A transaction risk data identification method based on big data analysis

Abstract

This invention discloses a method for identifying transaction risk data based on big data analysis, comprising the following steps: reading transaction business data and generating a transaction stage variable table; establishing candidate causal edges according to the stage sequence and generating a process direction constraint matrix; inputting an improved NOTEARS network, masking reverse edge weights and updating forward edge weights to generate a transaction observation causal graph; extracting a set of candidate risk trigger chains; intervening to replace stage variables and generating a transaction intervention twin graph; comparing causal edge directions and risk output changes across environments to generate an invariant risk causal graph; determining the minimum risk trigger chain and the main trigger variable, and outputting the risk identification result. This invention relates to the field of transaction risk identification technology, improving the accuracy of transaction risk identification and the ability to locate risk causes, reducing the false positive rate and the false negative rate, and is applicable to transaction risk control in multiple scenarios.

Description

Technical Field

[0001] This invention relates to the field of transaction risk identification technology, and in particular to a transaction risk data identification method based on big data analysis. Background Technology

[0002] Trading platforms generate a large amount of transaction data during payment, transfer, settlement, order fulfillment, and fund flow. Transaction risk data identification methods often employ rule thresholds, blacklist matching, risk scoring models, feature classification models, and graph relationship analysis to identify and process transaction amounts, transaction frequencies, account relationships, device information, network addresses, voucher status, and fund paths, and output risky transactions, risk levels, and review prompts.

[0003] Existing methods for identifying transaction risk data focus on determining the correlation between transaction characteristics and risk outcomes, lacking causal constraints on the sequential relationships within the transaction process. There are sequential relationships between transaction stages, such as login, order placement, payment, receipt, voucher creation, and fund transfer. Existing models are prone to generating reverse causal edges, self-edge interference, and connections that do not conform to the transaction process when learning variable relationships, leading to unclear risk trigger paths.

[0004] Existing methods, after identifying risky transactions, primarily output risk scores or risk levels, lacking intervention and verification of candidate risk trigger chains, making it difficult to confirm the actual impact of changes in stage variables on the risk output variables. Faced with behavioral differences arising from different trading environments, existing methods lack cross-environment consistency comparisons, making it difficult to rule out accidental correlations formed in a single trading environment, and unable to stably determine the minimum risk trigger chain and the main trigger variable. Therefore, how to provide a transaction risk data identification method based on big data analysis is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose a method for identifying transaction risk data based on big data analysis. This invention utilizes an improved NOTEARS network, transaction process direction constraints, transaction intervention twin graphs, and multi-environment invariance verification to identify transaction risk trigger chains and main trigger variables. It has the advantages of high risk identification accuracy, clear causal explanation, and low false positive rate.

[0006] A method for identifying transaction risk data based on big data analysis according to an embodiment of the present invention includes the following steps: Read transaction data and organize it into a transaction stage variable table according to the transaction process sequence; Based on the sequential relationship between the variables in the transaction stage variable table, candidate causal edges pointing from the variables in the preceding stage to the variables in the following stage are established, and the candidate causal edges are registered as the transaction process direction constraint matrix. The transaction stage variable table and the transaction process direction constraint matrix are input into the improved NOTEARS network. Edge weights in the causal edge weight matrix that do not conform to the transaction process direction are masked, while edge weights that conform to the transaction process direction are retained and iteratively updated. A transaction observation causal graph is generated under acyclic constraints. Extract a set of candidate risk trigger chains from the transaction observation causal graph, which are the stages of variables that reach the risk output variables via directed causal edges; Intervention replacement is performed on the stage variables in the candidate risk trigger chain set, and the risk is retransmitted to the risk output variables along the candidate risk trigger chain to generate a transaction intervention twin graph; Based on the causal graph of transaction observation and the twin graph of transaction intervention, the causal edge direction and risk output value of the same candidate risk triggering chain are compared under different transaction environments to generate an invariant risk causal graph; The minimum risk trigger chain and the main trigger variable are determined in the invariant risk causal graph, and the transaction risk identification result is output based on the minimum risk trigger chain and the main trigger variable.

[0007] Optionally, the operation of generating the transaction stage variable table includes: The transaction data is divided into several transaction stages according to the transaction process sequence. The stage status value is extracted from each transaction stage and registered as a stage variable. The stage variables, risk output variables and transaction environment markers are written into the same transaction stage variable table.

[0008] Optionally, the operation of registering candidate causal edges as transaction flow direction constraint matrices includes: Read the stage variables and risk output variables from the transaction stage variable table, and assign a stage number to each stage variable according to the transaction process sequence. Register candidate causal edges pointing from variables in the preceding stage to variables in the following stage, in ascending order of stage number. Register the direction in which the variable in the subsequent stage points to the variable in the preceding stage as a direction masking flag; Register the directions between variables in the same stage as self-edge masking tags; Register the risk output variable as the endpoint variable of the candidate causal edge; The transaction flow direction constraint matrix is ​​generated from candidate causal edges, direction masking markers, self-edge masking markers, and endpoint variables.

[0009] Optionally, the operation of generating a transaction observation causal graph under acyclic constraints includes: Read the stage variables and risk output variables from the transaction stage variable table, and build a causal edge weight matrix according to the stage variables and risk output variables; Read the candidate causal edges, direction masking markers, and self-edge masking markers from the transaction flow direction constraint matrix; Set the causal edge weights corresponding to the directional masking markers and the causal edge weights corresponding to the self-edge masking markers to the masked state; Set the weights of the causal edges corresponding to the candidate causal edges to a learnable state; In the improved NOTEARS network, the weights of causal edges in the shielded state are set to zero, and iterative updates are stopped. Perform preservation and iterative updates on the causal edge weights that are in a learnable state; After each iteration update, perform acyclic constraint verification on the causal edge weight matrix; After the causal edge weight matrix satisfies the acyclic constraint, the causal edge weights that are in a learnable state and have completed iterative updates are read, and the corresponding stage variables, risk output variables, and directed causal edges are written into the transaction observation causal graph.

[0010] Optionally, the operation of generating the candidate risk trigger chain set includes: In the causal graph of trading observation, the directed path that can reach the risk output variable is traced with the risk output variable as the endpoint; According to the direction constraint matrix of the transaction process, the directed paths are verified, and the directed paths containing the direction corresponding to the direction masking mark and the directed paths containing the direction corresponding to the self-edge masking mark are deleted. The retained directed paths are registered according to transaction number and path sequence to generate a set of candidate risk trigger chains.

