampling day.

[0061] The processing module is specifically used to perform time-series encoding processing on the daily behavior feature vectors corresponding to each of the second sampling days through the behavior flow encoder to obtain the interaction behavior time-series feature vectors.

[0062] In one possible implementation, the allocation module is further configured to allocate a second position number to the daily behavioral feature vector corresponding to each of the second sampling days;

[0063] The determining module is further configured to determine the second position encoding vector of each of the single-day behavior feature vectors based on the second position number of each of the single-day behavior feature vectors;

[0064] The processing module is further configured to add and fuse each of the single-day behavior feature vectors with the second position encoding vector of each of the single-day behavior feature vectors to obtain a second fused structural feature;

[0065] The processing module is specifically used to perform multi-layer encoding processing on the second fusion structure features to obtain the temporal feature vector of the interaction behavior.

[0066] In one possible implementation, the device further includes: an input module;

[0067] The input module is used to input the global multimodal joint feature vector into the feedforward neural network layer to obtain the first feature vector;

[0068] The input module is further configured to input the first feature vector into the residual connection and normalization layer to obtain the second feature vector;

[0069] The input module is further configured to input the second feature vector into the fully connected layer to obtain a one-dimensional predicted feature value;

[0070] The input module is specifically used to input the single-dimensional predicted feature value into the activation layer to obtain the abnormal probability score of the target account.

[0071] In one possible implementation, the input module is specifically used to input the anomaly probability score into the risk assessment layer, and the risk assessment layer compares the anomaly probability score with a plurality of preset score intervals to obtain the target risk label of the target account.

[0072] Thirdly, embodiments of this application provide a processing device for abnormal virtual resource links, including: a memory and a processor;

[0073] The memory stores computer-executed instructions;

[0074] The processor executes computer execution instructions stored in the memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0075] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0076] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0077] The method, apparatus, device, medium, and product for processing abnormal virtual resource links provided in this application's embodiments acquire virtual resource flow data and interaction behavior flow data of a target account within a preset time period. Based on this data, multi-source fusion is performed to construct a global multimodal joint feature. An anomaly probability is output based on the decoder of the anomaly identification model. The target risk label of the target account is determined according to the anomaly probability, and then a corresponding risk management plan is matched and executed. This method solves the problem of inaccurate identification of abnormal virtual resource links. By associating virtual resource flow data with user interaction behavior, it improves the ability to identify cross-day interval abnormal links, thereby improving the accuracy and timeliness of identifying concealed and long-term abnormal virtual resource links. Attached Figure Description

[0078] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0079] Figure 1 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 1 ;

[0080] Figure 2A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 2 ;

[0081] Figure 3 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 3 ;

[0082] Figure 4 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 4 ;

[0083] Figure 5 A schematic diagram of the overall architecture of a method for handling abnormal virtual resource links provided in an embodiment of this application;

[0084] Figure 6 A schematic diagram of the structure for reducing the dimensionality of the input sequence in the convolutional neural network provided in this application;

[0085] Figure 7 A schematic diagram of the structure of the abnormal virtual resource link processing device provided in the embodiments of this application;

[0086] Figure 8 A schematic diagram of the structure of the abnormal virtual resource link processing device provided in the embodiments of this application.

[0087] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0088] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application.

[0089] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0090] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0091] It should be noted that the methods, apparatus, devices, media and products for processing abnormal virtual resource links provided in this application can be used in the fields of artificial intelligence or fintech, or in any field other than artificial intelligence or fintech. The application fields of the methods, apparatus, devices, media and products for processing abnormal virtual resource links in this application are not limited.

[0092] First, the terms used in this application will be explained.

[0093] Rotary Position Embedding (RoPE) is a method that implicitly encodes positional information into a positional representation of a vector by rotating the word embedding vector. This method allows the model to perceive the order and relative distance of sequences during self-attention computation, thereby improving its ability to model long sequences.

[0094] Convolutional Neural Networks (CNNs) are feedforward artificial neural networks with local connectivity and weight sharing characteristics. Their core components include convolutional layers, pooling layers, and fully connected layers. These networks extract and downsample local features from the input data using convolutional kernels to reduce data dimensionality and the number of parameters while preserving key feature information. They are commonly used in tasks such as image recognition and natural language processing, possessing strong local pattern capture capabilities and high computational efficiency.

[0095] Min-Max Normalization, also known as deviation normalization, is a commonly used data normalization method. Its core purpose is to map the raw data in a dataset to a specified interval, usually the [0,1] interval, but other user-defined intervals are also possible.

[0096] With the rapid development of fintech, the full online and mobile transformation of banking services has become a mainstream trend. Bank account transaction data is exhibiting massive growth and increasing complexity, and abnormal virtual resource links within accounts have become a core risk threatening the security and compliant operation of banks' virtual resources.

[0097] Existing technologies for identifying virtual resource links mainly fall into two categories: the first is fixed rule identification, which intercepts abnormal transactions by setting preset thresholds and logical conditions (such as virtual resource retention time, transaction frequency, etc.); the second is deep learning time series model identification, such as a classification model built on a recurrent neural network, which identifies anomalies only by recognizing virtual resource transaction data.

[0098] However, both of the above identification schemes have obvious drawbacks. For fixed rule identification methods, the reliance on human experience to set thresholds and judgment logic results in weak generalization ability and difficulty in identifying virtual resource anomaly links with strong concealment and multiple condition combinations. For deep learning time series models, existing models only use transaction data such as virtual resource flow to model, which is not effective in identifying complete abnormal virtual resource links.

[0099] To address the aforementioned issues, this application provides a method for processing abnormal virtual resource links. This method involves acquiring historical virtual resource flow data and historical interaction behavior flow data corresponding to a target account within a preset time period. A global multimodal joint feature vector is determined based on the information fusion result. This global multimodal joint feature vector is then decoded using a decoder in an anomaly identification model to obtain an anomaly probability score. The anomaly probability score is then judged to obtain a target risk label, and an anomaly handling scheme for the target risk label is determined and executed. This method solves the problem of inaccurate identification of abnormal virtual resource links. By associating virtual resource flow data with user interaction behavior, it improves the ability to identify cross-day interval abnormal links, thereby enhancing the accuracy and timeliness of identifying concealed and long-term abnormal virtual resource links.

[0100] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0101] Figure 1 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 1 ,like Figure 1 As shown, the method includes:

[0102] S101. Obtain the historical virtual resource flow data and historical interaction behavior flow data corresponding to the target account within a preset time period.

[0103] The target account can be a bank account, a payment account, or a virtual resource account associated with the transfer of virtual resources.

[0104] The implementing entity can be a processing server, risk identification gateway, or data processing node connected to the account transaction system deployed in the risk control platform.

[0105] The preset time period can be set as a continuous time window, such as the past 24 hours, the past 72 hours, or a fixed observation window spanning multiple days. After receiving the target account identifier, it can obtain the corresponding data from the relevant data source and perform time correlation processing on the data from different sources.

[0106] Historical virtual resource flow data is used to characterize the virtual resource flow of a target account within a preset time period.

[0107] Historical interaction behavior stream data is used to characterize the changes in the interaction behavior of a target account within the same time period.

[0108] Different acquisition factors have different acquisition methods. When the acquisition factor is historical virtual resource flow data, it can be obtained, for example, by retrieving account transaction records stored in the risk control database or by retrieving account transaction records stored in the business transaction system. When the acquisition factor is historical interactive behavior flow data, it can be obtained, for example, by obtaining operation logs transmitted back by mobile terminals or other devices that have established a communication connection with the risk control platform, or by viewing operation records on the behavior tracking page of the mobile terminal. This application does not impose any special restrictions on this.

