Multi-agent based risk exploration method, device and equipment

Abstract

The application discloses a kind of based on multi-agent risk exploration method, risk exploration device and electronic equipment, it is related to financial risk control technical field, comprising: in response to risk exploration instruction, the atlas data of to-be-probed object is acquired;Through with main agent, the interactive dialogue for to-be-probed object is carried out, and the interactive dialogue content is obtained, and the target compression summary is obtained by dialogue content incremental compression;Through main agent, the exploration subtask carrying time indication is generated based on target compression summary, and is distributed to each sub-agent;Each sub-agent obtains the subgraph data of time range corresponding to time indication from atlas data according to time indication and carries out reasoning, and returns respective reasoning result;Through main agent, the risk exploration conclusion of to-be-probed object is generated according to the reasoning result of each sub-agent.The application simultaneously improves the accuracy and timeliness of risk exploration.

Description

Technical Field

[0001] This application relates to the field of financial risk control technology, and in particular to risk detection methods, risk detection devices and electronic devices based on multi-agent systems. Background Technology

[0002] In financial risk control scenarios, business analysts typically utilize artificial intelligence (such as intelligent agents) to perform risk analysis on massive amounts of graph data. However, AI is limited by the length of its context window, making it impossible to process complete graph data at once. Existing methods are forced to randomly prune or sample the graph data, resulting in the loss of key risk paths and the inability of AI to perceive complete correlation information, leading to missed risk detections. Furthermore, even after pruning, the remaining graph data is still enormous, significantly increasing the response latency of AI with limited computing power, failing to meet the timeliness requirements of real-time risk control.

[0003] The above factors together result in insufficient accuracy and timeliness of existing risk detection methods. Summary of the Invention

[0004] The main objective of this application is to provide a risk detection method, apparatus, and device based on multi-agent systems, aiming to solve the technical problems of insufficient accuracy and timeliness in existing risk detection methods.

[0005] To achieve the above objectives, this application proposes a multi-agent-based risk detection method, which includes: In response to a risk investigation command triggered for an object to be investigated, the map data of the object to be investigated is obtained; By engaging in interactive dialogue with the main intelligent agent regarding the object to be explored, the content of the interactive dialogue is obtained, and the interactive dialogue content is incrementally compressed to obtain a target compressed summary. The main agent determines exploration task information based on the target compressed digest, generates exploration sub-tasks carrying time indications according to the exploration task information, and distributes the exploration sub-tasks to each sub-agent. Each of the sub-agents obtains sub-graph data corresponding to the time range of the time indication from the graph data according to the time indication of the exploration sub-task, performs reasoning on the sub-graph data, and returns the reasoning results obtained by each to the main agent; The main agent generates a risk assessment conclusion for the object to be investigated based on the reasoning results of each sub-agent.

[0006] In one embodiment, prior to the step of acquiring the spectral data of the object to be investigated, the method includes: For each relationship record, the fragment identifier of the relationship record is determined according to the sequence identifier of the time window to which the relationship record belongs and the node identifier of the connected node. The relationship record is then stored in the corresponding storage fragment according to the fragment identifier. The relationship record is used to characterize the association between two nodes in the graph data, and the node is the object to be explored. Among them, all relationship records belonging to the same time window are allocated to a preset number of storage shards corresponding to the time window, and the relationship records stored in the same storage shard and belonging to the same time window are arranged in chronological order.

[0007] In one embodiment, the step of incrementally compressing the interactive dialogue content to obtain a target compressed summary includes: During the interactive dialogue, the main intelligent agent compresses the current round's compressed summary based on the compressed summary of the previous round's dialogue and the current round's dialogue content to obtain the current compressed summary of the current round.