[0011] Optionally, the operation of generating the transaction intervention twin graph includes: Read each candidate risk trigger chain from the candidate risk trigger chain set one by one, copy the stage variables, directed causal edges and risk output variables in the candidate risk trigger chain, and generate a copy of the candidate risk trigger chain; Select stage variables one by one from the candidate risk trigger chain replicas and register them as variables to be intervened in the stage; Read the records in the transaction stage variable table where the risk output variable is in a non-risk state, extract the stage variable values ​​with the same names as the variables in the stage to be intervened, and generate the benchmark variable values; Replace the values ​​of the intervention stage variables in the candidate risk triggering chain replica with the baseline variable values, while keeping the other stage variables and directed causal edges in the candidate risk triggering chain replica unchanged. Following the order of the directed causal edges in the candidate risk trigger chain replicas, update the state of the subsequent stage variables to the risk output variables according to the causal edge weight of the corresponding directed causal edge, and generate the risk output variables after intervention; The candidate risk trigger chain, the variables to be intervened, the benchmark variable value, the risk output variable after intervention, and the copy of the candidate risk trigger chain are registered as a transaction intervention twin graph.

[0012] Optionally, the operation of generating risk output change records includes: Extract the risk output variable values ​​and risk level markers corresponding to the candidate risk trigger chains from the transaction observation causal graph, and register them as the observed risk output status; Extract the risk output variable values ​​and post-intervention risk level markers of the same candidate risk trigger chain after the intervention and replacement of stage variables from the transaction intervention twin graph, and register them as the intervention risk output status; Compare the changes in observed risk output status and intervention risk output status to generate a risk output change record; Record changes in risk outputs and associate them with candidate risk trigger chain numbers and variables in the intervention phase.

[0013] Optionally, the operation of generating the invariant risk causal graph includes: The transaction phase variable table is divided into several transaction environment sub-tables according to the transaction environment label; Within each trading environment sub-table, generate a causal graph of trading observations, a twin graph of trading interventions, and a record of changes in risk outputs. Using the candidate risk trigger chain number as the matching index, a consistency comparison is performed on the directed causal edge directions of the same candidate risk trigger chain in several transaction environment sub-tables, and candidate risk trigger chains with consistent directions are retained. Compare the risk output change records corresponding to the retained candidate risk trigger chains with the same change direction, and retain the candidate risk trigger chains with the same risk output change direction as unchanged risk trigger chains; Write the stage variables, directed causal edges, risk output variables, and risk output change records in the invariant risk trigger chain into the same causal graph to generate an invariant risk causal graph.

[0014] Optionally, the operation of determining the minimum risk trigger chain and the main trigger variable includes: Taking the invariant risk trigger chain as the processing object, delete the intermediate stage variables in the invariant risk trigger chain one by one according to the order of the directed causal edge connection to generate a reduced risk trigger chain; Perform combined interventions on variables in the retention phase of the risk reduction trigger chain to generate a reduction intervention twin graph; Generate corresponding risk output change records based on the reduced intervention twin map; Register risk reduction trigger chains that meet the preset confirmation conditions as valid risk reduction trigger chains; Among the effective risk reduction trigger chains, select the effective risk reduction trigger chain with the fewest stage variables and register it as the minimum risk trigger chain; Perform univariate interventions on each stage variable in the minimum risk trigger chain and generate univariate risk output change records. Register the stage variable with the largest change in risk output from the univariate risk output change record as the primary trigger variable.

[0015] Optionally, the operation of outputting the transaction risk identification result includes: Using the transaction number as an index, write the minimum risk trigger chain, the main trigger variable, and the risk output change record into the same result record; Arrange the stage variables according to the order of the directed causal edges in the minimum risk trigger chain, and write the arranged stage variables, main trigger variables, and risk output change records into the risk cause record; The risk cause record is incorporated into the result record to generate the transaction risk identification result, and the transaction risk identification result is output according to the transaction number.

[0016] The beneficial effects of this invention are: (1) This invention transforms the sequential relationship of the transaction business data into causal edge learning constraints through the transaction stage variable table and the transaction process direction constraint matrix. In the improved NOTEARS network, edge weights that do not conform to the transaction process direction are masked, while edge weights that conform to the transaction process direction are retained and iteratively updated. This reduces the interference of reverse causal edges and self-edges, and improves the structural accuracy of the transaction observation causal graph.

[0017] (2) This invention uses a set of candidate risk trigger chains and a twin graph of transaction intervention to perform intervention and replacement on stage variables, and then retransmits them to risk output variables along the candidate risk trigger chains to form a record of risk output changes before and after intervention. This makes the transaction risk identification results not only include risk level, but also locate stage variables that affect risk output, thereby enhancing the interpretability of risk identification results.