[0109] In one possible embodiment, during the process of acquiring historical virtual resource stream data and historical interaction behavior stream data, the relevant data can be collected, organized, cleaned, and time-aligned to form a data sequence corresponding to a preset time period.

[0110] S102. Determine the global multimodal joint feature vector based on historical virtual resource flow data and historical interaction behavior flow data.

[0111] Among them, the local multimodal joint feature vector is used to carry the overall representation after the fusion of historical virtual resource flow data and historical interaction behavior flow data.

[0112] Understandably, when looking at historical virtual resource flow data alone, it can only reflect the changes in virtual resource flow itself, and it is difficult to represent the collaborative relationship between operational actions and virtual resource flow.

[0113] Therefore, by jointly processing historical virtual resource flow data and historical interaction behavior flow data, and then generating a global multimodal joint feature vector, the operation context and virtual resource flow results of the same account in a long observation window can be incorporated into a unified representation.

[0114] In one possible embodiment, historical virtual resource flow data and historical interaction behavior flow data can be jointly modeled based on a unified temporal correlation, and the modeling results can be fused to obtain a global multimodal joint feature vector.

[0115] For example, when a target account exhibits abnormal interaction changes and is accompanied by abnormal virtual resource flows within a certain period of time, the corresponding joint expression can reflect a strong abnormal correlation; when an account exhibits abnormal interaction behavior and abnormal virtual resource flow changes successively within different time periods, the global multimodal joint feature vector can also retain this correlation.

[0116] S103. The global multimodal joint feature vector is decoded by the decoder in the anomaly recognition model to obtain the anomaly probability score of the target account. The anomaly probability score of the target account is judged to obtain the target risk label of the target account. The anomaly probability score is used to indicate the probability that there is an abnormal virtual resource link in the target account within a preset time period.

[0117] The anomaly detection model is used to identify anomalies and assess risks from the global multimodal joint feature vector. It contains at least a decoder, which converts the global multimodal joint feature vector into anomaly probability scores and further outputs target risk labels.

[0118] Understandably, the global multimodal joint feature vector is input into the decoder of the anomaly detection model. The decoder processes the input vector and outputs anomaly probability scores. Subsequently, a judgment is made based on the anomaly probability scores to obtain the target risk label.

[0119] Target risk labels are used to indicate the risk status of a target account within a preset time period and serve as the basis for selecting subsequent anomaly handling solutions. Target risk labels can be discrete labels such as low risk, risk of concern, and high risk, or they can be coded labels corresponding to pre-set policies in the business system. For example, when the decoder outputs a low anomaly probability score, it can be marked as low risk; when the output anomaly probability score is at an intermediate level, it can be marked as risk of concern; and when the output anomaly probability score is high, it can be marked as high risk.

[0120] S104. Determine the anomaly handling plan for the target risk label and execute the anomaly handling plan.

[0121] Among them, the anomaly handling scheme is used to take corresponding actions against the target account based on the target risk label.

[0122] Understandably, once the target risk label is obtained, the corresponding exception handling plan can be determined and the corresponding exception handling operation can be executed.

[0123] If the target risk label is a normal label, the currently submitted virtual resource transaction will be allowed directly.

[0124] If the target risk label is a suspected abnormal label, the currently submitted virtual resource transaction will be allowed, and the account to which the transaction belongs will be added to a preset dynamic observation list. All subsequent interactions and transfers of the account will be continuously tracked, and an early warning work order will be generated simultaneously for risk control personnel to conduct off-site spot checks regularly.

[0125] If the target risk label is a high-risk abnormal label, it means that the model has identified a hidden long-term abnormal chain of operations over multiple days for the account. It can be determined that the currently submitted virtual resource transaction has an immediate risk. Therefore, high-intensity risk control measures will be taken against the risk-triggered transaction, the transaction will be blocked in real time, and a mandatory manual review process will be initiated.

[0126] The abnormal virtual resource link processing method provided in this application embodiment obtains the historical virtual resource flow data and historical interaction behavior flow data corresponding to the target account within a preset time period, and determines the global multimodal joint feature vector based on the two. This method can associate and represent virtual resource change information with account interaction behavior information, thereby enhancing the ability to characterize cross-modal risk features.

[0127] By using the decoder in the anomaly detection model to decode the global multimodal joint feature vector, the anomaly probability score of the target account is obtained. The anomaly probability score is then judged to obtain the target risk label. This can improve the accuracy of identifying long-term, cross-day and hidden anomaly virtual resource links, thereby reducing the risk of false alarms and false negatives.

[0128] By identifying and implementing the anomaly handling plan corresponding to the target risk label, targeted handling of abnormal virtual resource links can be achieved, thereby improving the efficiency and effectiveness of risk response in bank risk control scenarios.

[0129] Figure 2 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 2 ,like Figure 2 As shown, in this embodiment... Figure 1 Based on the embodiments, the method for handling abnormal virtual resource links is described in detail, which includes:

[0130] S201. Obtain the historical virtual resource flow data and historical interaction behavior flow data corresponding to the target account within a preset time period.

[0131] The explanation of step S201 is the same as that in the above embodiments, and will not be repeated here.

[0132] S202. Determine the virtual resource flow time-series feature vector of historical virtual resource flow data, and determine the interaction behavior time-series feature vector of historical interaction behavior flow data.

[0133] The purpose of this step is to extract the corresponding time-series feature vectors from the two types of raw business data: historical virtual resource stream data and historical interaction behavior stream data.

[0134] Understandably, relying solely on virtual resource flow data can only identify explicit anomalies at the virtual resource level, but cannot capture hidden risks at the user operation behavior level. Furthermore, individual interaction behavior data lacks the virtual resource flow link as a basis for risk assessment.

[0135] Therefore, by simultaneously constructing virtual resource flow time-series feature vectors and interactive behavior time-series feature vectors, the long-term fund flow time-series patterns and user operation time-series patterns of the account can be fully preserved, which can provide a basis for subsequent fusion of the two types of vectors to comprehensively assess account risk.

[0136] S203. The virtual resource flow temporal feature vector and the interaction behavior temporal feature vector are concatenated to obtain the global multimodal joint feature vector.

[0137] Understandably, the time-series feature vector of virtual resource flow can only reflect the quantitative pattern of account funds entering and leaving, and the time-series feature vector of interactive behavior can only reflect the user's operational habits. A single vector can only cover information in a single dimension, and it is easy to miss hidden risk clues across dimensions.

[0138] Therefore, by concatenating the virtual resource flow temporal feature vector with the interaction behavior temporal feature vector, a global multimodal joint feature vector is generated. This vector can simultaneously retain all the numerical information of the two types of features, providing an input basis for subsequent anomaly probability score calculation that includes both transaction-side and behavior-side information.

[0139] S204. Input the global multimodal joint feature vector into the feedforward neural network layer to obtain the first feature vector. The decoder includes: a feedforward neural network layer, a residual connection and normalization layer, a fully connected layer, and an activation layer.

[0140] The feedforward neural network layer is used to perform a nonlinear transformation on the global multimodal joint feature vector to generate an intermediate representation suitable for subsequent discrimination. The feedforward neural network layer can be composed of at least one cascaded layer of linear transformation units and nonlinear activation units. The weight parameters and bias parameters of the linear transformation units can be iteratively updated through training samples to make the first feature vector more fully represent the coupling relationship between the abnormal virtual resource links and the interaction behavior. In practical applications, this layer can also be selected from other network structures capable of nonlinear mapping; this application does not limit this choice.

[0141] The residual connection and normalization layer is used to perform residual fusion of the input features and the feedforward transformation results, and to normalize the distribution of the fused features.

[0142] Fully connected layers are used to map two-dimensional or high-dimensional features into one-dimensional predicted feature values.