[0008] In one embodiment, the step of compressing the current round of dialogue by the main intelligent agent based on the compressed summary of the previous round of dialogue and the dialogue content of the current round to obtain the current compressed summary of the current round includes: obtaining the compressed summary of the previous round of dialogue and the dialogue content of the current round; Semantic compression is performed on the dialogue content of the current round to obtain an initial compressed summary; Calculate the semantic dependency between the compressed summary of the previous round of dialogue and the initial compressed summary to obtain the cross-round semantic dependency weight; Based on the cross-round semantic dependency weights, the compressed summary of the previous round of dialogue is fused with the initial compressed summary to obtain the compressed summary of the current round.

[0009] In one embodiment, the exploration task information includes an exploration direction for the object to be explored and a time range corresponding to the exploration direction; the step of generating an exploration sub-task carrying a time indication based on the exploration task information and distributing the exploration sub-task to each sub-agent includes: An exploration subtask is generated based on the exploration direction, and a time tag is added to the exploration subtask according to the time range; The exploration subtasks labeled with the time tags are distributed to each sub-agent as exploration subtasks carrying time indications.

[0010] In one embodiment, after the step of generating a risk investigation conclusion for the object to be investigated, the following is included: Identify the key subgraph data on which the risk investigation conclusion is based, and convert the key subgraph data into a natural language description; The natural language description is input into a large language model to generate candidate risk features; Obtain the graph structure features of the key subgraph data, and score the candidate risk features based on the degree of matching between the graph structure features and the candidate risk features to obtain the quality score of each candidate risk feature; Candidate risk features whose quality scores are greater than a preset score threshold are used as target risk features; Based on the target risk characteristics, a risk detection skill is generated for the agent to invoke, wherein the risk detection skill includes a first risk detection skill for the main agent to invoke, or a second risk detection skill for the sub-agent to invoke.

[0011] In one embodiment, after the step of generating the risk detection skill for agent invocation, the method includes: Obtain simulated map data labeled with known risk tags; In a simulated environment, risk detection is performed on the simulated map data based on the risk detection skill to obtain a first detection result; The first detection result is compared with the known risk label to obtain the performance evaluation result of the risk detection skill; The risk detection skills that pass the performance evaluation are deployed in a real environment.

[0012] In one embodiment, after the step of acquiring simulated atlas data labeled with known risk tags, the method further includes: The simulated spectral data is subjected to graph structure mutation processing to obtain mutated spectral data; In a simulated environment, risk detection is performed on the mutation map data based on the risk detection skill to obtain a second detection result; The second exploration result is compared with the first exploration result to obtain the stability evaluation result of the risk exploration skill; The risk detection skill, for which both stability and performance evaluation results are passed, is deployed to a real-world environment.

[0013] Furthermore, to achieve the above objectives, this application also proposes a risk detection device, which includes: The data acquisition module is used to acquire the map data of the object to be explored in response to a risk exploration command triggered for the object to be explored; The interactive dialogue module is used to conduct interactive dialogue with the main intelligent agent on the object to be explored, obtain the interactive dialogue content, and incrementally compress the interactive dialogue content to obtain the target compressed summary. The generation and invocation module is used to determine exploration task information based on the target compressed digest through the main intelligent agent, generate exploration sub-tasks carrying time indications according to the exploration task information, and distribute the exploration sub-tasks to each sub-intelligent agent; The data reasoning module is used to obtain sub-graph data corresponding to the time range of the time indication from the graph data through each of the sub-intelligent agents according to the time indication of the exploration sub-task, and to reason about the sub-graph data, and return the reasoning results obtained by each to the main intelligent agent. The risk detection module is used to generate a risk detection conclusion for the object to be detected by the main agent based on the reasoning results of each sub-agent.

[0014] In addition, to achieve the above objectives, this application also proposes an electronic device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the multi-agent-based risk detection method described above.

[0015] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the multi-agent-based risk detection method described above.

[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the multi-agent-based risk detection method described above.