[0018] (3) This invention generates an invariant risk causal graph by comparing the changes in the causal edge direction and risk output value under different trading environments, and determines the minimum risk triggering chain and the main triggering variable in the invariant risk causal graph, thereby reducing the impact of accidental correlation caused by a single trading environment and improving the stability of the identification of the trading risk triggering chain and the accuracy of risk cause location. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a flowchart of a transaction risk data identification method based on big data analysis proposed in this invention; Figure 2 This is a structural diagram of the improved NOTEARS network for a transaction risk data identification method based on big data analysis proposed in this invention. Figure 3This is a flowchart illustrating the risk trigger chain determination process for a transaction risk data identification method based on big data analysis proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figures 1-3 A method for identifying transaction risk data based on big data analysis includes the following steps: The system reads transaction data and organizes it into a transaction stage variable table according to the transaction process sequence. Transaction data includes transaction flow data, account data, merchant data, device fingerprint data, network address data, order data, payment data, collection data, voucher data, fund transfer data, and verification label data. Transaction data within the same transaction identification period is aggregated by transaction number and sorted by transaction time. The transaction data is then divided into multiple transaction stages according to the transaction process sequence: login, order placement, payment, collection, voucher, and fund transfer. Stage status values ​​are extracted from each stage and registered as stage variables. Stage variables, risk output variables, and transaction environment markers are written into the same transaction stage variable table. Risk output variables record the transaction risk status, and transaction environment markers record the environment in which the transaction occurred. Based on the sequential relationship between stage variables in the transaction stage variable table, candidate causal edges pointing from preceding stage variables to subsequent stage variables are established, and these candidate causal edges are registered in the transaction flow direction constraint matrix. Stage numbers are assigned to the stage variables in the transaction stage variable table according to the transaction flow order; stage variables with smaller stage numbers are designated as preceding stage variables, and stage variables with larger stage numbers are designated as subsequent stage variables. Candidate causal edges are established with preceding stage variables as the starting point and subsequent stage variables as the ending point. Connection directions with subsequent stage variables as the starting point and preceding stage variables as the ending point are registered as direction masking markers. Connection directions with the same stage variables as the starting and ending points are registered as self-edge masking markers. Candidate causal edges, direction masking markers, and self-edge masking markers are written into the transaction flow direction constraint matrix. The improved NOTEARS network inputs the transaction stage variable table and the transaction process direction constraint matrix. Edge weights in the causal edge weight matrix that do not conform to the transaction process direction are masked, while edge weights that conform are retained and iteratively updated, generating a transaction observation causal graph under acyclic constraints. A causal edge weight matrix is ​​established according to the stage variables and risk output variables in the transaction stage variable table. The causal edge weights in the causal edge weight matrix are state-labeled according to the transaction process direction constraint matrix. Causal edge weights corresponding to direction masking and self-masking are marked as masked states; causal edge weights corresponding to candidate causal edges are marked as learnable states. Causal edge weights in masked states are set to zero and iterative updates are stopped. Causal edge weights in learnable states are retained and iteratively updated. After each round of iterative updates, the causal edge weight matrix undergoes acyclic constraint verification. Once the causal edge weight matrix satisfies the acyclic constraint, the stage variables, risk output variables, and directed causal edges corresponding to the iteratively updated learnable state causal edge weights are written into the transaction observation causal graph. Extract a set of candidate risk trigger chains from the stage variables via directed causal edges in the transaction observation causal graph; locate the node corresponding to the risk output variable in the transaction observation causal graph; trace the stage variables that can reach the risk output variable along the reverse direction of the directed causal edges, with the node corresponding to the risk output variable as the endpoint; arrange the traced stage variables and directed causal edges in the forward connection order from the stage variables to the risk output variable to form a directed path; verify the directed path according to the transaction flow direction constraint matrix; delete the directed paths containing the direction corresponding to the direction masking mark and the direction corresponding to the self-edge masking mark; register the retained directed paths according to the transaction number and path order to generate a set of candidate risk trigger chains. Intervention and replacement are performed on the stage variables in the candidate risk trigger chain set, and the results are retransmitted to the risk output variables along the candidate risk trigger chain to generate a trading intervention twin graph. Candidate risk trigger chains in the candidate risk trigger chain set are copied one by one to obtain candidate risk trigger chain copies. Stage variables are selected in the candidate risk trigger chain copies according to the connection order and registered as stage variables to be intervened. Trading records with non-risk states for risk output variables are selected from the trading stage variable table. The values ​​of stage variables with the same names as the stage variables to be intervened are extracted from the non-risk state trading records to generate benchmark variable values. The values ​​of the stage variables to be intervened in the candidate risk trigger chain copies are replaced with the benchmark variable values. Other stage variables, directed causal edge directions, and causal edge weights in the candidate risk trigger chain copies remain unchanged. The states of subsequent stage variables are updated to the risk output variables according to the causal edge weights of the corresponding directed causal edges along the connection order of the directed causal edges in the candidate risk trigger chain copies to generate post-intervention risk output variables. The candidate risk trigger chains, candidate risk trigger chain copies, stage variables to be intervened, benchmark variable values, and post-intervention risk output variables are registered as a trading intervention twin graph. Based on the causal graph of trading observation and the twin graph of trading intervention, the causal edge direction and risk output value changes of the same candidate risk trigger chain under different trading environments are compared to generate an invariant risk causal graph. The trading stage variable table is divided into at least two trading environment sub-tables according to the trading environment label. In each trading environment sub-table, the causal graph of trading observation, the twin graph of trading intervention, and the risk output change record under the corresponding trading environment are generated. Using the candidate risk trigger chain number as the matching index, the consistency of the directed causal edge direction of the same candidate risk trigger chain in different trading environment sub-tables is compared. Candidate risk trigger chains with consistent directed causal edge directions are retained. The change direction of the risk output change record corresponding to the retained candidate risk trigger chains is compared. Candidate risk trigger chains with consistent risk output change directions are registered as invariant risk trigger chains. The stage variables, directed causal edges, risk output variables, and risk output change records in the invariant risk trigger chain are written into the same causal graph to generate an invariant risk causal graph. In the invariant risk causal graph, the minimum risk trigger chain and the main trigger variable are determined, and the transaction risk identification result is output based on the minimum risk trigger chain and the main trigger variable. The invariant risk trigger chain is extracted from the invariant risk causal graph. Intermediate stage variables in the invariant risk trigger chain are deleted one by one according to the order of directed causal edges, generating a reduced risk trigger chain. Combined interventions are performed on the retained stage variables in the reduced risk trigger chain, generating a reduced intervention twin graph. Corresponding risk output change records are generated based on the reduced intervention twin graph. Reduced risk trigger chains whose risk output change records meet preset confirmation conditions are registered as valid reduced risk trigger chains. Among the valid reduced risk trigger chains, the one with the fewest stage variables is selected and registered as the minimum risk trigger chain. Single-variable interventions are performed on each stage variable in the minimum risk trigger chain, generating single-variable risk output change records. The stage variable with the largest risk output change magnitude in the single-variable risk output change records is registered as the main trigger variable. The transaction risk identification result is generated based on the minimum risk trigger chain, the main trigger variable, and the risk output change records.

[0022] In this embodiment, the operation of generating the transaction stage variable table includes: The transaction data is divided into multiple transaction stages according to the transaction process sequence. Stage status values ​​are extracted from each stage and registered as stage variables. Stage variables, risk output variables, and transaction environment markers are written into the same transaction stage variable table. Transaction data is grouped by transaction number, account number, and transaction time. For the login stage, login time, login device identifier, network address, login region, and login status are extracted as stage status values. For the order placement stage, order identifier, order amount, order generation time, order status, and product category are extracted as stage status values. For the payment stage, payment amount, payment time, payment account, payment method, and payment status are extracted as stage status values. For the collection stage, collection account, collection time, collection amount, merchant identifier, and collection status are extracted as stage status values. For the voucher stage, voucher identifier, voucher generation time, voucher amount consistency status, voucher integrity status, and voucher source status are extracted as stage status values. For the fund transfer stage, the number of transit accounts, fund splitting status, fund aggregation status, fund return status, and fund transfer duration are extracted as stage status values. Risk output variables are generated based on review label data, historical risk labels, and transaction interception status. When a transaction record is manually reviewed as risky, a historical risk label is hit, or the transaction interception status is "intercepted," the risk output variable is registered as a risky status. When a transaction record is manually reviewed as normal, a historical risk label is not hit, and the transaction interception status is "not intercepted," the risk output variable is registered as a non-risky status. Transaction environment markers are generated based on the transaction time period, transaction frequency, transaction area, transaction channel, and review status. Transaction environment markers, along with the transaction number, stage variables, and risk output variables, are written into the same transaction stage variable table.