[0143] The activation layer is used to compress the single-dimensional predicted feature values ​​into a probability interval and output anomaly probability scores.

[0144] The first feature vector is an intermediate representation vector obtained by linear mapping, dimensionality compression and feature selection of the global multimodal joint feature vector through a feedforward neural network layer. This vector inherits all effective risk information in the original joint features and eliminates redundant and irrelevant feature dimensions.

[0145] The purpose of this step is to use a feedforward neural network layer to perform shallow feature extraction and information filtering on the global multimodal joint feature vector, to perform mapping transformation on redundant and irrelevant feature values ​​within the vector, to extract deeper representation information with better risk discrimination, and to generate a first feature vector with optimized and compressed dimensions.

[0146] S205. Input the first feature vector into the residual and connect it to the normalization layer to obtain the second feature vector.

[0147] The second feature vector is an intermediate feature vector output from the first feature vector after residual connection information compensation and layer normalization numerical calibration.

[0148] Understandably, the first feature vector output by the feedforward neural network is subjected to a dual optimization and correction operation. On the one hand, the residual connection is used to superimpose the original first feature vector with the feature transformed by the network, so as to avoid the loss of key risk information related to the flow of virtual resources and interactive behavior of accounts during deep network transmission. On the other hand, the numerical range of each dimension feature inside the vector is unified by layer normalization to eliminate the interference caused by the inconsistency of the scale of different feature indicators. After dual processing, the optimized second feature vector is output.

[0149] S206. Input the second feature vector into the fully connected layer to obtain the single-dimensional predicted feature value.

[0150] Among them, the single-dimensional predicted feature value is a single value output after the multi-dimensional second feature vector is globally weighted and fused by the fully connected layer and the dimension is compressed. It can represent the probability of an account having an abnormal virtual resource link.

[0151] Understandably, by using a fully connected layer to perform global feature fusion and dimensionality compression on the second feature vector after residual normalization optimization, a multi-dimensional vector containing multi-dimensional information such as virtual resource flow and user interaction behavior can be mapped into a single numerical value, completing the conversion from multi-modal features to risk quantification values, and outputting a single-dimensional predictive feature value that can intuitively measure the degree of account anomaly.

[0152] S207. Input the single-dimensional prediction feature value into the activation layer to obtain the abnormal probability score of the target account. The abnormal probability score is used to indicate the probability that there is an abnormal virtual resource link in the target account within a preset time period.

[0153] Understandably, by applying nonlinear mapping constraints to the single-dimensional predicted feature values ​​output by the fully connected layer through the activation layer, the original predicted values ​​without a fixed numerical range are transformed into a standardized anomaly probability score between 0 and 1, quantifying the possibility that the target account will generate an abnormal virtual resource flow link during the preset observation period.

[0154] S208. Input the anomaly probability score into the risk assessment layer. The risk assessment layer compares the anomaly probability score with multiple preset score ranges to obtain the target risk label of the target account. The decoder also includes: the risk assessment layer.

[0155] The purpose of this step is to clarify the risk profile of the target account.

[0156] Understandably, the anomaly probability score is only a quantitative value representing the degree of risk of an abnormal virtual resource link in a target account, and cannot directly issue differentiated risk control actions. However, the risk judgment layer pre-configures multiple sets of non-overlapping probability score intervals. By comparing the anomaly probability score with the threshold of each interval one by one to match the corresponding risk label, the quantitative risk value can be transformed into a business label that can be implemented. This provides a clear basis for subsequent matching and execution of corresponding anomaly handling solutions for different risk labels.

[0157] Optionally, when the score interval includes a first score interval, a second score interval, and a third score interval, this application provides a possible implementation method, including: if the anomaly probability of the target account is within the first score interval, determining the target risk label of the target account as a low-risk label; if the anomaly probability of the target account is within the second score interval, determining the target risk label of the target account as a medium-risk label, wherein all anomaly probability values ​​within the second score interval are greater than all anomaly probability values ​​within the first score interval; if the anomaly probability of the target account is within the third score interval, determining the target risk label of the target account as a high-risk label, wherein all anomaly probability values ​​within the third score interval are greater than all anomaly probability values ​​within the second score interval.

[0158] The first score interval can be [0, 0.2), the second score interval can be [0.2, 0.45), and the third score interval can be [0.45, 1].

[0159] The purpose of this step is to stratify account risk based on the probability of anomalies in the target account and determine the corresponding risk label.

[0160] Understandably, when the anomaly probability of a target account is in the first score range, it means that the virtual resource flow and user operation behavior of the account are highly consistent with the distribution characteristics of normal customer groups. Therefore, the target risk label of the target account can be determined as a low-risk label.

[0161] When the anomaly probability of the target account is in the second score range, it means that the account has some characteristics that deviate from the normal baseline (such as a sudden increase in virtual resource conversion rate for two consecutive days and a slight decrease in page jump depth). However, since the anomaly probability has not yet reached the high-risk standard, the target risk label of the target account can be determined as a medium-risk label.

[0162] When the anomaly probability of the target account is in the third score range, it means that the account has triggered multiple strongly correlated anomaly features at the same time (such as a pulse-like spike in the net outflow of virtual resources on a single day, and an average session duration of less than 15 seconds). Therefore, the target risk label of the target account can be determined to be a high-risk label.

[0163] S209. Determine the anomaly handling plan for the target risk label and execute the anomaly handling plan.

[0164] The explanation of step S209 is the same as that in the above embodiments, and will not be repeated here.

[0165] The method for handling abnormal virtual resource links provided in this application first collects historical virtual resource flow data and historical interaction behavior flow data of the target account within a preset time period. The temporal feature vectors corresponding to the two types of data are extracted and concatenated to generate a global multimodal joint feature vector. Then, the joint feature vector is sent to a decoder containing a feedforward neural network layer, a residual connection and normalization layer, a fully connected layer, an activation layer, and a risk judgment layer. The first feature vector is output by the feedforward network, the second feature vector is obtained by residual normalization, the fully connected layer is mapped to a single-dimensional predicted feature value, and the activation layer is transformed to obtain an abnormal probability score representing the possibility of an abnormal virtual resource link in the account. Then, the risk judgment layer compares the abnormal probability score with a preset score range to output a target risk label. Finally, the abnormal handling plan corresponding to the risk label is matched and the plan is executed.

[0166] This method constructs multimodal joint features by integrating the temporal characteristics of virtual resource circulation and interaction behavior, which can solve the shortcomings of single-dimensional data in easily missing risk clues and inaccurate identification of abnormal virtual resource links. Furthermore, this method can capture both immediate anomalies generated by a single transaction and identify hidden long-term abnormal links formed by operations over multiple days, effectively improving the accuracy of risk identification. This allows for the clear classification of account risk levels, providing a standardized basis for subsequent differentiated risk control procedures.

[0167] Figure 3 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 3 ,like Figure 3 As shown, in cases where the anomaly detection model also includes a virtual resource flow encoder, and the historical virtual resource flow data includes multiple first sampling days, the implementation process for determining the virtual resource flow time-series feature vector of the historical virtual resource flow data is described in detail. This method includes:

[0168] S301. Perform feature extraction processing on the daily virtual resource flow data corresponding to each first sampling day to obtain the daily virtual resource sample data corresponding to each first sampling day.

[0169] Understandably, the original daily virtual resource transaction data only stores scattered detailed records of individual transactions. The data volume is large, the information is complex, and there is no unified indicator dimension, making it impossible to directly carry out vector conversion and model calculation.

[0170] Therefore, by performing feature extraction processing on daily virtual resource transaction data to generate daily virtual resource sample data that summarizes the overall transaction situation of the day, it is possible to filter out worthless detailed information and condense core transaction features.