[0017] One or more technical solutions proposed in this application have at least the following technical effects: This application obtains a target compressed summary by conducting interactive dialogue with the target object in the main intelligent agent and incrementally compressing the content of the interactive dialogue. This allows the main intelligent agent to continuously accumulate key information across rounds based on the target compressed summary, under the premise of a limited context window, thereby parsing out the exploration task information for the target object, avoiding the problem of critical path loss caused by the forced random pruning when directly processing complete graph data in existing technologies.

[0018] Furthermore, by generating exploration sub-tasks carrying time indicators based on the parsed exploration task information, and distributing these sub-tasks to sub-agents, the sub-agents do not need to carry the full map data. They only need to acquire sub-map data within the time range corresponding to the time indicator for inference. This decomposes the task of processing massive map data into multiple sub-tasks with clear time and exploration boundaries, which are executed in parallel. Each sub-agent only needs to process a limited amount of sub-map data related to a specific exploration direction and time range in an independent context, rather than loading all map data at once. This avoids truncating map data due to insufficient context windows, ensuring that key risk paths associated with the explored object are fully preserved and reducing the risk of missed detection of risk links.

[0019] In the scheme of this application, each sub-agent only needs to process the subgraph data of its own dimension, which significantly reduces the response latency. The main agent, as the scheduler and decision-maker, only needs to process the target compressed summary and summarize the inference results returned by each sub-agent to generate risk exploration conclusions. It does not need to bear the computational burden of massive graph data. Thus, through the collaborative cooperation of the main agent and each sub-agent, a comprehensive and effective exploration of massive graph data can be achieved with limited computing power, while improving the accuracy and timeliness of risk exploration. Attached Figure Description

[0020] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This application provides a flowchart illustrating an embodiment of a multi-agent-based risk exploration method. Figure 1 ; Figure 2 This application provides a flowchart illustrating an embodiment of a multi-agent-based risk exploration method. Figure 2 ; Figure 3 This is a schematic diagram provided for an embodiment of the risk detection method based on multi-agent technology in this application; Figure 4 This is a schematic diagram of the module structure of the risk detection device in this application; Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the multi-agent risk exploration method of this application.

[0023] Explanation of icon numbers: 101. Node; 102. Edge.

[0024] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0025] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of this application and are not intended to limit this application.

[0026] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0027] In financial risk control investigation scenarios, business analysts typically utilize artificial intelligence (such as intelligent agents) to perform risk analysis on massive graph data containing hundreds of thousands of nodes and edges to identify potential risk links targeting specific objects. Existing methods usually directly acquire all graph data and input it into the intelligent agent for inference analysis. However, the intelligent agent is limited by a fixed context window length and cannot receive and process all graph data containing hundreds of thousands of nodes and edges at once.

[0028] To accommodate the context capacity limitations of intelligent agents, current methods are forced to randomly prune or sample all graph data, inputting only a portion of the graph data into the agent for analysis. During this process, the pruned or truncated graph data may contain critical risk paths related to the object being investigated. The loss of these critical risk paths directly prevents the agent from perceiving the complete relational structure during inference, leading to missed detections of risky links.

[0029] Furthermore, faced with still massive graph data even after pruning, the agent needs to carry all graph structure information within a limited context window. This causes the agent's attention to be scattered across a large number of irrelevant nodes and edges, making it difficult to focus on high-risk local structures for deep reasoning. At the same time, the agent's serial processing of massive graph data significantly increases response latency under limited computing resources, failing to meet the efficiency requirements of real-time risk control scenarios.

[0030] The above factors together lead to existing methods having problems when faced with massive map data, such as missing key risk paths due to map data truncation, difficulty in focusing on high-risk structures due to distraction, and inability to respond in real time due to low efficiency of serial computing. The accuracy and timeliness of risk detection cannot be effectively guaranteed.

[0031] It should be noted that the executing entity in this embodiment can be an electronic device, such as a desktop computer, laptop computer, smartphone, tablet computer, server, etc.; or it can be a computing service device with data processing, network communication, and program execution functions, such as a cloud server, edge computing node, etc. The following description uses an electronic device as an example to illustrate this embodiment and the subsequent embodiments.