[0023] In this embodiment, the operation of registering candidate causal edges as transaction flow direction constraint matrices includes: Read the stage variables and risk output variables from the transaction stage variable table, and configure stage numbers for each stage variable according to the transaction process sequence; configure the login stage variable as the first stage number, the order placement stage variable as the second stage number, the payment stage variable as the third stage number, the collection stage variable as the fourth stage number, the voucher stage variable as the fifth stage number, the fund transfer stage variable as the sixth stage number, and the risk output variable as the endpoint number; write the stage variable name and stage number into the stage variable index table; Candidate causal edges pointing from variables in the preceding stage to variables in the following stages are registered in ascending order of stage number. In the stage variable index table, the stage variable with the smaller stage number is used as the starting point of the candidate causal edge, and the stage variable with the larger stage number is used as the ending point of the candidate causal edge. The starting point, ending point, and directed connection direction of the candidate causal edge are registered as candidate causal edge records. The directed connection direction of the candidate causal edge is maintained from the preceding stage of the transaction process to the following stage of the transaction process. The direction from a subsequent stage variable to a preceding stage variable is registered as a direction masking mark; in the stage variable index table, when a stage variable with a larger stage number points to a stage variable with a smaller stage number, the corresponding directed connection direction is registered as a direction masking mark; the direction masking mark records the masked starting stage variable, the masked ending stage variable, and the masked direction; the direction masking mark is not registered as a candidate causal edge; The direction between variables in the same stage is registered as a self-edge masking mark; when the same stage variable is used as the start and end point, the corresponding directed connection direction is registered as a self-edge masking mark; the self-edge masking mark records the stage variable name and the self-connection direction; the self-edge masking mark is not registered as a candidate causal edge; Register the risk output variable as the endpoint variable of the candidate causal edge; register the direction from any stage variable to the risk output variable as the candidate causal edge; register the direction from the risk output variable to any stage variable as the direction masking mark; register the direction from the risk output variable to the risk output variable as the self-edge masking mark; A trading process direction constraint matrix is ​​generated from candidate causal edges, direction masking markers, self-edge masking markers, and endpoint variables. The trading process direction constraint matrix uses stage variables and risk output variables as row and column objects. The matrix position corresponding to the candidate causal edge is recorded as the learnable direction. The matrix position corresponding to the direction masking marker is recorded as the masked direction. The matrix position corresponding to the self-edge masking marker is recorded as the self-edge masked direction. The column position corresponding to the endpoint variable is recorded as the risk output direction.

[0024] In this embodiment, the operation of generating a transaction observation causal graph under acyclic constraints includes: Read the stage variables and risk output variables from the trading stage variable table, and build a causal edge weight matrix according to the stage variables and risk output variables; each stage variable and risk output variable in the trading stage variable table is used as a row and column object in the causal edge weight matrix; the directed connection position between any two variables corresponds to a causal edge weight; the row object in the causal edge weight matrix represents the starting point of the directed causal edge, and the column object represents the ending point of the directed causal edge. Read candidate causal edges, direction masking markers, and self-edge masking markers from the transaction flow direction constraint matrix; map the positions recorded as learnable directions in the transaction flow direction constraint matrix to the same row and column positions in the causal edge weight matrix; map the positions recorded as masked directions in the transaction flow direction constraint matrix to the same row and column positions in the causal edge weight matrix; map the positions recorded as self-edge masking directions in the transaction flow direction constraint matrix to the same row and column positions in the causal edge weight matrix. Set the causal edge weights corresponding to the direction masking mark and the causal edge weights corresponding to the self-edge masking mark to the masked state; the causal edge weights in the masked state are set to zero before the iteration update; the causal edge weights in the masked state do not receive gradient updates, do not participate in the edge weight retention judgment, and are not written into the transaction observation causal graph during the iteration update process. Set the weights of the causal edges corresponding to the candidate causal edges to learnable states; retain the initial values ​​of the causal edge weights in learnable states and participate in the iterative update of the improved NOTEARS network; perform weight updates and acyclic constraint verification on the causal edge weights in learnable states after each iteration. In the improved NOTEARS network, the weights of causal edges in the shielded state are set to zero, and the iterative update is stopped. The zeroing process is performed before the start of each iteration. When the weights of causal edges in the shielded state become non-zero during the iteration, the weights of causal edges in the shielded state are restored to zero. The weights of causal edges in the shielded state are used as zero values ​​in the acyclic constraint verification. The causal edge weights in the learnable state are retained and iteratively updated; the causal edge weights in the learnable state are adjusted for loss calculation based on the values ​​of the stage variables in the transaction stage variable table; after each edge weight adjustment, the improved NOTEARS network retains the update results that conform to the direction of the transaction process; when the update results conflict with the constraint matrix of the transaction process direction, the conflict position is restored to the shielded state. After each iteration update, an acyclic constraint check is performed on the causal edge weight matrix. The acyclic constraint check is performed on the directed causal edge connections in the current causal edge weight matrix. If the check result indicates that a closed loop exists, the causal edge weights of the learnable state are adjusted. If the check result indicates that no closed loop exists, the edge weight adjustment for the next iteration is stopped. After the causal edge weight matrix satisfies the acyclic constraint, the causal edge weights that are in a learnable state and have completed iterative updates are read, and the corresponding stage variables, risk output variables, and directed causal edges are written into the transaction observation causal graph. The transaction observation causal graph uses stage variables and risk output variables as nodes, and the directed causal edges that have completed iterative updates and are retained as graph edges. Each directed causal edge records the starting variable, ending variable, causal edge weight, and transaction flow direction.

[0025] In this embodiment, the operation of generating a set of candidate risk trigger chains includes: In the causal graph of trading observation, the directed path that can reach the risk output variable is traced with the risk output variable as the endpoint; the node corresponding to the risk output variable is located in the causal graph of trading observation; starting from the node corresponding to the risk output variable, the directly connected stage variable is searched along the reverse direction of the directed causal edge; for the directly connected stage variable, the upstream stage variable is searched along the reverse direction of the directed causal edge; the search process stops when a stage variable without an upstream directed causal edge is reached; the upstream stage variables and directed causal edges found are arranged in the forward connection order to form a directed path; According to the transaction flow direction constraint matrix, the directed paths are verified, and directed paths containing the direction corresponding to the direction masking mark and the direction corresponding to the self-edge masking mark are deleted. For each directed causal edge in the directed path, the corresponding direction is queried in the transaction flow direction constraint matrix. If the query result is a direction masking mark, the directed path is deleted. If the query result is a self-edge masking mark, the directed path is deleted. If the query result is a candidate causal edge, the directed path is retained. The retained directed paths are registered according to transaction number and path sequence number to generate a candidate risk trigger chain set; the path sequence number is generated according to the connection order of the directed path from the starting stage variable to the risk output variable; each candidate risk trigger chain in the candidate risk trigger chain set records the transaction number, starting stage variable, intermediate stage variable, directed causal edge, risk output variable and path sequence number.