[0171] S302. Perform vector transformation processing on the daily virtual resource sample data corresponding to each first sampling day to obtain the daily sample feature vector corresponding to each first sampling day.

[0172] Understandably, the daily virtual resource stream sample data is a set of multi-field structured business indicators, which cannot be directly used for various matrix and vector operations such as standardization, rotation transformation, and feature addition and fusion.

[0173] Therefore, by performing vector transformation processing on the daily virtual resource sample data corresponding to each first sampling day, each daily business sample data can be uniformly mapped into a standard vector format with regular dimensions, so that it can adapt to the numerical calculation rules of all subsequent feature processing processes.

[0174] S303. Perform extreme value standardization on the single-day sample feature vector corresponding to each first sampling day to obtain the single-day virtual resource flow feature vector corresponding to each first sampling day.

[0175] Understandably, the feature vector of a single sample contains business metrics that vary greatly in terms of single session duration and the proportion of specific behaviors. When not standardized, large numerical metrics will excessively dominate model calculations, and small numerical features will easily be submerged, interfering with the calculation accuracy of subsequent location coding, feature fusion, and temporal coding.

[0176] Therefore, it is necessary to perform extreme value standardization on the daily sample feature vector to unify the numerical scale of all feature dimensions, avoid the calculation bias caused by the difference in scale, and obtain a scale-balanced daily virtual resource flow feature vector.

[0177] Optionally, this application can express the daily virtual resource flow feature vector corresponding to any sampling day through the following expression, including:

[0178]

[0179] Where t represents day t, it can be understood as a vector of 1 row and 22 columns composed of 22 capital indicators within any sampling day; This represents the feature vector of a single day's virtual resource flow. Indicates the duration of fund retention; Indicates intraday capital turnover rate; ...; This indicates the number of credit inquiries made in the past three months.

[0180] In this step, extreme value normalization can be used to scale and transform the daily sample feature vectors corresponding to each first sampling day, thereby generating the daily virtual resource flow feature vectors corresponding to each first sampling day. After standardization, the values ​​of all feature dimensions within the vector fall within the interval [0, 1].

[0181] For example, Table 1 shows the daily virtual resource flow feature vector table constructed in the embodiments of this application. The table records all daily virtual resource feature indicators corresponding to any sampling day, as shown in Table 1.

[0182]

[0183]

[0184]

[0185]

[0186]

[0187]

[0188]

[0189]

[0190] S304. Using a virtual resource stream encoder, perform time-series encoding on the single-day virtual resource stream feature vector corresponding to each first sampling day to obtain the virtual resource stream time-series feature vector.

[0191] The purpose of this step is to transform the single-day virtual resource flow feature vectors, which are independent of each other and only carry local transaction information for a single day, into virtual resource flow time-series feature vectors that integrate cross-date fund association information from all sampled days.

[0192] Understandably, the feature vectors of each single-day virtual resource flow only store the transaction business and time-series location information of a single sampling day. The vectors are independent of each other and cannot reflect long-term time-series fund linkage behaviors such as step-by-step transfers and cross-period aggregations over multiple days.

[0193] The virtual resource flow encoder can perform correlation operations between different date characteristics, filter redundant transaction information, strengthen the effective cross-day fund correlation, and explore the global time-series flow logic.

[0194] Therefore, by uniformly encoding all single-day virtual resource flow feature vectors using a virtual resource flow encoder, a virtual resource flow time-series feature vector containing multi-day transaction correlation patterns can be obtained.

[0195] Optionally, this application can represent the virtual resource flow temporal feature vector by the following expression, including:

[0196]

[0197] in, The virtual resource flow time-series feature vector is represented by the daily virtual resource flow feature vector corresponding to 30 sampling days. , , … It is composed of 30 rows and 22 columns to form a two-dimensional time series matrix.

[0198] Optionally, this application provides a possible implementation method, including:

[0199] The first step is to assign a first position number to the feature vector of the single-day virtual resource flow corresponding to each first sampling day.

[0200] The first position number is used to mark the position of each daily virtual resource flow feature vector in the overall feature sequence.

[0201] The purpose of this step is to sequentially label each single-day virtual resource flow feature vector obtained from each first sampling day within the sequence, and to clarify the order of each single-day virtual resource flow feature vector in the complete time-series feature sequence.

[0202] It is understandable that the anomaly detection model cannot independently identify the sequence order and temporal relationship of the features of virtual resource flows over multiple days. The position number is a prerequisite for generating the first position encoding vector carrying temporal information. Assigning the first position number can prevent the anomaly detection model from confusing the virtual resource flow features corresponding to different sampling days and ensure that the original temporal sequence information of the multi-day transaction behavior is not lost.

[0203] The second step is to determine the first position encoding vector corresponding to each daily virtual resource flow feature vector based on the first position number of each daily virtual resource flow feature vector.

[0204] The first position encoding vector is a numerical vector generated by rotation transformation based on the first position number corresponding to the feature vector of the daily virtual resource flow, and is used to characterize the arrangement position of the feature vector of the daily virtual resource flow in the time series.

[0205] Understandably, the first position number is in pure numerical form and cannot be directly used in vector operations and feature fusion. Therefore, it is necessary to calculate the rotation angle based on the first position number and perform a rotation transformation on the daily virtual resource flow feature vector to generate a vector with dimension matching and carrying temporal position information, thus obtaining the first position encoding vector corresponding to each daily virtual resource flow feature vector.

[0206] The third step is to add and fuse the feature vectors of each day's virtual resource flow with the first position encoding vectors corresponding to each day's virtual resource flow feature vectors to obtain the first fused structural feature.

[0207] The first fusion structural feature is a set of time-series feature units. Each feature unit in the set is obtained by adding the feature vector of a single day's virtual resource flow to the first position encoding vector corresponding to that day dimension by dimension. Each unit simultaneously carries the virtual resource service content information of the corresponding day, as well as the position information of that day in the time-series sequence of all sampled days. This time-series feature set is an intermediate feature connecting the time-series position encoding and the in-depth analysis of the anomaly recognition model.

[0208] Understandably, the single-day virtual resource flow feature vector is used to characterize the single-day virtual resource transaction income and expenditure, circulation scale, and other single-day independent business attributes, while the first position encoding vector is used to characterize the sequential position of the corresponding single-day virtual resource data in the overall multi-day time series.

[0209] After individually adding and fusing the two sets of vectors for each day dimension by dimension, the fusion units corresponding to all sampling days are summarized to form a complete time series set. This allows for the simultaneous integration of all single-day business content information and global time series location information, resulting in a complete first fusion structure feature.

[0210] The fourth step is to perform multi-layer encoding processing on the first fusion structure features to obtain the virtual resource stream temporal feature vector.

[0211] The purpose of this step is to transform the set of fusion units, which contains only local information for a single day and whose units are independent of each other, into a virtual resource flow time sequence feature vector that can uniformly represent the overall time sequence pattern of virtual resource transactions on all sampling days and the cross-date virtual resource linkage behavior.

[0212] Understandably, since each unit in the first fusion structure only stores the business and location information of a single day, and no correlation calculation is established between the units of each sampling day, it is impossible to identify long-term abnormal virtual resource behaviors such as step-by-step transfers and cash-outs across multiple days.

[0213] Therefore, it is necessary to achieve cross-day feature interaction, filter redundant transaction information, and strengthen the effective correlation and dependence of multi-day virtual resource circulation through multi-layer coding, so as to explore the hidden global virtual resource circulation logic between multiple sampling days and fully capture cross-date time-series correlation risks.

[0214] For example, a rotation position encoding algorithm can be used to complete the encoding conversion and rotation transformation based on the first position number, thereby generating the first position encoding vector corresponding to the feature vector of each daily virtual resource flow.