[0032] In this embodiment, the main intelligent agent and the sub-intelligent agent can be deployed in the same electronic device, or deployed in multiple electronic devices respectively and interact through a communication network. The electronic device is connected to a graph database server via a wired or wireless network, and the graph database server is used to store the graph data and provide graph query services. This application does not limit the specific deployment method of the main intelligent agent, sub-intelligent agents and graph database.

[0033] Based on this, embodiments of this application provide a risk detection method based on multiple agents, referring to... Figure 1 , Figure 1 This is a flowchart illustrating an embodiment of the risk detection method based on multi-agent systems in this application.

[0034] In one feasible embodiment, the application scenarios of the technical solution of this application can be: anti-fraud monitoring of financial institutions, risk control review of auto finance installment business, post-loan risk screening of consumer finance companies, and transaction security monitoring of internet platforms. The target users of the technical solution of this application can be: risk analysts, anti-fraud auditors, post-loan managers, and other business personnel of financial institutions, as well as the risk detection system on electronic devices that undertake the detection needs of the aforementioned business personnel.

[0035] In this embodiment, the risk detection method based on multi-agent technology includes steps S1 to S5: Step S1: In response to a risk investigation command triggered for the object to be investigated, acquire the map data of the object to be investigated; It should be noted that when an electronic device receives a risk investigation instruction triggered against a target, the device initiates the risk investigation process. This risk investigation instruction can be triggered manually by business personnel clicking the investigation button on the electronic device's interface, or it can be automatically triggered by the upstream risk control system based on preset rules. The target of this risk investigation is the primary subject of the investigation. In a financial risk control scenario, this target can be an individual customer with abnormal transactions, a corporate account alerted by the system, or a device marked as suspicious.

[0036] Optionally, the response can be understood as the electronic device initiating a corresponding processing flow after receiving a trigger signal.

[0037] Optionally, the risk investigation instruction may include unique identification information of the object to be investigated, such as customer number, account ID, device serial number, etc. Upon receiving the risk investigation instruction, the electronic device parses the unique identifier of the object to be investigated from the instruction and then uses this unique identifier as a query condition to retrieve the graph data of the object to be investigated from the dynamic time-series graph database. This graph data is a structured data set in the dynamic time-series graph with the object to be investigated as the central node. The dynamic time-series graph is a graph database storage structure used to record the relationships between entities in a financial business scenario. The edge data (i.e., relationship records) is distributed and stored using the result of a joint hash of the time window identifier and the vertex identifier as the basis for sharding and routing. Furthermore, in the underlying storage, it is arranged continuously using the timestamp field as the highest-order prefix of the storage key. Therefore, the graph data contains time dimension information. The graph data may include the entity node information of the object to be investigated, the neighboring entity node information directly associated with the object to be investigated, the time-series edge relationship information between entity nodes, and the timestamp information corresponding to each edge.

[0038] Understandably, in financial risk control scenarios, fraudulent behavior is hidden within multi-hop associations and time series, thus requiring the prior acquisition of complete graph data of the target object as data for subsequent analysis and reasoning. The graph data acquired in step S1 will be sliced ​​by each sub-agent according to time range in step S4, and can also be used by the main agent as a reference benchmark for comprehensive decision-making in step S5.

[0039] Step S2: Through interactive dialogue with the main intelligent agent, the interactive dialogue content is obtained, and the interactive dialogue content is incrementally compressed to obtain the target compressed summary. It should be noted that an interactive dialogue is initiated within the main intelligent agent targeting the object to be investigated. This main intelligent agent is a large language model intelligent agent running on the electronic device. As the scheduler and decision-maker of the entire risk investigation process, it is responsible for interacting with business personnel using natural language and understanding their investigation intentions. This interactive dialogue is multi-turn, meaning that the business personnel and the main intelligent agent can continuously engage in multiple rounds of question-and-answer sessions. In each round, the business personnel input new dialogue content, and the main intelligent agent responds accordingly. As the number of interaction rounds increases, the content of the interactive dialogue continuously accumulates and grows. The number of interaction rounds can be pre-set, and the interaction stops once the set number of interaction rounds is reached.