[0026] In this embodiment, the operation of generating a transaction intervention twin graph includes: Read each candidate risk trigger chain from the candidate risk trigger chain set one by one, copy the stage variables, directed causal edges, and risk output variables in the candidate risk trigger chain, and generate a candidate risk trigger chain copy; the candidate risk trigger chain copy retains the order of stage variables, the direction of directed causal edges, and the weight of causal edges in the candidate risk trigger chain; the candidate risk trigger chain copy uses the same candidate risk trigger chain number as the candidate risk trigger chain, and adds a copy number; Select stage variables one by one from the candidate risk trigger chain replicas and register them as stage variables to be intervened; the selection process is performed according to the connection order of the stage variables in the candidate risk trigger chain replicas; one stage variable is selected as the stage variable to be intervened at a time; the registration content of the stage variable to be intervened includes the candidate risk trigger chain number, replica number, stage variable name and original value of the stage variable; The system reads records from the transaction stage variable table where the risk output variable is in a non-risk state, extracts the stage variable values ​​with the same name as the variable in the stage to be intervened, and generates a benchmark variable value. The non-risk state records are derived from transaction records where the risk output variable is marked as non-risk. In the non-risk state records, the system searches for stage variables with the same name according to the variable name of the stage to be intervened. The system performs frequency statistics on the found stage variable values ​​with the same name and uses the value with the highest frequency as the benchmark variable value. When the stage variable values ​​with the same name are consecutive, the median of the corresponding stage variable values ​​in the non-risk state records is recorded as the benchmark variable value. Replace the values ​​of the variables in the candidate risk trigger chain replica with the values ​​of the baseline variables, while keeping the other stage variables and directed causal edges in the candidate risk trigger chain replica unchanged; when replacing, only modify the value fields corresponding to the variables in the stage to be intervened, do not modify the names of the variables in the stage to be intervened, do not modify the direction of the directed causal edges in the candidate risk trigger chain replica, and do not modify the weights of the causal edges in the candidate risk trigger chain replica. Following the order of directed causal edges in the candidate risk trigger chain replicas, the states of subsequent stage variables are updated to the risk output variables according to the causal edge weights of the corresponding directed causal edges, generating post-intervention risk output variables. The update process starts from the variable to be intervened and calculates the states of subsequent stage variables level by level according to the order of directed causal edge connections. The state of each subsequent stage variable is generated based on the state of the previous stage variable and the causal edge weights connecting the two stages. The update process stops when it reaches the risk output variable. The updated risk output variable is registered as the post-intervention risk output variable. The candidate risk trigger chain, the variable to be intervened, the benchmark variable value, the risk output variable after intervention, and the copy of the candidate risk trigger chain are registered as a transaction intervention twin graph. The transaction intervention twin graph includes the original candidate risk trigger chain area and the intervention candidate risk trigger chain copy area. The original candidate risk trigger chain area records the stage variable and risk output variable before intervention. The intervention candidate risk trigger chain copy area records the variable to be intervened, the benchmark variable value, and the risk output variable after intervention.

[0027] In this embodiment, the operation of generating risk output change records includes: Extract the risk output variable values ​​and risk level markers corresponding to the candidate risk trigger chains from the transaction observation causal graph, and register them as the observed risk output state; the observed risk output state corresponds to the pre-intervention state; the observed risk output state records the candidate risk trigger chain number, risk output variable values, risk level markers, and corresponding transaction number; Extract the risk output variable values ​​and post-intervention risk level markers of the same candidate risk trigger chain after the intervention and replacement of the stage variable from the transaction intervention twin graph, and register them as the intervention risk output status; the intervention risk output status corresponds to the post-intervention status; the intervention risk output status records the candidate risk trigger chain number, the stage variable to be intervened, the benchmark variable value, the post-intervention risk output variable value, and the post-intervention risk level marker; The observed risk output status and the intervention risk output status are compared to generate a risk output change record. The status change comparison is performed according to the same candidate risk trigger chain number and the same variable to be intervened in the same stage. When the risk level marker after intervention is lower than the observed risk level marker, the risk output change record is recorded as risk reduction. When the risk level marker after intervention is equal to the observed risk level marker, the risk output change record is recorded as risk unchanged. When the risk level marker after intervention is higher than the observed risk level marker, the risk output change record is recorded as risk increase. Record the risk output change with the candidate risk trigger chain number and the variable to be intervened; record the risk output change in the risk output change record table; the risk output change record table includes the candidate risk trigger chain number, the variable to be intervened, the observed risk output status, the intervention risk output status, and the direction of risk output change.

[0028] In this embodiment, the operation of generating an invariant risk cause-effect graph includes: The trading stage variable table is divided into at least two trading environment sub-tables based on the trading environment markers; the trading environment markers are generated according to the trading time period, trading frequency, trading area, trading channel, and review status; trading records with the same trading environment markers are written into the same trading environment sub-table; each trading environment sub-table retains the stage variables, risk output variables, and trading environment markers from the trading stage variable table; Within each trading environment sub-table, a trading observation causal graph, a trading intervention twin graph, and a risk output change record are generated. Each trading environment sub-table is input into an improved NOTEARS network according to the trading process direction constraint matrix to generate a trading observation causal graph for the corresponding environment. Each trading environment sub-table generates a trading intervention twin graph for the corresponding environment based on a set of candidate risk trigger chains. Each trading environment sub-table generates a risk output change record for the corresponding environment based on the trading observation causal graph and the trading intervention twin graph for the corresponding environment. Using the candidate risk trigger chain number as the matching index, a consistency comparison is performed on the directed causal edge directions of the same candidate risk trigger chain in at least two trading environment sub-tables, retaining candidate risk trigger chains with consistent directions. The consistency comparison compares the start-stage variables, end-stage variables, and directed causal edge directions of the same candidate risk trigger chain in different trading environment sub-tables one by one. When the start-stage variables, end-stage variables, and directed causal edge directions are all consistent, the candidate risk trigger chain is registered as having consistent directions; if any directed causal edge direction is inconsistent, the candidate risk trigger chain is not registered as having consistent directions. The risk output change records corresponding to the retained candidate risk trigger chains are compared for change direction. Candidate risk trigger chains with consistent risk output change direction are retained and registered as unchanged risk trigger chains. The change direction comparison is performed according to the risk decrease, risk unchanged, and risk increase in the risk output change records. When the risk output change direction of the same candidate risk trigger chain is consistent in different trading environment sub-tables, it is registered as an unchanged risk trigger chain. Write the stage variables, directed causal edges, risk output variables, and risk output change records in the invariant risk trigger chain into the same causal graph to generate an invariant risk causal graph. The invariant risk causal graph uses the stage variables and risk output variables in the invariant risk trigger chain as nodes, and the directed causal edges with the same direction as graph edges, and binds the corresponding risk output change records to the invariant risk trigger chain.

