Transaction account monitoring method and apparatus, program product, and electronic device

Abstract

This invention discloses a method, apparatus, program, and electronic device for monitoring trading accounts, relating to the fields of artificial intelligence, fintech, or other related fields. The monitoring method includes: collecting raw trading data within the current time window; constructing a dynamic graph of the current moment based on the raw trading data; inputting the dynamic graph into a preset classification model; and outputting the risk category corresponding to each trading account. This invention solves the technical problem of low accuracy in monitoring trading accounts in related technologies.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence, and more specifically, to a method, apparatus, program product, and electronic device for monitoring transaction accounts. Background Technology

[0002] Monitoring abnormal transactions is fundamental to maintaining the security and stability of the financial system. Its core task is to identify financial activities that conceal the source and nature of abnormal returns from massive transactions.

[0003] With the acceleration of financial digitalization, current monitoring systems still rely on multi-layered rule engines and traditional machine learning models, such as static rule-based monitoring and machine learning-based monitoring. However, static rule-based monitoring is prone to risk avoidance but has a high false alarm rate; machine learning-based monitoring, due to insufficient modeling capabilities, struggles to capture complex relationship patterns, making it unable to handle complex financial transactions.

[0004] There is currently no effective solution to the above problems. Summary of the Invention

[0005] This invention provides a method, apparatus, program, and electronic device for monitoring trading accounts, in order to at least solve the technical problem of low accuracy in monitoring trading accounts in related technologies.

[0006] According to one aspect of the present invention, a method for monitoring trading accounts is provided, comprising: collecting raw trading data of the current time window, wherein the current time window is determined based on the current moment and a preset time window; constructing a dynamic graph of the current moment based on the raw trading data, wherein the dynamic graph includes: account nodes, associated edges, and an account node feature matrix, wherein a single account node corresponds to a trading account; inputting the dynamic graph into a preset classification model, and outputting the risk category corresponding to each trading account, wherein the preset classification model is a model constructed based on a spatiotemporal conditional attention mechanism.

[0007] Furthermore, the steps for constructing a dynamic graph at the current moment based on the original transaction data include: extracting transaction accounts from the original transaction data and mapping the transaction accounts to corresponding account nodes; determining account nodes with transaction associations based on the original transaction data and constructing association edges between account nodes with transaction associations; for each association edge, generating dynamic edge features of the association edge based on all transaction flows associated with the two account nodes connected by the association edge; determining the static feature vector and dynamic feature vector corresponding to each account node, and constructing an account node feature matrix based on the static feature vector and dynamic feature vector corresponding to each account node; and constructing a dynamic graph based on all account nodes, all association edges, and the account node feature matrix.

[0008] Furthermore, the step of generating dynamic edge features of the associated edge based on all transaction flows associated with the two account nodes connected by the associated edge includes: determining the timestamp of each transaction flow and using the latest timestamp as the transaction timestamp of the associated edge; aggregating all transaction flows to obtain the total amount, total number of transactions, counterparty account type, and transaction channel for each transaction; and generating dynamic edge features of the associated edge based on the total amount, total number of transactions, transaction timestamp, counterparty account type, and transaction channel.

[0009] Furthermore, before inputting the dynamic graph into the preset classification model and outputting the risk category corresponding to each trading account, the process includes: constructing an initial classification model based on a spatiotemporal conditional attention mechanism. The initial classification model's structure includes: multiple layers of spatiotemporal conditional attention layers and a classification head; each spatiotemporal conditional attention layer is followed by residual connections and layer normalization. The spatiotemporal conditional attention layers are used to output the intermediate node feature matrix based on the spatiotemporal conditional attention weights; the classification head is used to output the risk category of each account node based on the target node feature matrix output by the last spatiotemporal conditional attention layer; historical trading data is collected and processed to obtain training data; the initial classification model is trained using the training data to obtain the preset classification model.

[0010] Further, the steps for processing historical transaction data to obtain training data include: dividing the historical transaction data into historical transaction sub-data corresponding to different historical time windows, wherein the historical transaction data includes: multiple historical transaction records, each historical transaction record includes: transaction account pair, transaction amount, and timestamp; for each historical time window, constructing a historical dynamic graph of the historical time window based on the historical transaction sub-data corresponding to the historical time window; classifying each transaction account in the historical dynamic graph based on the transaction results corresponding to the historical transaction sub-data to obtain a labeled category set; and constructing training data based on the historical dynamic graph and the labeled category set.

[0011] Further, the step of training the initial classification model using training data to obtain the preset classification model includes: training the initial classification model using a preset cross-entropy loss function based on the training data to obtain the loss value for each iteration, wherein the loss value is calculated using the preset cross-entropy loss function based on the predicted category set and the labeled category set, and the predicted category set is the set consisting of the predicted categories of each trading account output by the initial classification model; determining that training is complete when the loss value is less than a preset loss threshold, and obtaining the target model parameter set, wherein the target model parameter set includes at least: the weights, attention parameters, balance parameters, and decay parameters corresponding to each temporal conditional spatial attention layer; and adjusting the initial classification model based on the target model parameter set to obtain the preset classification model.

[0012] Further, the steps of inputting the dynamic graph into the preset classification model and outputting the risk category corresponding to each trading account include: for each account node, determining the account time sequence code based on the feature vector corresponding to each transaction of the account node within the current time window; fusing the node feature matrix and the account time sequence code to obtain the initial node feature vector of the account node; processing the initial node feature vector using a multi-layer temporal conditional spatial attention layer in the preset classification model to obtain the target node feature vector of the account node; constructing the target node feature matrix based on the target node feature vector of each account node; and processing the target node feature matrix using the classification head in the preset classification model to obtain the risk category of the trading account indicated by each account node.

[0013] Further, the step of processing the initial node feature vector using a multi-layer temporal conditional spatial attention layer in a pre-defined classification model to obtain the target node feature vector of the account node includes: determining the set of neighboring nodes of the account node; for each temporal conditional spatial attention layer, based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor, determining the temporal conditional attention weight of each neighboring node in the set of neighboring nodes in the current temporal conditional spatial attention layer, wherein the first temporal conditional spatial attention layer uses the initial node feature vector as the intermediate node feature vector; determining the aggregation information of the account node based on the temporal conditional attention weight of each neighboring node, the intermediate node feature vector, and the weight of the current temporal conditional spatial attention layer; performing a residual connection on the aggregation information and the intermediate node feature vector to obtain a connection vector, and performing layer normalization processing on the connection vector to obtain the intermediate node feature vector output by the current temporal conditional spatial attention layer; and representing the intermediate node feature vector output by the last temporal conditional spatial attention layer as the target node feature vector.

[0014] Furthermore, the step of determining the temporal conditional attention weight of each neighbor node in the current temporal conditional spatial attention layer based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor includes: determining the initial attention weight of the neighbor node in the current temporal conditional spatial attention layer based on the weight of the current temporal conditional spatial attention layer, attention parameters, intermediate node feature vectors of the account node and intermediate node feature vectors of the neighbor node; determining the time decay factor of the neighbor node based on the decay parameter, time normalization factor, transaction timestamps of the associated edges between the account node and the neighbor node and the current time; and determining the temporal conditional attention weight of each neighbor node in the current temporal conditional spatial attention layer based on the balance parameter, the initial attention weight of each neighbor node and the time decay factor.

[0015] According to another aspect of the present invention, a monitoring device for trading accounts is also provided, comprising: a collection unit for collecting raw trading data of the current time window, wherein the current time window is determined based on the current moment and a preset time window; a construction unit for constructing a dynamic graph of the current moment based on the raw trading data, wherein the dynamic graph includes: account nodes, associated edges, and an account node feature matrix, wherein a single account node corresponds to a trading account; and an input unit for inputting the dynamic graph into a preset classification model and outputting the risk category corresponding to each trading account, wherein the preset classification model is a model constructed based on a spatiotemporal conditional attention mechanism.

[0016] Furthermore, the construction unit includes: a first extraction module, used to extract transaction accounts from the original transaction data and map the transaction accounts to corresponding account nodes; a first construction module, used to determine account nodes with transaction associations based on the original transaction data and construct association edges between account nodes with transaction associations; a first generation module, used to generate dynamic edge features of each association edge based on all transaction flows associated with the two account nodes connected by the association edge; a first determination module, used to determine the static feature vector and dynamic feature vector corresponding to each account node, and construct an account node feature matrix based on the static feature vector and dynamic feature vector corresponding to each account node; and a second construction module, used to construct a dynamic graph based on all account nodes, all association edges, and the account node feature matrix.

[0017] Furthermore, the first generation module includes: a first determining submodule, used to determine the timestamp of each transaction and use the latest timestamp as the transaction timestamp of the associated edge; a first aggregation submodule, used to aggregate all transaction flows to obtain the total amount, total number of transactions, counterparty account type, and transaction channel for each transaction; and a first generation submodule, used to generate dynamic edge features of the associated edge based on the total amount, total number of transactions, transaction timestamp, counterparty account type, and transaction channel.