[0215] For any single-day virtual resource flow feature vector, its first position encoding vector can be determined in the following ways:

[0216] The first step is to determine the scaling constant using the following formula. The fundamental rotation angle with the i-th dimension group .

[0217]

[0218]

[0219] in, It represents the scaling constant, which determines the period of position encoding and controls how fast the angle grows with position, avoiding excessively fast decay of high-frequency dimensions and excessively slow growth of low-frequency dimensions. The dimension represents the feature vector of a single day's virtual resource flow, such as 512 or 1024; i represents the dimension group index, with values ​​ranging from 0 to... ; This represents the base rotation angle corresponding to the i-th dimension group.

[0220] The second step is to combine the first position number p corresponding to the feature vector of the daily virtual resource flow with the basic rotation angle of the corresponding dimension group using the following formula to obtain the rotation angle of the vector in each dimension group.

[0221]

[0222] in, Let p represent the rotation angle of the daily virtual resource flow feature vector at position p in the i-th dimension group; p represents the first position number of the daily virtual resource flow feature vector (i.e., its position index in the time series, such as the element corresponding to the 3rd sampling day in the series, p=3); This represents the base rotation angle corresponding to the i-th dimension group.

[0223] The third step is to generate an angle tensor with the same dimensions as the daily virtual resource flow feature vector by using the following formula, based on the rotation angle of the daily virtual resource flow feature vector in each dimension group.

[0224]

[0225]

[0226] Wherein, full_thetas is a tensor with the same dimension as the feature vector of the daily virtual resource flow. Characterizes the sine value corresponding to the 2i-th dimension. The cosine value corresponding to the 2i+1th vector, together with the cosine value, constitutes the rotation angle representation of the vector in all dimensions.

[0227] The fourth step is to set up a dimension reversal operation using the following formula to achieve dimension reversal.

[0228]

[0229]

[0230] Where q represents the feature vector of virtual resource flow in a single day; This represents the value of the 2i-th dimension after the inversion operation; This represents the value of the (2i+1)th dimension after the reversal operation; i represents the dimension group index.

[0231] The fifth step involves rotating and transforming the feature vector of the daily virtual resource flow using the following formula to obtain the first location encoding vector with location information.

[0232]

[0233] in, This represents the feature vector of a single day's virtual resource flow. This represents the vector after applying rotational position encoding, which is the first position encoding vector corresponding to the feature vector of the virtual resource flow for that single day.

[0234] The abnormal virtual resource link processing method provided in this application embodiment performs feature extraction on the daily virtual resource flow data corresponding to each first sampling day, and outputs the daily virtual resource sample data corresponding to each sampling day; then, it performs vector transformation on each daily virtual resource sample data to generate a one-to-one corresponding daily sample feature vector; next, it performs extreme value standardization on all daily sample feature vectors, and obtains the daily virtual resource flow feature vector corresponding to each first sampling day after unifying the numerical range; finally, it performs time-series encoding processing on all daily virtual resource flow feature vectors through a virtual resource flow encoder, and finally outputs the virtual resource flow time-series feature vector.

[0235] This method sequentially completes the entire process of transaction data feature extraction, vector transformation, extreme value standardization, and time-series coding. It transforms scattered daily raw transaction data into standardized time-series feature vectors with complete cross-day time-series correlation expression capabilities. This eliminates computational interference caused by differences in the scale of different transaction indicators, and fully preserves the business information and temporal logic of virtual resource transactions on each sampling day. This facilitates the subsequent anomaly identification model to accurately capture abnormal virtual resource flow links formed by continuous cross-date operations, thereby improving the accuracy of identifying illegal virtual resource behavior.

[0236] Figure 4 A flowchart illustrating the method for handling abnormal virtual resource links provided in this application embodiment. Figure 4 ,like Figure 4 As shown, the anomaly identification model also includes a behavior flow encoder. Given that the historical interaction behavior flow data includes multiple second sampling days, the implementation process for determining the temporal feature vector of the historical interaction behavior flow data is explained in detail. This method includes:

[0237] S401. Perform feature extraction processing on the daily behavior data corresponding to each second sampling day to obtain the daily interaction sample data corresponding to each second sampling day.

[0238] Understandably, raw daily behavioral data only stores single, scattered details of user operations. The data volume is huge, the information is messy, and there are no unified quantitative indicators, making it impossible to directly perform deep learning operations such as vector conversion, standardization, and time-series coding.

[0239] Therefore, by extracting features from daily behavioral data, we can obtain structured sample data that summarizes the overall interaction situation of the day, and eliminate worthless detailed information.

[0240] S402. Perform vector transformation processing on the daily interactive sample data corresponding to each second sampling day to obtain the daily interactive sample feature vector corresponding to each second sampling day.

[0241] Understandably, daily interaction sample data is a multi-field structured dataset containing multiple interaction indicators, and cannot be directly used in various vector matrix operations such as rotation transformation, feature addition and fusion.

[0242] Therefore, it is necessary to perform vector transformation on the daily interaction sample data corresponding to each second sampling day, and integrate the scattered interaction business indicators into a numerical vector with unified dimensions so that it can meet the requirements of all subsequent feature processing procedures.

[0243] S403. Perform extreme value standardization on the feature vector of the daily interaction sample corresponding to each second sampling day to obtain the daily behavior feature vector corresponding to each second sampling day.

[0244] Understandably, the feature vector of a single-day interaction sample contains behavioral indicators with vastly different magnitudes, such as the duration of a single session and the proportion of specific behaviors. Without standardization, indicators with larger values ​​will dominate the entire calculation process, while key interaction features with smaller values ​​are easily masked, interfering with the calculation accuracy of subsequent time-series feature extraction and anomaly identification.

[0245] Therefore, it is necessary to perform extreme value standardization on the feature vector of daily interaction samples to unify the numerical scale of all feature dimensions, avoid the calculation bias caused by the difference in scale, and obtain a scale-balanced daily behavior feature vector.

[0246] Optionally, this application can express the daily behavioral feature vector corresponding to any second sampling day by the following expression, including:

[0247]

[0248] Where t represents day t; This represents a single-day behavioral feature vector. Indicates the duration of a single session; Indicates the page jump depth; Indicates page diversity; Indicates the percentage of a specific behavior.

[0249] In this step, extreme value standardization can be used to scale and transform the feature vectors of the daily interaction samples corresponding to each second sampling day, thereby generating the daily behavioral feature vectors corresponding to each second sampling day. After standardization, the values ​​of all feature dimensions within the vector fall within the interval [0, 1].

[0250] For example, Table 2 shows the daily behavior feature vector table constructed in the embodiments of this application. The table records all daily behavior feature vectors corresponding to any sampling day, as shown in Table 2.

[0251]

[0252]

[0253] S404. Using a behavior flow encoder, perform time-series encoding on the daily behavior feature vectors corresponding to each second sampling day to obtain interactive behavior time-series feature vectors.

[0254] The purpose of this step is to transform the independent daily behavior flow feature vector sequence, which can only carry local interaction information on a single day, into a global interaction behavior time-series feature vector that integrates cross-date behavior association information from multiple sampling days.

[0255] Understandably, each daily behavior flow feature vector only records the interaction behavior information of a single sampling day. The vectors are independent of each other and cannot reflect long-term time-series related behaviors such as multi-day step-by-step operations and cross-cycle continuous violations.

[0256] The behavior flow encoder can perform cross-temporal correlation operations with different date features, filter out invalid and redundant behavior information, strengthen the effective correlation and dependency between multi-day interaction behaviors, and uncover the complete global interaction temporal logic.

[0257] Therefore, by uniformly performing time-series encoding on all daily behavior flow feature vectors using a behavior flow encoder, we can obtain interactive behavior time-series feature vectors that contain multi-day interactive linkage relationships.