[0040] Optionally, the main intelligent agent can be an AI (Artificial Intelligence) program module with autonomous decision-making capabilities built on a large language model.

[0041] Optionally, the interactive dialogue content may include the inquiry questions input by business personnel, the responses from the main agent, and entity information, relationship descriptions, and time conditions involved in the communication. In each round of interaction, the main agent performs incremental compression on the dialogue content to obtain a compressed summary for the current round. This incremental compression is a lightweight semantic compression method that does not rely on external vector databases. Each round's new compressed summary inherits key information from the previous round's summary while incorporating new information from the current round's dialogue content, allowing the compressed summary to continuously accumulate inquiry elements across rounds. These inquiry elements may include entities, relationships, and time, i.e., the direction of inquiry and its corresponding time range. Once the compressed summary has accumulated complete inquiry elements, it becomes the target compressed summary. This target compressed summary serves as the basis for determining the inquiry task in subsequent steps.

[0042] Understandably, step S2 addresses the information loss problem in long dialogue scenarios. In actual financial risk investigation, business personnel need to clarify the investigation direction through multiple rounds of dialogue. For example, they first specify the target to be investigated, then state the time period to be focused on, and then add the specific risk type. Without incremental compression, as the number of dialogue rounds increases, the content of the interactive dialogue will exceed the context window limit of the large language model, causing early key information to be discarded. Through incremental compression, the main agent continuously retains key investigation elements across rounds in the compressed summary at extremely low cost, providing complete intent information for the accurate generation of subsequent investigation subtasks. The target compressed summary generated in step S2 will be used in step S3 to determine the investigation task information.

[0043] Step S3: The main agent determines the exploration task information based on the target compressed digest, generates exploration sub-tasks carrying time indications according to the exploration task information, and distributes the exploration sub-tasks to each sub-agent. It should be noted that after obtaining the target compressed summary in step S2, the electronic device continues to parse the target compressed summary by the main intelligent agent to determine the exploration task information for the object to be explored. This exploration task information describes the specific content of the exploration elements contained in the target compressed summary. When parsing the target compressed summary, the main intelligent agent extracts the relevant entity information of the object to be explored, the specific relationship dimensions that need to be explored, and the time range corresponding to those specific relationship dimensions. The main intelligent agent summarizes this information extracted from the target compressed summary into the exploration task information.

[0044] Optionally, the exploration task information may include the entity identifier of the object to be explored, the exploration direction, and the time range corresponding to the exploration direction. For example, if the target compressed summary contains the key semantics "Zhang San's transfer transactions have been abnormal in the past three months", then the exploration task information may include: the entity is "Zhang San", the exploration direction is "transfer transactions", and the time range is "the past three months".

[0045] After determining the exploration task information, the main agent generates exploration subtasks carrying time indicators based on that information. Each exploration subtask is an atomic exploration unit that can be independently executed on a single dimension, derived from the complete exploration intent within the exploration task information. The time indicator is a explicitly marked time range constraint within the exploration subtask, derived from the time range specified in the exploration task information. For example, if the exploration task information includes two dimensions: "transfer transactions in the last three months" and "device associations in the last three months," the main agent generates two exploration subtasks: one for transfer transactions carrying a "last three months" time indicator, and another for device associations carrying a "last three months" time indicator.