[0018] Furthermore, the monitoring device also includes: a third construction module, used to construct an initial classification model based on a spatiotemporal conditional attention mechanism before inputting the dynamic graph into the preset classification model and outputting the risk category corresponding to each trading account. The model structure of the initial classification model includes: multiple layers of spatiotemporal conditional attention layers and a classification head; each layer of spatiotemporal conditional attention is followed by residual connections and layer normalization. The spatiotemporal conditional attention layers are used to output the feature matrix of intermediate nodes based on the spatiotemporal conditional attention weights. The classification head is used to output the risk category of each account node based on the target node feature matrix output by the last layer of spatiotemporal conditional attention layers. A first processing module is used to collect historical trading data and process the historical trading data to obtain training data. A first training module is used to train the initial classification model using the training data to obtain the preset classification model.

[0019] Furthermore, the first processing module includes: a first segmentation submodule, used to segment historical transaction data into historical transaction sub-data corresponding to different historical time windows, wherein the historical transaction data includes: multiple historical transaction records, each historical transaction record including: transaction account pair, transaction amount, and timestamp; a first construction submodule, used to construct a historical dynamic graph of each historical time window based on the historical transaction sub-data corresponding to the historical time window; a first annotation submodule, used to classify each transaction account in the historical dynamic graph based on the transaction results corresponding to the historical transaction sub-data, to obtain an annotation category set; and a second construction submodule, used to construct training data based on the historical dynamic graph and the annotation category set.

[0020] Further, the first training module includes: a first training submodule, used to train the initial classification model based on training data using a preset cross-entropy loss function to obtain the loss value for each iteration, wherein the loss value is calculated based on the predicted category set and the labeled category set using the preset cross-entropy loss function, and the predicted category set is the set consisting of the predicted categories of each trading account output by the initial classification model; a second determination submodule, used to determine that training is complete when the loss value is less than a preset loss threshold, and obtain the target model parameter set, wherein the target model parameter set includes at least: the weights, attention parameters, balance parameters, and decay parameters corresponding to each temporal conditional spatial attention layer; and a first adjustment submodule, used to adjust the initial classification model based on the target model parameter set to obtain a preset classification model.

[0021] Further, the input unit includes: a second determining module, used to determine the account time sequence code for each account node based on the feature vector corresponding to each transaction of the account node within the current time window; a first fusion module, used to fuse the node feature matrix and the account time sequence code to obtain the initial node feature vector of the account node; a second processing module, used to process the initial node feature vector using a multi-layer temporal conditional spatial attention layer in a preset classification model to obtain the target node feature vector of the account node; a fourth construction module, used to construct the target node feature matrix based on the target node feature vector of each account node; and a third processing module, used to process the target node feature matrix using a classification head in a preset classification model to obtain the risk category of the transaction account indicated by each account node.

[0022] Further, the second processing module includes: a third determining submodule, used to determine the set of neighboring nodes of the account node; a fourth determining submodule, used to determine the temporal conditional attention weight of each neighboring node in the current temporal conditional spatial attention layer for each temporal conditional spatial attention layer, based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor, wherein the first temporal conditional spatial attention layer uses the initial node feature vector as the intermediate node feature vector; a fifth determining submodule, used to determine the aggregation information of the account node based on the temporal conditional attention weight of each neighboring node, the intermediate node feature vector, and the weight of the current temporal conditional spatial attention layer; a first processing submodule, used to perform residual connection on the aggregation information and the intermediate node feature vector to obtain a connection vector, and perform layer normalization processing on the connection vector to obtain the intermediate node feature vector output by the current temporal conditional spatial attention layer; and a first characterization submodule, used to characterize the intermediate node feature vector output by the last temporal conditional spatial attention layer as the target node feature vector.

[0023] Furthermore, the fourth determining submodule includes: a sixth determining submodule, used to determine the initial attention weight of a neighboring node in the current time-conditional spatial attention layer based on the weights of the current time-conditional spatial attention layer, attention parameters, the intermediate node feature vectors of the account node, and the intermediate node feature vectors of the neighboring nodes; a seventh determining submodule, used to determine the time decay factor of a neighboring node based on decay parameters, time normalization factors, transaction timestamps of the associated edges between the account node and the neighboring node, and the current time; and an eighth determining submodule, used to determine the time-conditional attention weight of each neighboring node in the current time-conditional spatial attention layer based on balance parameters, the initial attention weight of each neighboring node, and the time decay factor.

[0024] According to another aspect of the present invention, a computer program product is also provided, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements any of the above-described methods for monitoring transaction accounts.

[0025] According to another aspect of the present invention, an electronic device is also provided, including one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement any of the above-described methods for monitoring transaction accounts.

[0026] In this invention, raw transaction data of the current time window is collected, and a dynamic graph of the current moment is constructed based on the raw transaction data. The dynamic graph is input into a preset classification model, and the risk category corresponding to each transaction account is output, thereby solving the technical problem of low accuracy in monitoring transaction accounts in related technologies.

[0027] In this invention, an anomaly monitoring method based on a dynamic spatiotemporal graph neural network is adopted. By collecting raw transaction data within the current time window, a dynamic graph containing account nodes, related edges, and account node feature matrices is constructed. This dynamic graph is then input into a preset classification model based on a spatiotemporal conditional attention mechanism. This achieves the goal of accurately calculating the spatiotemporal dependencies between nodes and outputting the risk category corresponding to each transaction account. This realizes the technical effect of deeply integrating transaction timeliness with topology structure and dynamically assessing the differences in the impact of historical transactions on current risks. In turn, it solves the technical problems of traditional static rules being easily circumvented, having a high false alarm rate, and traditional machine learning models being unable to capture complex fund flow patterns and cope with the risk perception of dynamically changing financial transaction networks. Attached Figure Description

[0028] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings:

[0029] Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing a method for monitoring trading accounts is shown.

[0030] Figure 2 This is a flowchart of a method for monitoring transaction accounts according to Embodiment 1 of the present invention;

[0031] Figure 3 This is a schematic diagram of an optional temporal-conditional spatial attention layer processing flow according to an embodiment of the present invention;

[0032] Figure 4 This is a schematic diagram of an optional transaction monitoring method based on a dynamic spatiotemporal graph neural network according to an embodiment of the present invention;

[0033] Figure 5 This is a schematic diagram of an optional transaction account monitoring device according to an embodiment of the present invention;

[0034] Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0035] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0036] It should be noted that the terms "first," "second," etc., used in this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0037] It should be noted that all related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, and displayed data) collected and involved in this invention are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of related data all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary measures have been taken to ensure compliance with public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, a request to obtain the information needs to be sent to the aforementioned user or organization through the interface. After receiving consent from the aforementioned user or organization, the relevant information is obtained. If the user chooses to refuse, the process proceeds to an expert decision-making process.

[0038] In this invention, a method combining dynamic evolution transaction graph modeling and spatiotemporal conditional attention mechanism is proposed through the construction of dynamic graphs and spatiotemporal conditional attention, which can handle complex, accurate, and real-time updated intelligent monitoring scenarios.

[0039] In this invention, a dynamic graph is constructed, modeling discrete transaction flows as a continuous-time dynamic heterogeneous graph. Transaction timeliness encoding and dynamic edge weights are introduced, making the graph structure itself a carrier of temporal semantics, allowing for incremental updates rather than static graphs. Furthermore, a temporal-conditional spatial attention layer is designed. When aggregating neighbor information, it considers not only topological connections but also uses transaction time differences as the core condition for attention calculation. This enables the model to dynamically evaluate the varying impacts of different historical transactions on current risk assessments, which is more effective than timestamp feature concatenation or independent temporal modules, achieving deep coupling between spatial topology and temporal dynamics.

[0040] The present invention will now be described in detail with reference to various embodiments.

[0041] Example 1

[0042] According to an embodiment of this application, an embodiment of a method for monitoring transaction accounts is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0043] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method for monitoring trading accounts is shown. Figure 1 As shown, computer terminal 10 (or mobile device) may include one or more ( Figure 1 The processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions may also be included. In addition, it may include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera, wherein the network interface can be connected to wired and / or wireless networks. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0044] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0045] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the transaction account monitoring method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned transaction account monitoring method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0046] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0047] The display may be, for example, a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0048] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for monitoring trading accounts is shown. Figure 2 This is a flowchart of a transaction account monitoring method according to Embodiment 1 of the present invention, as follows: Figure 2As shown, the method includes the following steps:

[0049] Step S201: Collect raw transaction data for the current time window, wherein the current time window is determined based on the current time and a preset time window.

[0050] In this embodiment of the invention, the original transaction records of the bank's transaction system are obtained, and a fixed time span is set as a preset time window. Based on the current system time Based on this, the time window is captured. ] Transaction records within.