[0258] Optionally, the temporal feature vector of the interaction behavior can be represented by the following expression.

[0259]

[0260] in, The interaction behavior time-series feature vector is composed of the daily behavior feature vectors corresponding to 30 sampling days. , , , The matrix is ​​composed of 30 rows and 4 columns, forming a two-dimensional time series matrix.

[0261] Optionally, this application provides a possible implementation method, including:

[0262] The first step is to assign a second position number to the daily behavioral feature vector corresponding to each second sampling day.

[0263] The second position number is used to mark the position of each daily behavior feature vector in the overall behavior time sequence.

[0264] The purpose of this step is to sequentially label each daily behavioral feature vector obtained from each second sampling day within the sequence, and to clarify the order of each daily behavioral feature vector in the complete behavioral time-series feature sequence.

[0265] Understandably, the interactive behavior analysis model cannot autonomously identify the sequence order and temporal correlation of multi-day behavioral features, and the second position number is a prerequisite for generating the second position encoding vector carrying temporal information.

[0266] Assigning a second position number can prevent the model from confusing the daily behavior flow features corresponding to different sampling days, and ensure that the original temporal sequence information of multi-day interaction behaviors is not lost. Therefore, a second position number needs to be assigned to the daily behavior feature vector corresponding to each second sampling day.

[0267] The second step is to determine the second position encoding vector of each daily behavior feature vector based on the second position number of each daily behavior feature vector.

[0268] The second position encoding vector is a numerical vector generated by rotation transformation based on the second position number corresponding to the daily behavior feature vector, and is used to characterize the arrangement position of the daily behavior feature vector in the time series.

[0269] Understandably, the second position number is in pure numerical form and cannot be directly used in vector operations and feature fusion. Therefore, it is necessary to calculate the rotation angle based on the second position number and perform a rotation transformation on the daily behavior feature vector to generate a vector with dimension matching and carrying temporal position information, thus obtaining the second position encoding vector corresponding to each daily behavior feature vector.

[0270] The third step is to add and fuse the daily behavior feature vectors with the second position encoding vectors of the daily behavior feature vectors to obtain the second fused structural feature.

[0271] The second fusion structure feature is a set of time-series feature units. Each feature unit in the set is obtained by adding the single-day behavior feature vector and the corresponding second location encoding vector dimension by dimension. Each unit simultaneously carries the business content information of the user interaction behavior on the corresponding single day, as well as the location information of that single day in the time-series sequence of all sampled days. This time-series feature set is an intermediate feature connecting time-series location encoding and in-depth analysis of interaction behavior.

[0272] Understandably, the single-day behavior feature vector is used to characterize independent business attributes such as the frequency and type of user interaction behavior on a single day, while the second position encoding vector is used to characterize the order of the corresponding single-day behavior feature vector in the overall multi-day time series.

[0273] Therefore, by adding and fusing the daily behavioral feature vectors with the second position encoding vectors of each daily behavioral feature vector, we can simultaneously integrate all daily behavioral business content information and global temporal position information to obtain a complete second fused structural feature.

[0274] The fourth step is to perform multi-layer encoding on the second fusion structure features to obtain the temporal feature vector of the interaction behavior.

[0275] Understandably, the second fusion structure features can only reflect the local information of the interaction behavior and temporal location information of independent units of the daily behavior flow, and cannot reflect the global user interaction logic and cross-date long-distance behavior correlation and dependency between multiple sampling days.

[0276] Therefore, by performing multi-layer encoding on the second fusion structure features, deep semantic abstraction of the features can be achieved, redundant behavioral information can be filtered out, the effective correlation of cross-day interactive behaviors can be strengthened, and an interactive behavior temporal feature vector that can fully represent the overall temporal pattern of multi-day continuous user interactive behaviors can be generated.

[0277] For example, a rotation position encoding algorithm can be used to complete the encoding conversion and rotation transformation based on the second position number, thereby generating the second position encoding vector corresponding to each daily behavioral feature vector.

[0278] For any single-day behavior feature vector, its second position encoding vector can be determined in the following ways:

[0279] The first step is to determine the scaling constant using the following formula. The fundamental rotation angle with the i-th dimension group .

[0280]

[0281]

[0282] in, It represents the scaling constant, which determines the period of position encoding and controls how fast the angle grows with position, avoiding excessively fast decay of high-frequency dimensions and excessively slow growth of low-frequency dimensions. The dimension represents the feature vector of a single day's behavioral flow, such as 512 or 1024; i represents the dimension group index, with values ​​ranging from 0 to... ; This represents the base rotation angle corresponding to the i-th dimension group.

[0283] The second step is to combine the second position number p corresponding to the daily behavior flow feature vector with the basic rotation angle of the corresponding dimension group using the following formula to obtain the rotation angle of the vector in each dimension group.

[0284]

[0285] in, Let p represent the rotation angle of the daily behavior flow feature vector at position p in the i-th dimension group; p represents the first position number of the daily behavior flow feature vector (i.e., its position index in the sequence, such as the 3rd element in the sequence, p=3). This represents the base rotation angle corresponding to the i-th dimension group.

[0286] The third step is to generate an angle tensor with the same dimensions as the daily behavior flow feature vector by using the following formula, based on the rotation angle of the daily behavior flow feature vector in each dimension group.

[0287]

[0288]

[0289] Where full_thetas is a tensor with the same dimension as the feature vector of the daily behavior flow. Characterizes the sine value corresponding to the 2i-th dimension. The cosine value corresponding to the 2i+1th vector, together with the cosine value, constitutes the rotation angle representation of the vector in all dimensions.

[0290] The fourth step is to set up a dimension reversal operation using the following formula to achieve dimension reversal.

[0291]

[0292]

[0293] Where q represents the feature vector of daily behavior flow; This represents the value of the 2i-th dimension after the inversion operation; This represents the value of the (2i+1)th dimension after the reversal operation; i represents the dimension group index.

[0294] The fifth step involves rotating the daily behavior flow feature vector using the following formula to obtain the first location encoding vector with location information.

[0295]

[0296] in, This represents the feature vector of daily behavioral flow. This represents the vector after applying rotational position encoding, which is the second position encoding vector corresponding to the daily behavioral flow feature data.

[0297] The method for handling abnormal virtual resource links provided in this application embodiment first extracts features from the raw daily behavior data corresponding to each second sampling day, and aggregates and statistically obtains the daily interaction sample data corresponding to each second sampling day; then, the daily interaction sample data is vectorized into daily interaction sample feature vectors; next, all daily interaction sample feature vectors are normalized to obtain the daily behavior feature vectors corresponding to each second sampling day; finally, all daily behavior feature vectors are temporally encoded by a behavior flow encoder to obtain the interaction behavior temporal feature vectors.

[0298] This method gradually transforms scattered and irregular daily raw behavior details into interactive behavior time-series feature vectors with a unified scale and global temporal correlation expression capability. By extracting features to condense effective interactive behavior indicators and eliminating redundant and invalid information, it relies on vector transformation and extreme value standardization to unify the data operation format and avoid the calculation distortion problem caused by the difference in indicator magnitude. Then, through time-series encoding, it captures the long-term interactive behavior dependencies across sampling days, completely retaining the details of daily user interactive behavior and the global temporal sequence logic. This provides a basis for subsequent identification of abnormal virtual resource links by combining virtual resource flow characteristics, thereby improving the accuracy of identifying abnormal behavior links across cycles.

[0299] Figure 5 This is a schematic diagram of the overall architecture of a method for handling abnormal virtual resource links provided in an embodiment of this application, as shown below. Figure 5 As shown.