[0046] After generating exploration subtasks, the master agent distributes these subtasks to multiple sub-agents. Each sub-agent is a small-parameter model agent running on an electronic device, acting as the executor of the entire risk exploration process. It undertakes the exploration subtasks distributed by the master agent and executes them independently. The contexts of each sub-agent are completely isolated, and they do not share dialogue history or intermediate state information. The master agent distributes exploration subtasks to corresponding types of sub-agents based on the exploration dimensions involved in different sub-tasks. Optionally, sub-agents may include risk analysis sub-agents and data analysis sub-agents: the risk analysis sub-agent provides professional judgment according to the business vertical domain dimension; the data analysis sub-agent is responsible for performing specific data queries and result integration.

[0047] Understandably, step S3 transforms the natural language intent of the business personnel into executable atomic probing units. If a single agent processes probing across multiple dimensions simultaneously, the information within a single context becomes excessively complex, exceeding the window limit. By splitting probing subtasks and distributing them to multiple context-isolated sub-agents for parallel execution, each sub-agent only needs to focus on its own received single probing subtask, avoiding context pollution and token (lexical) accumulation. The probing subtasks generated in step S3 will be used in step S4, with each sub-agent executing subsequent operations based on the time indication of its received probing subtask.

[0048] Step S4: Each of the sub-agents obtains sub-graph data corresponding to the time range of the time indication from the graph data according to the time indication of the exploration sub-task, and performs reasoning on the sub-graph data, and returns the reasoning results obtained by each to the main agent; It should be noted that after each sub-agent receives the exploration sub-task distributed by the master agent, the electronic device executes its respective exploration sub-task in parallel. Each sub-agent first reads the time indication from its received exploration sub-task, and then, based on the time indication, filters data within the time range corresponding to the time indication from the graph data of the object to be explored obtained in step S1. Specifically, since the edge data in the graph data is arranged continuously in the underlying storage using the timestamp field as the highest-order prefix of the storage key, each sub-agent performs sequential range positioning in the graph data based on the start and end times in the time indication, extracting all entity node information and temporal edge relationship information falling between the start and end times to form subgraph data. This subgraph data is a subset of the complete graph data of the object to be explored that is related to a specific time range.

[0049] Optionally, each sub-agent can further extract specific data related to the exploration dimension from the subgraph data based on the different exploration dimensions of the exploration sub-tasks it receives. For example, a sub-agent with the exploration dimension of "transfer transaction" only focuses on edge relationships of type "transfer" in the subgraph data; a sub-agent with the exploration dimension of "device association" only focuses on edge relationships of type "device login" in the subgraph data.

[0050] After acquiring the subgraph data, each sub-agent performs inference on the subgraph data within its own independent and isolated context. This inference involves each sub-agent analyzing and calculating the node and edge relationships in the subgraph data based on a small-parameter model, identifying structured information that conforms to risk patterns. Optionally, this inference may include counting the number of associated nodes in the subgraph data, calculating the degree of clustering in the subgraph data, and identifying abnormal path patterns in the subgraph data.

[0051] After completing their reasoning, each sub-agent generates its own reasoning result for its respective dimension and returns it to the master agent. This reasoning result contains risk clues identified by each sub-agent from the subgraph data that are relevant to its respective exploration dimension. The reasoning results of each sub-agent can be returned to the master agent by writing them to a shared storage space. Optionally, the shared storage space is a temporary data storage area on an electronic device that can be read and written by multiple agents.

[0052] Understandably, step S4 enables parallel exploration, significantly improving the efficiency of risk exploration. If all map data were processed by a single agent, not only would the context window be insufficient, but the computation time would also be excessively long. By having each sub-agent process the data in parallel along its own dimension, each sub-agent only processes the sub-map data related to its own exploration dimension, both the time for a single inference is shortened, and the exploration of each dimension does not interfere with each other. The inference results returned by each sub-agent in step S4 will be used in step S5, where the main agent makes a comprehensive decision based on these inference results.

[0053] Step S5: The main agent generates a risk investigation conclusion for the object to be investigated based on the reasoning results of each sub-agent.