[0051] Here, "current moment" refers to the real-time point in time when the monitoring task is executed; "preset time window" refers to a fixed duration interval used to limit the timeliness of data; "raw transaction data" refers to a transaction sequence containing the transaction initiating account, receiving account, transaction amount, and transaction timestamp, which can be represented as: ,in, This represents the account pair at time k. This represents the transaction amount between account pairs at time k. This represents the timestamp, and K represents the total number of moments.

[0052] This step filters out recent transaction data with timeliness from a massive amount of historical transactions to ensure that the data processed by the subsequent model can reflect the latest capital flow, thereby guaranteeing the real-time nature and relevance of the monitoring results.

[0053] Step S202: Based on the original transaction data, construct a dynamic graph for the current moment. The dynamic graph includes: account nodes, related edges, and an account node feature matrix. Each account node corresponds to a transaction account.

[0054] In this embodiment of the invention, the filtered raw transaction data is transformed into graph-structured data. Here, account nodes refer to entities representing bank transaction accounts, and the node set remains persistent over time; associated edges are directed lines connecting two account nodes, representing the transaction relationship between accounts, and edge features include total transaction amount, number of transactions, and the most recent transaction timestamp; the account node feature matrix is ​​a vector set containing static attributes (such as account type and account opening duration) and dynamic attributes (such as current balance and recent transaction frequency) for each account. For example, when constructing a dynamic graph, transactions of the same account pair within a time window can be aggregated to generate edges with temporal semantics, and the node features can be updated.

[0055] This step transforms discrete transaction flows into structured graph data. By using dynamic edge timestamp encoding, the graph structure can reflect the time decay characteristics of transactions, providing the model with input rich in spatiotemporal information.

[0056] Step S203: Input the dynamic graph into the preset classification model and output the risk category corresponding to each trading account. The preset classification model is a model built based on the spatiotemporal conditional attention mechanism.

[0057] In this embodiment of the invention, the constructed dynamic graph is input into a preset classification model for inference calculation. The preset classification model refers to a deep learning model built on a spatiotemporal conditional attention mechanism. This mechanism introduces a learnable decay factor based on time difference when calculating the attention weights between nodes, making recent transactions have a greater impact on the current risk assessment. The risk category refers to the account risk level output by the model, such as normal, low risk, or high risk. Here, the model aggregates neighbor node information through multiple spatiotemporal conditional attention layers to capture the propagation path of funds in the spatiotemporal network, and finally outputs the probability of each account belonging to each category through a classification head.

[0058] This step utilizes deep learning models to automatically uncover risk patterns in complex trading networks, and improves the accuracy of identifying abnormal trading behavior and reduces the false positive rate through a dynamic weight allocation mechanism.

[0059] In summary, this anomaly detection method, based on a dynamic spatiotemporal graph neural network, collects raw transaction data within the current time window to construct a dynamic graph containing account nodes, related edges, and account node feature matrices. This dynamic graph is then input into a pre-defined classification model built on a spatiotemporal conditional attention mechanism. This achieves the goal of accurately calculating the spatiotemporal dependencies between nodes and outputting the risk category corresponding to each transaction account. This enables the deep integration of transaction timeliness with topology and the dynamic assessment of the differences in the impact of historical transactions on current risks. Furthermore, it solves the technical problems of traditional static rules being easily circumvented, having a high false alarm rate, and traditional machine learning models being unable to capture complex fund flow patterns and cope with the risk perception of dynamically changing financial transaction networks.

[0060] To improve the accuracy of constructing the dynamic graph, in the transaction account monitoring method provided in Embodiment 1 of this application, transaction accounts are extracted from the original transaction data and mapped to corresponding account nodes; account nodes with transaction associations are determined based on the original transaction data, and association edges are constructed between account nodes with transaction associations; for each association edge, dynamic edge features of the association edge are generated based on all transaction flows associated with the two account nodes connected by the association edge; static feature vectors and dynamic feature vectors corresponding to each account node are determined, and an account node feature matrix is ​​constructed based on the static feature vectors and dynamic feature vectors corresponding to each account node; and a dynamic graph is constructed based on all account nodes, all association edges, and the account node feature matrix.

[0061] In this embodiment of the invention, the core of dynamic graph construction lies in how to transform the original transaction flow into graph edges with temporal semantics. Instead of simply aggregating transactions into static edges, this embodiment adds precise timestamps and timeliness to the transactions.

[0062] The original transaction logs of a bank's transaction system are modeled as a dynamic heterogeneous graph on a discrete time series. Assume there exists a time series... T represents the total number of time points. At each time point... The system state can be represented as a graph.

[0063] Among them, the node set : Represents all bank accounts (customers), size is Nodes are persistent and do not disappear over time.

[0064] Time edge set Defined as .in, Represents the set of positive real numbers, triples Indicates within the time window Inside, account to account A transaction was initiated, and the timestamp of the most recent transaction is [timestamp value missing]. . This is the size of the time-sliding window of the graph.

[0065] Node feature matrix : No. OK Indicates account In time The vectorized features include static features (account type, account opening duration, and location) and dynamic features (current...). Account balance, recent (Total number of transactions within a given time period) This represents a real matrix with dimensions N rows and d columns.

[0066] Dynamic edge generation algorithm, input: original transaction flow Current system time Time window Output: Set of edges in a dynamic graph. And edge features. Time window filtering: Select all timestamps. satisfy Transactions. Side grouping and time-sensitive coding: For each group of accounts... All transactions within this window are aggregated.

[0067] Constructing dynamic edges: For each pair Create a directed edge with the following characteristics: And record its valid time as This means that the degree to which this edge "survives" and is noticed in the graph will change with the current time. and The difference increases and then decreases. This construction method ensures that each edge of the graph carries rich spatiotemporal pattern information, providing high-quality structured input for subsequent neural networks.

[0068] Specifically, the original transaction flow within the current time window is traversed, all unique account identifiers appearing in it are extracted as a set of transaction accounts, and each unique transaction account is uniquely mapped to a node in the graph structure. This node is the account node, which is used to represent the entity account in the graph.

[0069] Filter out account pairs with direct fund transfer records within the current time window, confirm that there is a transaction relationship between the corresponding account nodes of these account pairs, and establish directed connections between these account nodes with transaction relationships. These connections are called association edges, which are used to represent the direction of fund flow and connection relationship.

[0070] For each associated edge, retrieve all relevant transaction records of the two account nodes connected to it within the current time window, aggregate and calculate the total amount and total number of transactions of these transaction records, extract the timestamp of the most recent transaction, and record the transaction channel and counterparty type. Combine these aggregated data to form the feature vector of the associated edge, which is the dynamic edge feature.

[0071] For each account node, extract its attribute data that does not change over time (such as account type, account opening duration, and location) and encode it into a static feature vector. Extract its attribute data that changes over time (such as current account balance and total number of transactions within the current time window) and encode it into a dynamic feature vector. Concatenate or merge the static feature vectors and dynamic feature vectors of all account nodes to form a matrix containing the feature information of all nodes, which is the account node feature matrix.

[0072] All account nodes, all associated edges with weighted features, and the account node feature matrix are combined to form a complete graph structure object, which is defined as a dynamic graph.

[0073] In this embodiment, by meticulously dissecting the construction process of the dynamic graph, the node mapping, edge relationship establishment, edge spatiotemporal feature aggregation, and node multidimensional feature fusion are clarified. This ensures that the input dynamic graph can accurately reflect the true form and dynamic evolution of the financial transaction network within a specific time window, providing a high-quality, high-information-density structured foundation for subsequent risk prediction based on spatiotemporal conditional attention mechanisms.

[0074] To improve the accuracy of generating dynamic edge features for associated edges, in the transaction account monitoring method provided in Embodiment 1 of this application, the timestamp of each transaction is determined, and the latest timestamp is used as the transaction timestamp of the associated edge; all transaction flows are aggregated to obtain the total amount, total number of transactions, counterparty account type, and transaction channel for each transaction; based on the total amount, total number of transactions, transaction timestamp, counterparty account type, and transaction channel, dynamic edge features for associated edges are generated.

[0075] In this embodiment of the invention, for all historical transaction records between two account nodes constituting a certain associated edge, the specific time of each transaction is extracted as a timestamp, and the timestamp with the largest value is selected and defined as the transaction timestamp of the associated edge. This timestamp is used to characterize the latest activity level of the transaction relationship represented by the associated edge. In this way, dynamic edges are given a time-sensitive identifier, ensuring that the model can perceive the latest status of fund transactions, thereby distinguishing the differences in the contribution of transactions with different timeliness to risk assessment in subsequent calculations.

[0076] For all transaction flows connected to the same pair of account nodes, a statistical summary operation is performed. The sum of these transaction amounts is calculated as the total amount, the number of transaction records is counted as the total number of transactions, the identity attribute code of the receiving account is extracted as the counterparty account type, and the channel information where the transaction occurred is summarized or marked as the transaction channel. In this way, discrete, fine-grained raw transaction data is transformed into macroscopic statistical features, and key indicators reflecting the scale, intensity, and behavioral patterns of interactions between accounts are extracted, providing basic data support for constructing edge features.