[0300] After inputting historical virtual resource flow data and historical interaction behavior flow data, they are first uniformly sent to the extreme value standardization module for preprocessing. This module performs linear scaling mapping on the two types of original business time-series data, and uniformly constrains the original behavior values ​​such as virtual resource transactions and page clicks with large differences in scale and numerical range to a fixed numerical range, eliminating the interference of model training caused by the difference in data volume. After standardization, the data is sent to two parallel branches, the virtual resource flow encoder and the behavior flow encoder, for deep feature extraction.

[0301] The standardized historical virtual resource flow data is first converted into a dense semantic vector through a virtual resource embedding layer. After being superimposed with rotation position encoding to supplement temporal sequence information, it is input into a convolutional neural network layer. The convolutional layer extracts local correlation features of short-term continuous virtual resource behavior. The data then passes sequentially through the first branch multi-head attention layer and the corresponding residual normalization layer, and the second cross-multi-head attention layer and the corresponding residual normalization layer. The second multi-head attention layer receives the feature vector output by the behavior flow encoder to complete cross-modal cross-attention calculation, modeling the linkage risk relationship between virtual resource transactions and customer operation behavior. Finally, it passes through a feedforward network layer and a matching residual normalization layer to output the virtual resource flow temporal feature vector.

[0302] The standardized historical interaction behavior flow data is first mapped to a unified dimension feature vector through the interaction behavior flow embedding layer. After being superimposed with rotation position encoding to label the timing of behavior occurrence, it is fed into the convolutional neural network layer to capture local behavior patterns of continuous clicks, queries, and evidence collection operations within a short period. Subsequently, it passes through the first branch multi-head attention layer and residual normalization layer, and the second cross-multi-head attention layer and residual normalization layer. The second multi-head attention module synchronously outputs its own behavior feature vector to the virtual resource flow encoder, realizing bidirectional cross-correlation modeling of the two types of behavior data. Finally, it passes through the feedforward network and residual normalization layer to output the interaction behavior timing feature vector.

[0303] The two sets of temporal feature vectors output by the virtual resource flow encoder and the behavior flow encoder are input into the feature concatenation layer of the decoder to complete vector fusion. The concatenated fused features are sent to the feedforward network layer to mine the potential complaint risk features formed by the combination of virtual resources and operational behaviors. Then, the feature distribution is stabilized and the effective information at the bottom layer is preserved through residual connections and normalization layers. Subsequently, the high-dimensional fused features are compressed into a one-dimensional original risk score through a fully connected layer. The score is then mapped to the probability range of 0-1 through the activation layer. Finally, the risk judgment layer outputs the probability that the target account has an abnormal virtual resource link within a preset time period.

[0304] Figure 6 A schematic diagram illustrating the structure for reducing the dimensionality of the input sequence in the convolutional neural network provided in this application is shown below. Figure 6 As shown, Figure 6 Is Figure 5 Based on this, convolutional neural networks are introduced into the virtual resource flow encoder and behavior flow encoder of the anomaly recognition model.

[0305] As shown in the example in the figure: the left side is the input feature matrix of the code sequence, with each row corresponding to the feature vector of a line of code (such as "int", "add", "(", etc.); the right side is the convolutional neural network, which extracts features from local regions in the input feature matrix (such as the three consecutive rows of feature vectors corresponding to "int add ("), compressing multiple input vectors into a single output feature vector. This design structure can effectively reduce the dimensionality of the input features, reduce the computational load of the model, and thus improve the overall training efficiency of the model.

[0306] Figure 7 This is a schematic diagram of the structure of the abnormal virtual resource link processing device provided in the embodiments of this application, as shown below. Figure 7 As shown, the abnormal virtual resource link processing device 700 provided in this embodiment includes:

[0307] The acquisition module 701 is used to acquire the historical virtual resource flow data and historical interaction behavior flow data of the target account within a preset time period;

[0308] The determination module 702 is used to determine the global multimodal joint feature vector based on historical virtual resource flow data and historical interaction behavior flow data;

[0309] The processing module 703 is used to decode the global multimodal joint feature vector through the decoder in the anomaly recognition model to obtain the anomaly probability score of the target account, and to judge the anomaly probability score of the target account to obtain the target risk label of the target account; the anomaly probability score is used to indicate the probability that an abnormal virtual resource link exists in the target account within a preset time period.

[0310] The determination module 702 is also used to determine the anomaly handling plan for the target risk label;

[0311] Execution module 704 is used to execute the exception handling plan.

[0312] In one possible implementation, the determining module 702 is further configured to determine the virtual resource stream temporal feature vector of historical virtual resource stream data and the interaction behavior temporal feature vector of historical interaction behavior stream data.

[0313] The processing module 702 is specifically used to concatenate the virtual resource stream temporal feature vector with the interaction behavior temporal feature vector to obtain a global multimodal joint feature vector.

[0314] In one possible implementation, the processing module 703 is further configured to perform feature extraction processing on the daily virtual resource flow data corresponding to each first sampling day to obtain daily virtual resource sample data corresponding to each first sampling day.

[0315] The processing module 703 is also used to perform vector conversion processing on the daily virtual resource sample data corresponding to each first sampling day to obtain the daily sample feature vector corresponding to each first sampling day.

[0316] The processing module 703 is also used to perform extreme value standardization processing on the single-day sample feature vector corresponding to each first sampling day to obtain the single-day virtual resource flow feature vector corresponding to each first sampling day;

[0317] The processing module 703 is specifically used to perform time-series encoding processing on the single-day virtual resource flow feature vector corresponding to each first sampling day through the virtual resource flow encoder, so as to obtain the virtual resource flow time-series feature vector.

[0318] In one possible implementation, the device further includes: a distribution module 705;

[0319] The allocation module 705 is used to assign a first position number to the single-day virtual resource flow feature vector corresponding to each first sampling day;

[0320] The determining module 702 is also used to determine the first position encoding vector corresponding to each daily virtual resource flow feature vector based on the first position number of each daily virtual resource flow feature vector;

[0321] The processing module 703 is also used to add and fuse the feature vector of each daily virtual resource flow with the first position encoding vector corresponding to each daily virtual resource flow feature vector to obtain the first fused structure feature;

[0322] The processing module 703 is specifically used to perform multi-layer encoding processing on the first fusion structure features to obtain the virtual resource stream temporal feature vector.

[0323] In one possible implementation, the processing module 703 is further configured to perform feature extraction processing on the daily behavior data corresponding to each second sampling day to obtain daily interaction sample data corresponding to each second sampling day.

[0324] The processing module 703 is also used to perform vector transformation processing on the daily interactive sample data corresponding to each second sampling day to obtain the daily interactive sample feature vector corresponding to each second sampling day.

[0325] The processing module 703 is also used to perform extreme value standardization processing on the single-day interactive sample feature vector corresponding to each second sampling day to obtain the single-day behavior feature vector corresponding to each second sampling day.

[0326] The processing module 703 is specifically used to perform time-series encoding processing on the daily behavior feature vectors corresponding to each second sampling day through the behavior flow encoder to obtain the interactive behavior time-series feature vectors.

[0327] In one possible implementation, the allocation module 705 is further configured to allocate a second position number to the daily behavior feature vector corresponding to each second sampling day;

[0328] The determining module 702 is also used to determine the second position encoding vector of each daily behavior feature vector based on the second position number of each daily behavior feature vector;

[0329] The processing module 703 is also used to add and fuse each daily behavior feature vector with the second position encoding vector of each daily behavior feature vector to obtain the second fused structure feature;

[0330] The processing module 703 is specifically used to perform multi-layer encoding processing on the second fusion structure features to obtain the interactive behavior temporal feature vector.