[0029] In this embodiment, the operations for determining the minimum risk trigger chain and the main trigger variable include: Using the invariant risk trigger chain as the processing object, intermediate stage variables in the invariant risk trigger chain are deleted one by one according to the order of directed causal edge connections to generate a reduced risk trigger chain; intermediate stage variables are stage variables located between the starting stage variable and the risk output variable; when deleting intermediate stage variables, the directed causal edges connected to the intermediate stage variables are deleted simultaneously; after deletion, links that can be connected from the remaining stage variables to the risk output variable are retained; reduced links that cannot be connected to the risk output variable are not registered as reduced risk trigger chains; Perform combined interventions on the variables in the retained phase of the risk reduction trigger chain to generate a reduction intervention twin map; the combined interventions are performed according to the variables in the retained phase of the risk reduction trigger chain; each retained phase variable is replaced according to the aforementioned method for generating baseline variable values; the replaced risk reduction trigger chain serves as the intervention area of ​​the reduction intervention twin map; Based on the reduced intervention twin graph, generate the corresponding risk output change record; generate the intervention risk output state according to the post-intervention risk output variable in the reduced intervention twin graph, and compare the state change with the observed risk output state corresponding to the invariant risk trigger chain before reduction to generate the risk output change record corresponding to the reduced risk trigger chain. Risk reduction trigger chains that meet the preset confirmation conditions are registered as effective risk reduction trigger chains. The preset confirmation conditions are determined by the direction of risk output change and the change of risk level marker in the risk output change record. When the direction of risk output change is risk reduction and the risk level marker after intervention is lower than the observed risk level marker, the risk reduction trigger chain is registered as an effective risk reduction trigger chain. In the effective risk reduction trigger chain, select the effective risk reduction trigger chain with the fewest stage variables and register it as the minimum risk trigger chain; count the number of stage variables in each effective risk reduction trigger chain; sort them from the fewest to the most stage variables; register the effective risk reduction trigger chain with the first-ranked effective risk reduction trigger chain as the minimum risk trigger chain; when there are multiple effective risk reduction trigger chains with the same number of stage variables, select the effective risk reduction trigger chain with the largest change in risk output and register it as the minimum risk trigger chain. Perform univariate interventions on each stage variable in the minimum risk trigger chain to generate univariate risk output change records; each univariate intervention replaces only the value of one stage variable, while the other stage variables in the minimum risk trigger chain retain their original values; after each univariate intervention, update the risk output variables sequentially along the directed causal edges of the minimum risk trigger chain to generate the corresponding univariate risk output change records. The stage variable with the largest change in risk output in the univariate risk output change record is registered as the primary trigger variable; the change in risk output is determined based on the change in risk level and the change in the value of the risk output variable between the observed risk output state and the intervention risk output state after univariate intervention; the stage variable corresponding to the largest change in risk output is registered as the primary trigger variable; the primary trigger variable is bound to the minimum risk trigger chain in the record.

[0030] In this embodiment, the operation of outputting the transaction risk identification result includes: Using the transaction number as an index, the minimum risk trigger chain, the main trigger variable, and the risk output change record are written into the same result record; a unique record row is created for the result record according to the transaction number; the minimum risk trigger chain is written into the link field of the result record; the main trigger variable is written into the main trigger field of the result record; and the risk output change record is written into the intervention verification field of the result record. The stage variables are arranged according to the directed causal edge connection order in the minimum risk trigger chain. The arranged stage variables, main trigger variables, and risk output change records are written into the risk cause record. The risk cause record is arranged in the order of starting stage variable, intermediate stage variable, and risk output variable. The main trigger variable is independently marked in the risk cause record. The risk output change record is bound to the corresponding stage variable to be intervened in the risk cause record. The risk cause record is incorporated into the result record to generate a transaction risk identification result. The transaction risk identification result is output according to the transaction number. The transaction risk identification result includes the transaction number, the minimum risk trigger chain, the main trigger variable, the risk output change record, and the risk cause record. The transaction risk identification result is output to the transaction risk review process or the transaction risk interception process according to the transaction number.

[0031] Example 1: To verify the feasibility of this invention in practice, it was applied to a transaction risk data identification scenario. The test data originated from transaction business data within the same trading platform, including transaction records, accounts, merchants, device fingerprints, network addresses, orders, payments, receipts, vouchers, fund transfers, and verification tags. The test data contained a total of 52,600 transaction records, with 4,120 manually verified risk records and 48,480 manually verified normal records. The test objective was to verify the invention's ability to process transaction flow direction, risk trigger chains, intervention verification, and stable identification across multiple environments.

[0032] In this embodiment, the trading platform receives data from multiple stages, including login, order placement, payment, receipt, voucher generation, and fund transfer. Conventional risk identification methods directly input features such as device replacement, network address changes, increased payment amounts, and fund splitting into a risk scoring model. The model will provide a risk level, but it cannot reliably explain which stage triggered the risk, nor can it distinguish between the actual transmission relationship and accidental correlation in the transaction process. If the transaction occurs at night, at high frequency, across regions, or in a trading environment with different review statuses, conventional models are prone to treating environmental changes as the cause of risk, leading to false blocking, missed identification, and increased review pressure.

[0033] In this transaction risk identification scenario, the present invention first organizes transaction business data in stages. The transaction number serves as the primary index. The login stage records the login device, network address, and login status; the order placement stage records the order amount and order status; the payment stage records the payment amount, paying account, and payment method; the collection stage records the receiving account and merchant identifier; the voucher stage records the voucher integrity status and amount consistency status; and the fund transfer stage records the fund splitting status, fund aggregation status, and fund return status. The status values ​​of each stage are written into the transaction stage variable table, the review label and interception status are written into the risk output variable, and the transaction time period, transaction frequency, transaction area, transaction channel, and review status are written into the transaction environment flag.

[0034] After completing the transaction stage variable table, this invention generates a transaction process direction constraint matrix according to the transaction process sequence. The login stage points to the order placement stage, the order placement stage points to the payment stage, the payment stage points to the collection stage, the collection stage points to the voucher stage and the fund transfer stage, and the fund transfer stage points to the risk output variable. Reverse connections are registered as direction masking markers, and the same variable pointing to itself is registered as a self-edge masking marker. The improved NOTEARS network processes the causal edge weight matrix according to the transaction process direction constraint matrix. The edge weights of the masked state are set to zero and the iteration update stops, while the edge weights of the learnable state are retained and iteratively updated. After acyclic constraint verification, the retained directed causal edges are written into the transaction observation causal graph.