[0077] The total amount, total number of transactions, latest timestamp used as edge timestamp, counterparty account type, and transaction channel obtained from aggregation are combined into a vector according to a predetermined order or encoding rules. This vector is the dynamic edge feature of the associated edge, used as the input attribute of the edge in the graph neural network. In this way, multi-dimensional transaction statistics and time information are structured and encoded into the edge features, so that the dynamic graph not only has topological connections but also rich semantic information, thereby improving the model's ability to recognize complex transaction patterns (such as high-frequency small-amount transactions, transfers through specific channels, etc.).

[0078] For example, suppose there is a common The transaction, timestamp: The edge's time summary vector records the total number of transactions and the total amount, and also creates a time summary vector. To describe the time distribution pattern of transactions.

[0079] Total amount, total number of times [Transaction channels], among which, The timestamp of the most recent transaction is an absolute time.

[0080] In this embodiment, by clearly defining the generation logic of the dynamic edge features of the associated edges, the key elements are extracted and aggregated from the original transaction flow, ensuring that the dynamic edges can fully carry multi-dimensional information such as transaction amount, frequency, timeliness and channel type. This improves the ability of the dynamic graph to express the dynamic evolution and risk characteristics of the financial transaction network, and lays a solid data foundation for the accurate calculation of the subsequent spatiotemporal attention mechanism.

[0081] To improve the prediction accuracy of the preset classification model, in the transaction account monitoring method provided in Embodiment 1 of this application, before inputting the dynamic graph into the preset classification model and outputting the risk category corresponding to each transaction account, an initial classification model is constructed based on the spatiotemporal conditional attention mechanism. The model structure of the initial classification model includes: multiple layers of spatiotemporal conditional attention layers and a classification head; each layer of spatiotemporal conditional attention is followed by residual connections and layer normalization. The spatiotemporal conditional attention layers are used to output the feature matrix of intermediate nodes based on the spatiotemporal conditional attention weights; the classification head is used to output the risk category of each account node based on the target node feature matrix output by the last layer of spatiotemporal conditional attention layers; historical transaction data is collected and processed to obtain training data; the initial classification model is trained using the training data to obtain the preset classification model.

[0082] In this embodiment of the invention, a deep learning network architecture, namely the initial classification model, is constructed based on the spatiotemporal conditional attention mechanism. This architecture consists of several stacked spatiotemporal conditional attention layers, with residual connections and layer normalization modules connected in series at the output of each layer, and finally connected to a classification head. The spatiotemporal conditional attention mechanism refers to an algorithm that introduces a learnable decay factor based on time difference as part of the attention coefficient when calculating the attention weights between nodes; the multi-layer spatiotemporal conditional attention layer refers to a neural layer that repeatedly performs information aggregation operations based on spatiotemporal conditional attention weights; the residual connection refers to a skip connection structure that directly adds the input of the current layer to the output of the current layer; the layer normalization refers to a normalization operation that standardizes the layer output; the intermediate node feature matrix refers to the set of node features containing partial contextual information in the outputs of each layer except the last layer; the target node feature matrix refers to the final set of node features output by the last spatiotemporal conditional attention layer; and the classification head refers to a multilayer perceptron used to map high-dimensional features to class probabilities. By constructing a deep network structure with time awareness, using residuals and normalization for stable training, and gradually aggregating multi-hop spatiotemporal information, the complex graph structure features are ultimately transformed into interpretable risk classification probabilities.

[0083] Collect all transaction records and corresponding tag information for past time periods, perform preprocessing operations such as cleaning, deduplication, and missing value imputation on the raw data, and divide the data into training set, validation set, and test set according to time order to construct a dataset containing input feature vectors and corresponding real risk labels.

[0084] Training data is input into the initial classification model. Forward propagation is used to calculate the predicted risk category, and the loss function between the predicted result and the true label is calculated. Then, backpropagation is used to update all learnable parameters in the model, including attention mechanism parameters, linear transformation matrix, and classifier head weights, until the model converges or reaches the preset number of iterations. Supervised learning is then used to optimize the model parameters, minimizing the prediction error on historical data, thus obtaining the final model with high-precision risk identification capabilities—the preset classification model.

[0085] In this embodiment, by defining the internal structure of the initial classification model, the method of acquiring training data, and the specific process of model training, it is clarified how to implement the spatiotemporal conditional attention mechanism into an executable algorithm model, ensuring that the final preset classification model can fully utilize the temporal dynamics and spatial topology of transactions to achieve accurate, efficient, and robust automated monitoring of transaction risks.

[0086] To improve the accuracy of determining training data, in the transaction account monitoring method provided in Embodiment 1 of this application, historical transaction data is divided into historical transaction sub-data corresponding to different historical time windows. The historical transaction data includes multiple historical transaction records, and each historical transaction record includes: transaction account pair, transaction amount, and timestamp. For each historical time window, a historical dynamic graph of the historical time window is constructed based on the historical transaction sub-data corresponding to the historical time window. Based on the transaction results corresponding to the historical transaction sub-data, each transaction account in the historical dynamic graph is categorized to obtain a categorized set. Training data is constructed based on the historical dynamic graph and the categorized set.

[0087] In this embodiment of the invention, a complete dataset containing multiple historical transaction records is obtained. Each record includes the initiating account, the receiving account, the transaction amount, and the occurrence time. The dataset is divided into multiple consecutive or overlapping time slices according to the time axis. Each slice is a historical time window. Transaction records falling within the window are selected from the total data to form the historical transaction sub-data corresponding to the window.

[0088] For each historical time window, the graph structure at that moment is constructed using its corresponding historical transaction sub-data according to the dynamic graph construction logic (including generating account nodes, determining related edges, and calculating edge characteristics, etc.), which is the historical dynamic graph.

[0089] Based on the actual risk assessment results within the time window or for the account subsequently (such as whether it is identified as an abnormal risk account), a risk label is assigned to each node in the historical dynamic graph, and the set of labels for all nodes constitutes a label category set.

[0090] The graph structure data of the historical dynamic graph corresponding to each historical time window is paired with its corresponding labeled category set to form the sample pairs required for supervised learning, i.e., training data.

[0091] In this embodiment, by clarifying the construction process of historical training data, it specifies how to use the full historical data to generate labeled dynamic graph samples, ensuring that the training data can reflect the real risk status of fund flows in different time segments. This enables the preset classification model to learn effectively based on sufficient historical risk patterns, improving the accuracy and generalization ability of identifying unknown abnormal behaviors.

[0092] To improve the accuracy of training the initial classification model, in the transaction account monitoring method provided in Embodiment 1 of this application, the initial classification model is trained based on training data using a preset cross-entropy loss function to obtain the loss value for each iteration. The loss value is calculated using the preset cross-entropy loss function based on the predicted category set and the labeled category set. The predicted category set is the set of predicted categories for each transaction account output by the initial classification model. If the loss value is less than a preset loss threshold, training is considered complete, and a target model parameter set is obtained. The target model parameter set includes at least the weights, attention parameters, balance parameters, and decay parameters corresponding to each temporal conditional spatial attention layer. Based on the target model parameter set, the initial classification model is adjusted to obtain a preset classification model.

[0093] In this embodiment of the invention, the constructed training data is input into an initial classification model. The model forward propagates and outputs the probability distribution of each node belonging to each category, thereby forming a predicted category set. Then, this predicted category set and the true labeled category set in the training data are input into a preset cross-entropy loss function, and the difference between the two is calculated. This value is the learning loss value for this iteration, used to guide the direction of model parameter updates. In this way, by quantifying the error between the prediction result and the true label, a clear optimization objective is provided for the model, enabling the model to adjust its internal parameters according to the magnitude of the error to reduce prediction bias.

[0094] The training iterative process is continuously executed. After each iteration, the current loss value is checked to see if it is lower than a pre-set convergence criterion (preset loss threshold). When the loss value meets this condition, training stops, and the state of all learnable parameters in the model at this point is saved, forming the target model parameter set. The target model parameter set includes at least the following: weights, attention parameters, balance parameters, and decay parameters for each temporal conditional spatial attention layer. Weights refer to the linear transformation matrix parameters; attention parameters refer to the learnable vector parameters used to calculate the attention coefficients; balance parameters adjust the ratio of feature importance to temporal importance; and decay parameters control the rate of temporal decay.

[0095] After training, the set of target model parameters saved is loaded back into the architecture of the initial classification model, replacing the parameters of the initial random initialization or intermediate state, thereby fixing the inference ability of the model and forming the final preset classification model.

[0096] For example, supervised learning cross-entropy loss is used, and class weights are introduced to address the imbalance of positive and negative samples in abnormal transaction monitoring scenarios. The loss function is expressed as:

[0097] ;

[0098] in, For category The weights, where m represents the number of categories. With categories in the training set The sample size is inversely proportional to the number of samples to alleviate class imbalance. (like , ) are the model feature values. It is the target set.