[0331] In one possible implementation, the device further includes: an input module 706;

[0332] Input module 706 is used to input the global multimodal joint feature vector into the feedforward neural network layer to obtain the first feature vector;

[0333] The input module 706 is also used to connect the first feature vector into the residual and the normalization layer to obtain the second feature vector;

[0334] The input module 706 is also used to input the second feature vector into the fully connected layer to obtain a one-dimensional predicted feature value;

[0335] Input module 706 is specifically used to input single-dimensional predicted feature values ​​into the activation layer to obtain the abnormal probability score of the target account.

[0336] In one possible implementation, the input module 706 is specifically used to input the anomaly probability score into the risk assessment layer, which compares the anomaly probability score with multiple preset score ranges to obtain the target risk label of the target account.

[0337] The method for handling abnormal virtual resource links provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0338] Figure 8 A schematic diagram of the structure of the processing device for abnormal virtual resource links provided in this application. (See diagram below.) Figure 8 As shown, the electronic device 800 provided in this embodiment includes at least one processor 801 and a memory 802. Optionally, the abnormal virtual resource link processing device 800 further includes a communication component 803. The processor 801, memory 802, and communication component 803 are connected via a bus 804.

[0339] In the specific implementation process, at least one processor 801 executes computer execution instructions stored in memory 802, causing at least one processor 801 to execute the above-mentioned abnormal virtual resource link processing method.

[0340] The specific implementation process of processor 801 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0341] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0342] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0343] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0344] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method for handling abnormal virtual resource links.

[0345] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method for handling abnormal virtual resource links.

[0346] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0347] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0348] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0349] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0350] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0351] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0352] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0353] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope.

Claims

1. A method for handling abnormal virtual resource links, characterized in that, The method includes: Obtain historical virtual resource stream data and historical interaction behavior stream data corresponding to the target account within a preset time period; Based on the historical virtual resource flow data and historical interaction behavior flow data, a global multimodal joint feature vector is determined; The global multimodal joint feature vector is decoded by the decoder in the anomaly detection model to obtain the anomaly probability score of the target account. The anomaly probability score of the target account is then judged to obtain the target risk label of the target account. The anomaly probability score is used to indicate the probability that the target account has an abnormal virtual resource link within the preset time period. Determine the anomaly handling plan for the target risk label and execute the anomaly handling plan.

2. The method according to claim 1, characterized in that, The step of determining the global multimodal joint feature vector based on the historical virtual resource stream data and historical interaction behavior stream data includes: Determine the virtual resource stream temporal feature vector of the historical virtual resource stream data, and determine the interaction behavior temporal feature vector of the historical interaction behavior stream data; The virtual resource stream temporal feature vector and the interaction behavior temporal feature vector are concatenated to obtain the global multimodal joint feature vector.

3. The method according to claim 2, characterized in that, The anomaly detection model further includes: a virtual resource flow encoder, wherein the historical virtual resource flow data includes: multiple first sampling days, and daily virtual resource flow data corresponding to each first sampling day, and the step of determining the virtual resource flow time-series feature vector of the historical virtual resource flow data includes: Feature extraction processing is performed on the daily virtual resource flow data corresponding to each of the first sampling days to obtain the daily virtual resource sample data corresponding to each of the first sampling days. The daily virtual resource sample data corresponding to each of the first sampling days is subjected to vector transformation processing to obtain the daily sample feature vector corresponding to each of the first sampling days. The daily sample feature vectors corresponding to each of the first sampling days are subjected to extreme value standardization to obtain the daily virtual resource flow feature vectors corresponding to each of the first sampling days. The virtual resource stream encoder performs time-series encoding on the single-day virtual resource stream feature vector corresponding to each of the first sampling days to obtain the virtual resource stream time-series feature vector.

4. The method according to claim 3, characterized in that, The step of performing time-series encoding processing on the daily virtual resource flow feature vectors corresponding to each of the first sampling days through the virtual resource flow encoder to obtain the virtual resource flow time-series feature vectors includes: Assign a first position number to the single-day virtual resource flow feature vector corresponding to each of the first sampling days; Based on the first position number of each of the single-day virtual resource flow feature vectors, determine the first position encoding vector corresponding to each of the single-day virtual resource flow feature vectors; The first fused structural feature is obtained by adding and fusing the feature vectors of each day's virtual resource flow with the first position encoding vectors corresponding to each day's virtual resource flow feature vector. The first fusion structure feature is subjected to multi-layer encoding processing to obtain the virtual resource stream temporal feature vector.

5. The method according to claim 2, characterized in that, The anomaly detection model further includes: a behavior flow encoder, wherein the historical interaction behavior flow data includes: multiple second sampling days, and daily behavior data corresponding to each second sampling day, and the step of determining the interaction behavior time-series feature vector of the historical interaction behavior flow data includes: Feature extraction processing is performed on the daily behavioral data corresponding to each of the second sampling days to obtain the daily interaction sample data corresponding to each of the second sampling days; The daily interactive sample data corresponding to each of the second sampling days are processed by vector transformation to obtain the daily interactive sample feature vector corresponding to each of the second sampling days. The daily interaction sample feature vectors corresponding to each of the second sampling days are subjected to extreme value standardization to obtain the daily behavior feature vectors corresponding to each of the second sampling days. The behavior flow encoder performs time-series encoding on the daily behavior feature vectors corresponding to each of the second sampling days to obtain the interaction behavior time-series feature vectors.

6. The method according to claim 5, characterized in that, The step of performing time-series encoding on the daily behavior feature vectors corresponding to each of the second sampling days through the behavior flow encoder to obtain the interaction behavior time-series feature vectors includes: Assign a second position number to the daily behavior feature vector corresponding to each of the second sampling days; Based on the second position number of each of the single-day behavior feature vectors, determine the second position encoding vector of each of the single-day behavior feature vectors; The single-day behavior feature vectors are added to and fused with the second position encoding vectors of the single-day behavior feature vectors to obtain the second fused structural feature. The second fusion structure feature is subjected to multi-layer encoding processing to obtain the temporal feature vector of the interaction behavior.

7. The method according to claim 1, characterized in that, The decoder includes: a feedforward neural network layer, a residual connection and normalization layer, a fully connected layer, and an activation layer. The decoder in the anomaly detection model decodes the global multimodal joint feature vector to obtain the anomaly probability score of the target account, including: The global multimodal joint feature vector is input into the feedforward neural network layer to obtain the first feature vector; The first feature vector is input into the residual connection and normalization layer to obtain the second feature vector; The second feature vector is input into the fully connected layer to obtain a one-dimensional predicted feature value; The single-dimensional predicted feature value is input into the activation layer to obtain the anomaly probability score of the target account.

8. The method according to claim 1, characterized in that, The decoder further includes a risk assessment layer, which processes the anomaly probability score of the target account to obtain the target risk label of the target account, including: The anomaly probability score is input into the risk assessment layer, which compares the anomaly probability score with multiple preset score ranges to obtain the target risk label for the target account.

9. A processing device for abnormal virtual resource links, characterized in that, include: The acquisition module is used to acquire historical virtual resource stream data and historical interaction behavior stream data corresponding to the target account within a preset time period; The determination module is used to determine a global multimodal joint feature vector based on the historical virtual resource flow data and the historical interaction behavior flow data; The processing module is used to decode the global multimodal joint feature vector through the decoder in the anomaly recognition model to obtain the anomaly probability score of the target account, and to judge the anomaly probability score of the target account to obtain the target risk label of the target account; the anomaly probability score is used to indicate the probability that the target account has an abnormal virtual resource link within the preset time period; The determining module is also used to determine the anomaly handling scheme for the target risk label; The execution module is used to execute the exception handling scheme.

10. A processing device for abnormal virtual resource links, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-8.

12. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-8.

Images