[0035] In a typical risky transaction record, the account logs in using an uncommon device, the network address switches from a frequently used region to an uncommon region, a large payment is completed shortly after the order is placed, the receiving account differs from the historical transaction counterparty, the voucher status is missing, and there are splits and backflows in the fund flow stage. The causal graph of the transaction observation forms directed paths between device stage variables, network address stage variables, payment stage variables, fund flow stage variables, and risk output variables. This invention traces the directed path backward with the risk output variable as the endpoint, and after verification by the transaction process direction constraint matrix, obtains a set of candidate risk trigger chains.

[0036] For candidate risk trigger chains, this invention replicates the candidate risk trigger chain and generates a copy. The variables in the candidate risk trigger chain copy that are to be intervened upon are replaced one by one with baseline variable values. The baseline variable values ​​are derived from non-risk state transaction records; discrete variables use high-frequency normal values, and continuous variables use the median from the non-risk state records. After the replacement, the candidate risk trigger chain copy is re-transmitted to the risk output variables along the directed causal edge connection sequence, generating a transaction intervention twin graph. After comparing the state changes of the observed risk output state and the intervened risk output state, a risk output change record is generated.

[0037] To avoid accidental correlations caused by a single trading environment, this invention divides the trading environment into at least two sub-tables based on trading environment labels. Each sub-table generates a trading observation causal graph, a trading intervention twin graph, and a risk output change record. When the directed causal edges of the same candidate risk trigger chain remain consistent across different sub-tables, and the direction of risk output change remains consistent, it is registered as an invariant risk trigger chain. Invariant risk trigger chains are written into the invariant risk causal graph. This invention then performs link reduction and combined intervention on the invariant risk trigger chains, filters out effective reduced risk trigger chains that meet preset confirmation conditions, and selects the chain with the fewest stage variables from the effective reduced risk trigger chains as the minimum risk trigger chain. The stage variable with the largest change in risk output in the single-variable intervention results is registered as the primary trigger variable.

[0038] To verify the identification effect, this embodiment sets up two comparison methods. The first is the rule-based threshold identification method, which outputs the risk level based on the amount threshold, device change threshold, network address change, and blacklist matching. The second is the conventional correlation model identification method, which trains a risk classification model based on transaction features and outputs a risk score. The method of this invention is run on the same batch of transaction business data, outputting transaction risk identification results, minimum risk trigger chain, main trigger variable, and risk cause record. Manual review of labels serves as the verification benchmark. The comparison results are shown in the table below: Table 1: Comparison of Transaction Risk Identification Effectiveness

[0039] The data in the table shows that the high-risk transaction hit rate of the method of the present invention is 93.8%, which is higher than the 81.6% of the rule threshold identification method and the 87.9% of the conventional correlation model identification method, representing improvements of 12.2 percentage points and 5.9 percentage points respectively. This indicates that the transaction process direction constraint matrix and the improved NOTEARS network can improve the risk transaction identification coverage.

[0040] Regarding the false blocking rate and false negative rate, the false blocking rate of the method of this invention is 4.9%, lower than the 11.7% of the rule-based threshold identification method and the 8.3% of the conventional correlation model identification method; the false negative rate is 6.7%, lower than the 14.2% of the rule-based threshold identification method and the 10.5% of the conventional correlation model identification method. Compared with the rule-based threshold identification method, the false blocking rate of the method of this invention is reduced by 6.8 percentage points, and the false negative rate is reduced by 7.5 percentage points; compared with the conventional correlation model identification method, the false blocking rate is reduced by 3.4 percentage points, and the false negative rate is reduced by 3.8 percentage points, indicating that the present invention can reduce the misjudgment of normal transactions and the omission of risky transactions.

[0041] Regarding causal structure, conventional correlation model identification methods generate 128 reverse causal edges, while the method of this invention generates only 18, a reduction of 110 edges, or approximately 85.9%. This data indicates that the transaction flow direction constraint matrix can shield causal edges that do not conform to the transaction flow direction, making the transaction observation causal graph more consistent with the actual transaction flow.

[0042] Regarding the stability and explanatory power of risk trigger chains, the method of this invention achieves a stability rate of 82.4% for invariant risk trigger chains, representing improvements of 42.6 percentage points and 20.9 percentage points compared to rule-based threshold identification and conventional correlation model identification methods, respectively. The consistency rate of the main trigger variable verification is 86.9%, representing improvements of 38.0 percentage points and 12.4 percentage points, respectively. The completeness rate of risk cause recording is 94.5%, representing improvements of 41.9 percentage points and 16.4 percentage points, respectively. These data demonstrate that this invention can improve the stability of risk trigger chains and the completeness of risk cause explanations.

[0043] Regarding the workload of manual review, the manual review workload index for the rule-based threshold identification method is 100.0, for the conventional correlation model identification method it is 81.3, and for the method of this invention it is 64.8, representing reductions of 35.2 and 16.5 index points respectively. Therefore, this invention can improve the accuracy of transaction risk identification while reducing the pressure of manual review and increasing the efficiency of risk handling.

[0044] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for identifying transaction risk data based on big data analysis, characterized in that, Includes the following steps: Read transaction data and organize it into a transaction stage variable table according to the transaction process sequence; Based on the sequential relationship between the variables in the transaction stage variable table, candidate causal edges pointing from the variables in the preceding stage to the variables in the following stage are established, and the candidate causal edges are registered as the transaction process direction constraint matrix. The transaction stage variable table and the transaction process direction constraint matrix are input into the improved NOTEARS network. Edge weights in the causal edge weight matrix that do not conform to the transaction process direction are masked, while edge weights that conform to the transaction process direction are retained and iteratively updated. A transaction observation causal graph is generated under acyclic constraints. Extract a set of candidate risk trigger chains from the transaction observation causal graph, which are the stages of variables that reach the risk output variables via directed causal edges; Intervention replacement is performed on the stage variables in the candidate risk trigger chain set, and the risk is retransmitted to the risk output variables along the candidate risk trigger chain to generate a transaction intervention twin graph; Based on the causal graph of transaction observation and the twin graph of transaction intervention, the causal edge direction and risk output value of the same candidate risk triggering chain are compared under different transaction environments to generate an invariant risk causal graph; The minimum risk trigger chain and the main trigger variable are determined in the invariant risk causal graph, and the transaction risk identification result is output based on the minimum risk trigger chain and the main trigger variable.

2. The method for identifying transaction risk data based on big data analysis according to claim 1, characterized in that, The operation of generating the transaction phase variable table includes: The transaction data is divided into several transaction stages according to the transaction process sequence. The stage status value is extracted from each transaction stage and registered as a stage variable. The stage variables, risk output variables and transaction environment markers are written into the same transaction stage variable table.