[0099] In this embodiment, by defining the training process based on the cross-entropy loss function, the convergence judgment conditions, and the extraction and application of the final parameters, the complete transformation path of the model from the training state to the deployment state is clarified. In particular, the optimization methods of key hyperparameters (such as balance parameters and decay parameters) in the temporal conditional spatial attention mechanism are specified, ensuring that the preset classification model can fully learn the temporal dynamic features and spatial topological features of transactions during the training process. This achieves automated optimization and stable convergence of model performance, providing a high-precision and interpretable model foundation for subsequent real-time abnormal transaction monitoring.

[0100] To improve the accuracy of determining the risk category corresponding to each trading account, in the trading account monitoring method provided in Embodiment 1 of this application, for each account node, the account time sequence code is determined based on the feature vector corresponding to each transaction of the account node within the current time window; the node feature matrix and the account time sequence code are fused to obtain the initial node feature vector of the account node; the initial node feature vector is processed by a multi-layer temporal conditional spatial attention layer in a preset classification model to obtain the target node feature vector of the account node; a target node feature matrix is ​​constructed based on the target node feature vector of each account node; the target node feature matrix is ​​processed by a classification head in a preset classification model to obtain the risk category of the trading account indicated by each account node.

[0101] In this embodiment of the invention, for each account node in the figure, all transaction records of it as the initiator or receiver within the current time window are extracted. The transaction amount, counterparty type, channel and other attributes of each transaction are constructed into a transaction feature vector, and the vector is arranged in chronological order and input into a recurrent neural network (such as GRU (Gated Recurrent Unit) or LSTM (Long Short-Term Memory)). Through time series modeling, a high-dimensional vector reflecting the recent transaction behavior pattern of the account is extracted, which is the account time series encoding.

[0102] For example, the time-series feature vector obtained by processing recent transaction sequences using GRU includes transaction amount, counterparty type, and transaction channel, for nodes. In the window All relevant transactions (as an inflow sequence) are encoded to obtain:

[0103] ;

[0104] in, The account time sequence code representing time t, It is the feature vector of a single transaction, and M represents the number of transactions.

[0105] The data in the constructed node feature matrix containing static and dynamic attributes are concatenated or linearly mapped and fused with the generated account time-series code in the vector dimension to form a comprehensive feature vector containing account identity, current status and historical behavior time-series information. This vector is the initial node feature vector.

[0106] For example, at time step For each node (account) Construct its initial node features This feature is not only a combination of static and dynamic features, but also incorporates the temporal characteristics of its recent trading activities.

[0107] ;

[0108] in, : Static feature vector of the account, including account type, account opening duration, and location. : Account dynamic feature vector, including current Account balance, recent Total number of transactions within a given time period Account time sequence code, Vector concatenation operation Multilayer perceptron, used to fuse feature vectors. , Represents the feature space.

[0109] The initial node feature vector is input into a preset classification model and passed through multiple temporal conditional spatial attention layers. Each layer uses a time decay factor to adjust the attention weights of neighboring nodes, aggregates multi-hop neighbor information, and undergoes nonlinear activation, residual connection and layer normalization processing. Finally, the node representation after deep spatiotemporal feature extraction is output, which is the target node feature vector.

[0110] Arrange the target node feature vectors output by the last temporal conditional spatial attention layer of all account nodes in the graph in order of node ID (identifier), and combine them into a matrix containing the final features of all nodes, which is the target node feature matrix.

[0111] The target node feature matrix is ​​input into the classification head (usually a multilayer perceptron) at the end of the preset classification model. Through fully connected layers and Softmax (an activation function), the high-dimensional feature vector is mapped to the probability distribution of each risk level (such as normal, low risk, and high risk). The category with the highest probability is selected as the final output, which is the risk category.

[0112] For example, by The calculation of layer TCSA (Temporal-Conditioned Spatial Attention) results in the updated node feature matrix as follows: (i.e., the feature matrix of the target node) (representing the feature space), the specific model is for each node. Generate a representation vector that includes its spatiotemporal context. It uses a multilayer perceptron as the classification head to output the final model result.

[0113] ;

[0114] ;

[0115] in, These are the model feature values. It is a node In time Risk level prediction probability distribution (normal, low risk, high risk). This represents a multilayer perceptron. This represents the activation function.

[0116] In this embodiment, by establishing a complete inference chain from temporal coding generation, feature fusion, deep spatiotemporal attention processing to final risk classification, the data processing flow of the preset classification model in real-time monitoring scenarios is clarified. This ensures that the risk assessment of each account node can fully reflect the dynamic changes in its short-term trading behavior and the complex correlation of its long-term capital network, thereby improving the real-time performance, accuracy, and robustness of abnormal transaction monitoring.

[0117] In one alternative embodiment, when a new transaction arrives, an incremental graph update is triggered: the characteristics of the relevant nodes and edges are updated, and edges are inserted or refreshed. (Updated to the current time). The updated dynamic graph (involving changed nodes) is input into the trained model. The model outputs a risk assessment of the updated nodes.

[0118] To improve the accuracy of determining the target node feature vector of an account node, the transaction account monitoring method provided in Embodiment 1 of this application determines the set of neighbor nodes of the account node; for each temporal conditional spatial attention layer, based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor, the temporal conditional attention weight of each neighbor node in the set of neighbor nodes in the current temporal conditional spatial attention layer is determined, wherein the initial node feature vector of the first temporal conditional spatial attention layer is used as the intermediate node feature vector; based on the temporal conditional attention weight of each neighbor node, the intermediate node feature vector, and the weight of the current temporal conditional spatial attention layer, the aggregation information of the account node is determined; residual connection is performed on the aggregation information and the intermediate node feature vector to obtain the connection vector, and layer normalization is performed on the connection vector to obtain the intermediate node feature vector output by the current temporal conditional spatial attention layer; the intermediate node feature vector output by the last temporal conditional spatial attention layer is represented as the target node feature vector.

[0119] In this embodiment of the invention, traditional graph attention networks compute neighbors. For the target node When considering the importance of a transaction, it is based solely on its feature similarity. In a dynamic transaction graph, the timing of a transaction is crucial: a transaction from one hour ago and a transaction from one week ago, even with the same amount and counterparty, will have different impacts on the current node's risk status. Therefore, this embodiment defines Temporal-Conditioned Spatial Attention (TCSA). The attention calculation process for the Temporal-Conditioned Spatial Attention layer is as follows:

[0120] Traverse the current dynamic graph For the target account node i, filter out all nodes that are directly linked to node i (in-degree neighbors) or other nodes pointed to by node i (out-degree neighbors), and denote the set of these nodes as . That is, the set of neighboring nodes.

[0121] Starting from the first layer, attention calculations are performed sequentially: for the first layer, the initial node feature vectors are used as input; for the next layer... Layer, using the first The time decay factor is calculated by combining the intermediate node feature vectors output by the layer with the latest transaction timestamps of the edges connecting the target node and its neighbors. Calculate the contribution of each neighbor node j to the target node i, i.e., the time-conditional attention weight. .

[0122] The feature vector of each neighbor node j in the neighbor node set. Multiply by its corresponding time-conditional attention weight The aggregated information is obtained by summing the weighted feature vectors of all neighbors. .

[0123] Aggregate information The intermediate node feature vectors output from the previous layer The sums are used to obtain the residual connection vector. Then, layer normalization (LayerNorm) is applied to this vector, followed by a non-linear activation function to generate the new intermediate node feature vector of the current layer output. .

[0124] When the network is stacked to the Lth layer, the intermediate node feature vectors output by all nodes in the Lth layer are... This is directly used as the final feature representation of the node after full-text extraction, which is the target node feature vector.

[0125] For example, the normalized temporal conditional attention weights are obtained (temporal conditional attention weights) After that, the node Aggregate information from its neighbors:

[0126] ;

[0127] in, It is a non-linear activation function. Indicates the first Layer weights.

[0128] To stabilize the training of deep networks, residual connections and layer normalization are added to obtain the final output of the layer:

[0129] ;

[0130] By stacking The TCSA layer enables multi-hop temporal pattern awareness and node fusion. Information about hop neighbors. Because each layer emphasizes temporal proximity through a time decay factor during aggregation, the model can naturally model the propagation path of transactions on the spatiotemporal network. For example, it can capture the anomalous transaction pattern of "funds rapidly transferring through multi-hop accounts in a short period of time" because each edge on the path satisfies the condition of small time decay, thus activating the entire path in the model.

[0131] In this embodiment, by defining the internal computational logic of the temporal conditional spatial attention layer and applying residual connections and layer normalization, the model is clarified on how to progressively deepen the extraction of the spatiotemporal characteristics of the transaction network. This ensures that the model can accurately capture abnormal transaction patterns such as "short-term multi-hop rapid transfer", thereby improving the accuracy of risk identification and adaptability to complex dynamic transaction networks.

[0132] To improve the accuracy of determining time-conditional attention weights, in the transaction account monitoring method provided in Embodiment 1 of this application, the initial attention weight of a neighboring node in the current time-conditional spatial attention layer is determined based on the weight of the current time-conditional spatial attention layer, attention parameters, the intermediate node feature vector of the account node, and the intermediate node feature vector of the neighboring node; the time decay factor of the neighboring node is determined based on the decay parameter, time normalization factor, transaction timestamp of the associated edge between the account node and the neighboring node, and the current time; and the time-conditional attention weight of each neighboring node in the current time-conditional spatial attention layer is determined based on the balance parameter, the initial attention weight of each neighboring node, and the time decay factor.

[0133] In this embodiment of the invention, learnable attention parameters (weights) are utilized. and attention parameters ), respectively, for the intermediate node feature vectors of the target account node The feature vectors of the intermediate nodes of the nodes and their neighbors The transformation and concatenation are performed, and the correlation score between the two in the feature space is calculated using a non-linear activation function (such as LeakyReLU), which serves as the initial attention weight. .

[0134] For example, for a node and its dynamic graph Neighbors First, calculate an unnormalized attention coefficient:

[0135] ;

[0136] in, For nodes In the Layers, Time The hidden representation, For nodes In the Layers, Time The hidden representation, For the first The learnable parameters of the layer For the first The attention mechanism of the layer can learn parameters. This is a vector concatenation operation. As a scalar, reflecting the neighbors On the feature space The importance of.

[0137] Get the latest transaction timestamps recorded by the edges connecting the target account node and its neighboring nodes. Combined with the system's current time t and the learnable decay parameters and time normalization factor Substitute into the preset negative exponential decay formula The time decay factor is calculated. .in, For connecting nodes and The latest transaction timestamp corresponding to the edge (from dynamic edge features) ); It is a learnable parameter that controls the decay rate; It is the time normalization factor. This function guarantees... The closer to the current time , The larger the value, the smaller the decay, thus giving the neighbors corresponding to recent transactions a greater weight in attention allocation.

[0138] The initial attention weights of each neighbor node , With the corresponding time decay factor Multiply by a learnable equilibrium parameter The scores are then summed to obtain a comprehensive score. The comprehensive scores of all neighboring nodes are then normalized, and the weights, in the form of a probability distribution, are output as the time-conditional attention weights. .

[0139] For example, due to the initial attention weights Lacking time perception, a time decay factor is introduced. This is incorporated as a condition into attention calculation:

[0140] ;

[0141] in, For connecting nodes and The latest transaction timestamp corresponding to the edge (from dynamic edge features) ), It is a time-conditional function. It is a learnable parameter used to balance feature importance. Importance of time Contribution to final attention.

[0142] In this embodiment, by refining the calculation process of time-conditional attention weights, it specifies how to combine static feature correlation with dynamic time decay mechanism, establishes the quantitative relationship between "feature importance" and "time sensitivity" in attention allocation, and enables the model to adaptively adjust the degree of attention to historical transaction information, thereby more accurately identifying abnormal transaction behavior patterns with time sensitivity.

[0143] Figure 3 This is a schematic diagram of an optional temporal-conditional spatial attention layer processing flow according to an embodiment of the present invention, as shown below. Figure 3 As shown, combining the input node features of the TCSA layer, the dynamic graph structure information, and the current time t, the core calculation process of the TCSA layer includes: feature linear transformation, calculation of the original attention coefficient, injection of the temporal condition factor, aggregation of neighbor information, residual connection and normalization, and finally, the TCSA layer outputs the updated node features.

[0144] Figure 4 This is a schematic diagram of an optional transaction monitoring method based on a dynamic spatiotemporal graph neural network according to an embodiment of the present invention, such as... Figure 4 As shown, it includes: data access and preprocessing, construction of dynamic graph, node feature initialization, temporal conditional spatial attention layer, model training, and risk assessment.

[0145] The transaction account monitoring method provided in this application adopts an anomaly monitoring approach based on a dynamic spatiotemporal graph neural network. By collecting raw transaction data within the current time window, a dynamic graph containing account nodes, related edges, and account node feature matrices is constructed. This dynamic graph is then input into a preset classification model constructed based on a spatiotemporal conditional attention mechanism. This achieves the goal of accurately calculating the spatiotemporal dependencies between nodes and outputting the risk category corresponding to each transaction account. As a result, the technical effect of deeply integrating transaction timeliness with topological structure and dynamically assessing the differences in the impact of historical transactions on current risks is realized.

[0146] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0147] Example 2

[0148] This application also provides a trading account monitoring device. It should be noted that the trading account monitoring device of this application can be used to execute the trading account monitoring method provided in this application. The following describes the trading account monitoring device provided in this application.

[0149] According to an embodiment of this application, an apparatus for implementing the above-described method for monitoring transaction accounts is also provided. Figure 5 This is a schematic diagram of an optional transaction account monitoring device according to an embodiment of the present invention, such as... Figure 5 As shown, the monitoring device may include: a data acquisition unit 50, a data acquisition unit 51, and an input unit 52.

[0150] The acquisition unit 50 is used to acquire raw transaction data for the current time window, wherein the current time window is determined based on the current time and a preset time window.

[0151] Construction unit 51 is used to construct a dynamic graph at the current moment based on the original transaction data. The dynamic graph includes: account nodes, associated edges, and account node feature matrix. Each account node corresponds to a transaction account.

[0152] Input unit 52 is used to input dynamic graphs into a preset classification model and output the risk category corresponding to each trading account. The preset classification model is a model built based on spatiotemporal conditional attention mechanism.

[0153] The transaction account monitoring device provided in this application adopts an anomaly monitoring method based on a dynamic spatiotemporal graph neural network. By collecting raw transaction data within the current time window, it constructs a dynamic graph containing account nodes, related edges, and account node feature matrices. This dynamic graph is then input into a preset classification model constructed based on a spatiotemporal conditional attention mechanism. This achieves the goal of accurately calculating the spatiotemporal dependencies between nodes and outputting the risk category corresponding to each transaction account. This realizes the technical effect of deeply integrating transaction timeliness with topology structure and dynamically assessing the differences in the impact of historical transactions on current risks. In turn, it solves the technical problems of traditional static rules being easily circumvented, having a high false alarm rate, and traditional machine learning models being unable to capture complex fund flow patterns and cope with the risk perception of dynamically changing financial transaction networks.

[0154] Optionally, the construction unit includes: a first extraction module, used to extract transaction accounts from the original transaction data and map the transaction accounts to corresponding account nodes; a first construction module, used to determine account nodes with transaction associations based on the original transaction data and construct association edges between account nodes with transaction associations; a first generation module, used to generate dynamic edge features of each association edge based on all transaction flows associated with the two account nodes connected by the association edge; a first determination module, used to determine the static feature vector and dynamic feature vector corresponding to each account node, and construct an account node feature matrix based on the static feature vector and dynamic feature vector corresponding to each account node; and a second construction module, used to construct a dynamic graph based on all account nodes, all association edges, and the account node feature matrix.

[0155] Optionally, the first generation module includes: a first determining submodule, used to determine the timestamp of each transaction and use the latest timestamp as the transaction timestamp of the associated edge; a first aggregation submodule, used to aggregate all transaction flows to obtain the total amount, total number of transactions, counterparty account type, and transaction channel for each transaction; and a first generation submodule, used to generate dynamic edge features of the associated edge based on the total amount, total number of transactions, transaction timestamp, counterparty account type, and transaction channel.

[0156] Optionally, the monitoring device further includes: a third construction module, used to construct an initial classification model based on a spatiotemporal conditional attention mechanism before inputting the dynamic graph into the preset classification model and outputting the risk category corresponding to each trading account. The model structure of the initial classification model includes: multiple layers of spatiotemporal conditional attention layers and a classification head; each layer of spatiotemporal conditional attention is followed by a residual connection and layer normalization. The spatiotemporal conditional attention layers are used to output the feature matrix of intermediate nodes based on the spatiotemporal conditional attention weights. The classification head is used to output the risk category of each account node based on the target node feature matrix output by the last layer of spatiotemporal conditional attention layers. A first processing module is used to collect historical trading data and process the historical trading data to obtain training data. A first training module is used to train the initial classification model using the training data to obtain the preset classification model.

[0157] Optionally, the first processing module includes: a first segmentation submodule, used to segment historical transaction data into historical transaction sub-data corresponding to different historical time windows, wherein the historical transaction data includes: multiple historical transaction records, each historical transaction record including: transaction account pair, transaction amount, and timestamp; a first construction submodule, used to construct a historical dynamic graph of each historical time window based on the historical transaction sub-data corresponding to the historical time window; a first annotation submodule, used to annotate each transaction account in the historical dynamic graph with a category based on the transaction results corresponding to the historical transaction sub-data, to obtain an annotation category set; and a second construction submodule, used to construct training data based on the historical dynamic graph and the annotation category set.