3. The method for identifying transaction risk data based on big data analysis according to claim 2, characterized in that, The operation of registering candidate causal edges as transaction flow direction constraint matrices includes: Read the stage variables and risk output variables from the transaction stage variable table, and assign a stage number to each stage variable according to the transaction process sequence. Register candidate causal edges pointing from variables in the preceding stage to variables in the following stage, in ascending order of stage number. Register the direction in which the variable in the subsequent stage points to the variable in the preceding stage as a direction masking flag; Register the directions between variables in the same stage as self-edge masking tags; Register the risk output variable as the endpoint variable of the candidate causal edge; The transaction flow direction constraint matrix is ​​generated from candidate causal edges, direction masking markers, self-edge masking markers, and endpoint variables.

4. The method for identifying transaction risk data based on big data analysis according to claim 3, characterized in that, The operation of generating the transaction observation causal graph under acyclic constraints includes: Read the stage variables and risk output variables from the transaction stage variable table, and build a causal edge weight matrix according to the stage variables and risk output variables; Read the candidate causal edges, direction masking markers, and self-edge masking markers from the transaction flow direction constraint matrix; Set the causal edge weights corresponding to the directional masking markers and the causal edge weights corresponding to the self-edge masking markers to the masked state; Set the weights of the causal edges corresponding to the candidate causal edges to a learnable state; In the improved NOTEARS network, the weights of causal edges in the shielded state are set to zero, and iterative updates are stopped. Perform preservation and iterative updates on the causal edge weights that are in a learnable state; After each iteration update, perform acyclic constraint verification on the causal edge weight matrix; After the causal edge weight matrix satisfies the acyclic constraint, the causal edge weights that are in a learnable state and have completed iterative updates are read, and the corresponding stage variables, risk output variables, and directed causal edges are written into the transaction observation causal graph.

5. The method for identifying transaction risk data based on big data analysis according to claim 4, characterized in that, The operation of generating the candidate risk trigger chain set includes: In the causal graph of trading observation, the directed path that can reach the risk output variable is traced with the risk output variable as the endpoint; According to the direction constraint matrix of the transaction process, the directed paths are verified, and the directed paths containing the direction corresponding to the direction masking mark and the directed paths containing the direction corresponding to the self-edge masking mark are deleted. The retained directed paths are registered according to transaction number and path sequence to generate a set of candidate risk trigger chains.

6. The method for identifying transaction risk data based on big data analysis according to claim 5, characterized in that, The operation of generating the transaction intervention twin graph includes: Read each candidate risk trigger chain from the candidate risk trigger chain set one by one, copy the stage variables, directed causal edges and risk output variables in the candidate risk trigger chain, and generate a copy of the candidate risk trigger chain; Select stage variables one by one from the candidate risk trigger chain replicas and register them as variables to be intervened in the stage; Read the records in the transaction stage variable table where the risk output variable is in a non-risk state, extract the stage variable values ​​with the same names as the variables in the stage to be intervened, and generate the benchmark variable values; Replace the values ​​of the intervention stage variables in the candidate risk triggering chain replica with the baseline variable values, while keeping the other stage variables and directed causal edges in the candidate risk triggering chain replica unchanged. Following the order of the directed causal edges in the candidate risk trigger chain replicas, update the state of the subsequent stage variables to the risk output variables according to the causal edge weight of the corresponding directed causal edge, and generate the risk output variables after intervention. The candidate risk trigger chain, the variables to be intervened, the benchmark variable value, the risk output variable after intervention, and the copy of the candidate risk trigger chain are registered as a transaction intervention twin graph.

7. The method for identifying transaction risk data based on big data analysis according to claim 6, characterized in that, The operation of generating risk output change records includes: Extract the risk output variable values ​​and risk level markers corresponding to the candidate risk trigger chains from the transaction observation causal graph, and register them as the observed risk output status; Extract the risk output variable values ​​and post-intervention risk level markers of the same candidate risk trigger chain after the intervention and replacement of stage variables from the transaction intervention twin graph, and register them as the intervention risk output status; Compare the changes in observed risk output status and intervention risk output status to generate a risk output change record; Record changes in risk outputs and associate them with candidate risk trigger chain numbers and variables in the intervention phase.

8. The method for identifying transaction risk data based on big data analysis according to claim 7, characterized in that, The operation of generating an invariant risk cause-effect graph includes: The transaction phase variable table is divided into several transaction environment sub-tables according to the transaction environment label; Within each trading environment sub-table, generate a causal graph of trading observations, a twin graph of trading interventions, and a record of changes in risk outputs. Using the candidate risk trigger chain number as the matching index, a consistency comparison is performed on the directed causal edge directions of the same candidate risk trigger chain in several transaction environment sub-tables, and candidate risk trigger chains with consistent directions are retained. Compare the risk output change records corresponding to the retained candidate risk trigger chains with the same change direction, and retain the candidate risk trigger chains with the same risk output change direction as unchanged risk trigger chains; Write the stage variables, directed causal edges, risk output variables, and risk output change records in the invariant risk trigger chain into the same causal graph to generate an invariant risk causal graph.

9. The method for identifying transaction risk data based on big data analysis according to claim 8, characterized in that, The operations for determining the minimum risk trigger chain and the main trigger variable include: Taking the invariant risk trigger chain as the processing object, delete the intermediate stage variables in the invariant risk trigger chain one by one according to the order of the directed causal edge connection to generate a reduced risk trigger chain; Perform combined interventions on variables in the retention phase of the risk reduction trigger chain to generate a reduction intervention twin graph; Generate corresponding risk output change records based on the reduced intervention twin map; Register risk reduction trigger chains that meet the preset confirmation conditions as valid risk reduction trigger chains; Among the effective risk reduction trigger chains, select the effective risk reduction trigger chain with the fewest stage variables and register it as the minimum risk trigger chain; Perform univariate interventions on each stage variable in the minimum risk trigger chain and generate univariate risk output change records. Register the stage variable with the largest change in risk output from the univariate risk output change record as the primary trigger variable.

10. The method for identifying transaction risk data based on big data analysis according to claim 9, characterized in that, The operation of outputting the transaction risk identification result includes: Using the transaction number as an index, write the minimum risk trigger chain, the main trigger variable, and the risk output change record into the same result record; Arrange the stage variables according to the order of the directed causal edges in the minimum risk trigger chain, and write the arranged stage variables, main trigger variables, and risk output change records into the risk cause record; The risk cause record is incorporated into the result record to generate the transaction risk identification result, and the transaction risk identification result is output according to the transaction number.

Images