[0158] Optionally, the first training module includes: a first training submodule, used to train the initial classification model based on training data using a preset cross-entropy loss function to obtain the loss value for each iteration, wherein the loss value is calculated based on the predicted category set and the labeled category set using the preset cross-entropy loss function, and the predicted category set is the set consisting of the predicted categories of each trading account output by the initial classification model; a second determination submodule, used to determine that training is complete when the loss value is less than a preset loss threshold, and obtain the target model parameter set, wherein the target model parameter set includes at least: the weights, attention parameters, balance parameters, and decay parameters corresponding to each temporal conditional spatial attention layer; and a first adjustment submodule, used to adjust the initial classification model based on the target model parameter set to obtain a preset classification model.

[0159] Optionally, the input unit includes: a second determining module, used to determine the account time sequence code for each account node based on the feature vector corresponding to each transaction of the account node within the current time window; a first fusion module, used to fuse the node feature matrix and the account time sequence code to obtain the initial node feature vector of the account node; a second processing module, used to process the initial node feature vector using a multi-layer temporal conditional spatial attention layer in a preset classification model to obtain the target node feature vector of the account node; a fourth construction module, used to construct the target node feature matrix based on the target node feature vector of each account node; and a third processing module, used to process the target node feature matrix using a classification head in a preset classification model to obtain the risk category of the transaction account indicated by each account node.

[0160] Optionally, the second processing module includes: a third determining submodule for determining the set of neighboring nodes of the account node; a fourth determining submodule for determining, for each temporal conditional spatial attention layer, the temporal conditional attention weight of each neighboring node in the current temporal conditional spatial attention layer based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor, wherein the first temporal conditional spatial attention layer uses the initial node feature vector as the intermediate node feature vector; a fifth determining submodule for determining the aggregation information of the account node based on the temporal conditional attention weight of each neighboring node, the intermediate node feature vector, and the weight of the current temporal conditional spatial attention layer; a first processing submodule for performing a residual connection on the aggregation information and the intermediate node feature vector to obtain a connection vector, and performing layer normalization on the connection vector to obtain the intermediate node feature vector output by the current temporal conditional spatial attention layer; and a first characterization submodule for characterizing the intermediate node feature vector output by the last temporal conditional spatial attention layer as the target node feature vector.

[0161] Optionally, the fourth determining submodule includes: a sixth determining submodule, used to determine the initial attention weight of a neighboring node in the current time-conditional spatial attention layer based on the weights of the current time-conditional spatial attention layer, attention parameters, the intermediate node feature vectors of the account node, and the intermediate node feature vectors of the neighboring nodes; a seventh determining submodule, used to determine the time decay factor of a neighboring node based on decay parameters, time normalization factors, transaction timestamps of the associated edges between the account node and the neighboring node, and the current time; and an eighth determining submodule, used to determine the time-conditional attention weight of each neighboring node in the current time-conditional spatial attention layer based on balance parameters, the initial attention weight of each neighboring node, and the time decay factor.

[0162] The monitoring device described above may also include a processor and a memory. The acquisition unit 50, the construction unit 51, the input unit 52, etc., are all stored in the memory as program units, and the processor executes the program units stored in the memory to realize the corresponding functions.

[0163] The processor mentioned above contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; by adjusting kernel parameters, dynamic graphs are input into a preset classification model, outputting the risk category for each trading account.

[0164] The aforementioned memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0165] It should be noted that the acquisition unit 50, construction unit 51, and input unit 52 mentioned above correspond to steps S201 to S203 in Embodiment 1. The instances and application scenarios implemented by the above units and corresponding steps are the same, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above units can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0166] Example 3

[0167] Embodiments of this application may provide an electronic device. Figure 6 This is a structural block diagram of an electronic device according to an embodiment of the present invention. Figure 6 As shown, the electronic device may include: one or more ( Figure 6 (Only one is shown) Processor 602, memory 604, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0168] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the transaction account monitoring method and apparatus in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned transaction account monitoring method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0169] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: collecting raw transaction data for the current time window, where the current time window is determined based on the current moment and a preset time window; constructing a dynamic graph for the current moment based on the raw transaction data, where the dynamic graph includes: account nodes, related edges, and an account node feature matrix, with each account node corresponding to a transaction account; inputting the dynamic graph into a preset classification model, and outputting the risk category corresponding to each transaction account, where the preset classification model is a model constructed based on a spatiotemporal conditional attention mechanism.

[0170] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: extracting transaction accounts from the original transaction data and mapping the transaction accounts to corresponding account nodes; determining account nodes with transaction associations based on the original transaction data and constructing association edges between account nodes with transaction associations; for each association edge, generating dynamic edge features of the association edge based on all transaction flows associated with the two account nodes connected by the association edge; determining the static feature vector and dynamic feature vector corresponding to each account node, and constructing an account node feature matrix based on the static feature vector and dynamic feature vector corresponding to each account node; and constructing a dynamic graph based on all account nodes, all association edges, and the account node feature matrix.

[0171] The processor can access the information and application stored in the memory via the transmission device to perform the following steps: determine the timestamp of each transaction and use the latest timestamp as the transaction timestamp of the associated edge; aggregate all transaction flows to obtain the total amount, total number of transactions, counterparty account type, and transaction channel for each transaction; and generate dynamic edge features of the associated edge based on the total amount, total number of transactions, transaction timestamp, counterparty account type, and transaction channel.

[0172] The processor can access information and applications stored in memory via a transmission device to execute the following steps: Based on a spatiotemporal conditional attention mechanism, an initial classification model is constructed. The initial classification model's structure includes: multiple layers of spatiotemporal conditional attention and a classification head; each spatiotemporal conditional attention layer is followed by residual connections and layer normalization. The spatiotemporal conditional attention layers are used to output the intermediate node feature matrix based on the spatiotemporal conditional attention weights. The classification head is used to output the risk category of each account node based on the target node feature matrix output by the last spatiotemporal conditional attention layer. Historical transaction data is collected and processed to obtain training data. The initial classification model is trained using the training data to obtain a preset classification model.

[0173] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: dividing historical transaction data into historical transaction sub-data corresponding to different historical time windows, wherein the historical transaction data includes: multiple historical transaction records, each historical transaction record including: transaction account pair, transaction amount, and timestamp; for each historical time window, constructing a historical dynamic graph of the historical time window based on the historical transaction sub-data corresponding to the historical time window; classifying each transaction account in the historical dynamic graph based on the transaction results corresponding to the historical transaction sub-data to obtain a labeled category set; and constructing training data based on the historical dynamic graph and the labeled category set.

[0174] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: Based on the training data, train the initial classification model using a preset cross-entropy loss function to obtain the loss value for each iteration. The loss value is calculated using the preset cross-entropy loss function based on the predicted category set and the labeled category set. The predicted category set is the set of predicted categories for each trading account output by the initial classification model. If the loss value is less than a preset loss threshold, determine that training is complete and obtain the target model parameter set. The target model parameter set includes at least the weights, attention parameters, balance parameters, and decay parameters corresponding to each temporal conditional spatial attention layer. Based on the target model parameter set, adjust the initial classification model to obtain the preset classification model.

[0175] The processor can invoke information and applications stored in the memory via a transmission device to perform the following steps: For each account node, determine the account time sequence code based on the feature vector corresponding to each transaction of the account node within the current time window; fuse the node feature matrix and the account time sequence code to obtain the initial node feature vector of the account node; process the initial node feature vector using a multi-layer temporal conditional spatial attention layer in a preset classification model to obtain the target node feature vector of the account node; construct the target node feature matrix based on the target node feature vector of each account node; process the target node feature matrix using a classification head in a preset classification model to obtain the risk category of the transaction account indicated by each account node.

[0176] The processor can invoke information and applications stored in memory via a transmission device to perform the following steps: determining the set of neighboring nodes of the account node; for each temporal conditional spatial attention layer, based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor, determining the temporal conditional attention weight of each neighbor node in the set of neighboring nodes in the current temporal conditional spatial attention layer, wherein the first temporal conditional spatial attention layer uses the initial node feature vector as the intermediate node feature vector; determining the aggregation information of the account node based on the temporal conditional attention weight of each neighboring node, the intermediate node feature vector, and the weight of the current temporal conditional spatial attention layer; performing a residual connection on the aggregation information and the intermediate node feature vector to obtain a connection vector, and performing layer normalization processing on the connection vector to obtain the intermediate node feature vector output by the current temporal conditional spatial attention layer; and representing the intermediate node feature vector output by the last temporal conditional spatial attention layer as the target node feature vector.

[0177] The processor can invoke information and applications stored in the memory via the transmission device to execute the following steps: determining the initial attention weight of the neighboring node in the current time-conditional spatial attention layer based on the weights of the current time-conditional spatial attention layer, attention parameters, the intermediate node feature vectors of the account node, and the intermediate node feature vectors of the neighboring nodes; determining the time decay factor of the neighboring node based on the decay parameter, time normalization factor, transaction timestamps of the associated edges between the account node and the neighboring node, and the current time; and determining the time-conditional attention weight of each neighboring node in the current time-conditional spatial attention layer based on the balance parameter, the initial attention weight of each neighboring node, and the time decay factor.

[0178] This application provides a scheme for monitoring trading accounts. It employs an anomaly monitoring method based on a dynamic spatiotemporal graph neural network. By collecting raw transaction data within the current time window, a dynamic graph is constructed, containing account nodes, related edges, and a feature matrix of account nodes. This dynamic graph is then input into a preset classification model built on a spatiotemporal conditional attention mechanism. This achieves the goal of accurately calculating the spatiotemporal dependencies between nodes and outputting the corresponding risk category for each trading account. This realizes the technical effect of deeply integrating transaction timeliness with topology structure and dynamically assessing the differences in the impact of historical transactions on current risk. Furthermore, it solves the technical problems of traditional static rules being easily circumvented, having a high false alarm rate, and traditional machine learning models being unable to capture complex fund flow patterns and cope with the risk perception of dynamically changing financial transaction networks.

[0179] Those skilled in the art will understand that Figure 6 The structure shown is for illustrative purposes only. Electronic devices can also be terminal devices such as smartphones, tablets, PDAs, and mobile internet devices (MIDs). Figure 6 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 6 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 6 The different configurations shown.

[0180] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0181] Example 4

[0182] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the transaction account monitoring method provided in Embodiment 1.

[0183] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0184] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing method steps for monitoring transaction accounts.

[0185] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0186] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0187] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0188] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0189] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0190] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0191] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for monitoring trading accounts, characterized in that, include: Collect raw transaction data for the current time window, wherein the current time window is determined based on the current moment and a preset time window; Based on the original transaction data, a dynamic graph is constructed for the current moment, wherein the dynamic graph includes: account nodes, associated edges, and an account node feature matrix, and a single account node corresponds to a transaction account; The dynamic graph is input into a preset classification model, which outputs the risk category corresponding to each trading account. The preset classification model is a model constructed based on a spatiotemporal conditional attention mechanism.

2. The monitoring method according to claim 1, characterized in that, The steps for constructing the dynamic graph at the current moment based on the original transaction data include: Extract the transaction account from the original transaction data and map the transaction account to the corresponding account node; Based on the original transaction data, identify account nodes with transaction associations, and construct the association edges between the account nodes with transaction associations; For each of the aforementioned associated edges, dynamic edge features are generated based on all transaction flows associated with the two account nodes connected by the associated edge. Determine the static feature vector and dynamic feature vector corresponding to each account node, and construct the account node feature matrix based on the static feature vector and dynamic feature vector corresponding to each account node; The dynamic graph is constructed based on all the account nodes, all the associated edges, and the feature matrix of the account nodes.

3. The monitoring method according to claim 2, characterized in that, The step of generating dynamic edge features of the associated edge based on all transaction flows associated with the two account nodes connected by the associated edge includes: Determine the timestamp of each transaction, and use the latest timestamp as the transaction timestamp of the associated edge; Aggregate all the transaction records to obtain the total amount, total number of transactions, counterparty account type, and transaction channel for each transaction; Based on the total amount, total number of transactions, transaction timestamp, counterparty account type, and transaction channel, the dynamic edge features of the associated edge are generated.

4. The monitoring method according to claim 1, characterized in that, Before inputting the dynamic graph into the preset classification model and outputting the risk category corresponding to each trading account, the process also includes: Based on the aforementioned spatiotemporal conditional attention mechanism, an initial classification model is constructed. The model structure of the initial classification model includes: multiple layers of spatiotemporal conditional attention layers and a classification head. Each layer of the spatiotemporal conditional attention layer is followed by a residual connection and layer normalization. The spatiotemporal conditional attention layer is used to output the intermediate node feature matrix based on the spatiotemporal conditional attention weights. The classification head is used to output the risk category of each account node based on the target node feature matrix output by the last layer of the spatiotemporal conditional attention layer. Collect historical transaction data and process the historical transaction data to obtain training data; The initial classification model is trained using the training data to obtain the preset classification model.

5. The monitoring method according to claim 4, characterized in that, The steps of processing the historical transaction data to obtain training data include: The historical transaction data is divided into historical transaction sub-data corresponding to different historical time windows. The historical transaction data includes: multiple historical transaction records, and each historical transaction record includes: transaction account pair, transaction amount and timestamp. For each historical time window, a historical dynamic graph of the historical time window is constructed based on the historical transaction sub-data corresponding to the historical time window. Based on the transaction results corresponding to the historical transaction sub-data, each transaction account in the historical dynamic graph is categorized to obtain a categorized set; The training data is constructed based on the historical dynamic graph and the labeled category set.

6. The monitoring method according to claim 4, characterized in that, The step of training the initial classification model using the training data to obtain the preset classification model includes: Based on the training data, the initial classification model is trained using a preset cross-entropy loss function to obtain the loss value for each iteration. The loss value is calculated using the preset cross-entropy loss function based on the predicted category set and the labeled category set. The predicted category set is a set consisting of the predicted categories of each transaction account output by the initial classification model. If the loss value is less than a preset loss threshold, the training is determined to be complete, and the target model parameter set is obtained. The target model parameter set includes at least the weights, attention parameters, balance parameters, and decay parameters corresponding to each of the temporal conditional spatial attention layers. Based on the target model parameter set, the initial classification model is adjusted to obtain the preset classification model.

7. The monitoring method according to claim 1, characterized in that, The steps of inputting the dynamic graph into a preset classification model and outputting the risk category corresponding to each trading account include: For each account node, an account time sequence code is determined based on the feature vector corresponding to each transaction of the account node within the current time window; The node feature matrix and the account time-series code are fused to obtain the initial node feature vector of the account node; The initial node feature vector is processed using a multi-layer temporal conditional spatial attention layer in the preset classification model to obtain the target node feature vector of the account node; Based on the target node feature vector of each account node, construct a target node feature matrix; The target node feature matrix is ​​processed using the classification head in the preset classification model to obtain the risk category of the transaction account indicated by each account node.

8. The monitoring method according to claim 7, characterized in that, The step of processing the initial node feature vector using a multi-layer temporal conditional spatial attention layer in the preset classification model to obtain the target node feature vector of the account node includes: Determine the set of neighboring nodes of the account node; For each temporal conditional spatial attention layer, based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the time decay factor, the temporal conditional attention weight of each neighbor node in the neighbor node set in the current temporal conditional spatial attention layer is determined. The first temporal conditional spatial attention layer uses the initial node feature vector as the intermediate node feature vector. Based on the temporal conditional attention weights of each neighboring node, the feature vectors of the intermediate nodes, and the weights of the current temporal conditional spatial attention layer, the aggregation information of the account node is determined. The aggregated information and the intermediate node feature vector are residually connected to obtain a connection vector, and the connection vector is subjected to layer normalization to obtain the intermediate node feature vector output by the current layer temporal conditional spatial attention layer. The intermediate node feature vector output by the last temporal conditional spatial attention layer is represented as the target node feature vector.

9. The monitoring method according to claim 8, characterized in that, The step of determining the temporal conditional attention weight of each neighbor node in the neighbor node set in the current temporal conditional spatial attention layer, based on the intermediate node feature vector output by the previous temporal conditional spatial attention layer and the temporal decay factor, includes: Based on the weights, attention parameters, intermediate node feature vectors of the account node, and intermediate node feature vectors of the neighbor node in the current temporal conditional spatial attention layer, the initial attention weights of the neighbor node in the current temporal conditional spatial attention layer are determined. The time decay factor of the neighboring node is determined based on the decay parameter, the time normalization factor, the transaction timestamp of the associated edge between the account node and the neighboring node, and the current time. Based on the balance parameter, the initial attention weight of each neighbor node, and the time decay factor, the time-conditional attention weight of each neighbor node in the current layer's time-conditional spatial attention layer is determined.

10. A device for monitoring transaction accounts, characterized in that, include: The acquisition unit is used to acquire raw transaction data for the current time window, wherein the current time window is determined based on the current moment and a preset time window; The construction unit is used to construct a dynamic graph at the current moment based on the original transaction data, wherein the dynamic graph includes: account nodes, associated edges, and an account node feature matrix, and a single account node corresponds to a transaction account; The input unit is used to input the dynamic graph into a preset classification model and output the risk category corresponding to each trading account. The preset classification model is a model constructed based on a spatiotemporal conditional attention mechanism.

11. A computer program product, characterized in that, The method includes a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the transaction account monitoring method according to any one of claims 1 to 9.

12. An electronic device, characterized in that, It includes one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the transaction account monitoring method according to any one of claims 1 to 9.

Images