[0054] It should be noted that after each sub-agent returns its reasoning results in step S4, the main agent reads all reasoning results from the shared storage space and generates a risk investigation conclusion for the object to be investigated.

[0055] In one embodiment, the reasoning results from each dimension can be fused and analyzed with the graph data. This fusion analysis refers to the main agent integrating the fragmented risk clues returned by each sub-agent into a complete risk link description. Optionally, the fusion analysis may include arranging the risk clues into a temporal evolution path in chronological order, and piecing together the risk clues into a multi-hop association chain according to their proximity.

[0056] Optionally, the risk investigation conclusion is the final judgment on whether the object to be investigated poses a risk. Optionally, the risk investigation conclusion may include the risk level, risk type, risk chain path description, and recommended actions for the object to be investigated.

[0057] When performing fusion analysis, the main agent can also use the graph data obtained in step S1 as a reference benchmark to verify whether there are any omissions or biases in the inference results of each sub-agent. Specifically, the main agent can combine the global statistical features in the graph data, such as the total number of associated nodes, the total number of edges, and the overall graph density of the object to be explored, to cross-validate the abnormal segments in each inference result: if the abnormal segment in the inference result deviates little from the global statistical features, the inference result may be a false alarm and its weight should be reduced; if the deviation is high, the inference result does indeed point to an anomaly and its confidence should be increased.

[0058] After generating a risk assessment conclusion, the main AI agent outputs the conclusion in natural language to the interactive dialogue interface for review by business personnel. After reviewing the conclusion, business personnel can raise new questions in the dialogue to trigger a new round of interaction and assessment; alternatively, they can confirm the conclusion and end the current risk assessment.

[0059] Understandably, a single-dimensional reasoning result can only reflect a local characteristic of the object under investigation in a certain aspect, and cannot form a complete risk judgment. For example, "the existence of a large number of transfers" alone is not enough to determine fraud. It is also necessary to combine multi-dimensional evidence such as "device association" and "time clustering". By integrating the fragmented reasoning results of each sub-agent into a complete risk chain description through the main intelligent agent, and presenting it to business personnel in the form of natural language, a solution for multi-agent collaborative investigation with business personnel is formed. This not only solves the efficiency bottleneck of human intervention when facing complex graphs, but also preserves the final judgment and leadership of business personnel.

[0060] In one feasible implementation, prior to step S1, which involves acquiring the spectral data of the object to be investigated, the following steps are included: For each relationship record, the fragment identifier of the relationship record is determined according to the sequence identifier of the time window to which the relationship record belongs and the node identifier of the connected node. The relationship record is then stored in the corresponding storage fragment according to the fragment identifier. The relationship record is used to characterize the association between two nodes in the graph data, and the node is the object to be explored. Among them, all relationship records belonging to the same time window are allocated to a preset number of storage shards corresponding to the time window, and the relationship records stored in the same storage shard and belonging to the same time window are arranged in chronological order.

[0061] It should be noted that before obtaining the graph data in step S1, all relationship records need to be stored in the database to construct the dynamic time-series graph. This relationship record is used to represent the association between two nodes in the graph data. The node is a vertex in the graph; in a financial risk control scenario, the node can be an entity such as a customer account, device, mobile phone number, or IP address. For example, the relationship record may include records of customer A transferring money to customer B, customer C logging in on device D, and customer E binding mobile phone number F. Each relationship record contains a creation timestamp, which is used to determine the time window to which the relationship record belongs. The time window is a time interval obtained by dividing a continuous time axis into fixed durations. Optionally, the fixed duration can be one day, then each day corresponds to one time window. The time window has a sequence identifier; optionally, the sequence identifier can be a string obtained by converting the start date of the time window into YYYYMMDD format, for example, the time window sequence identifier corresponding to January 1, 2011 is "20110101".

[0062] Optionally, when the electronic device receives each relationship record, it first reads the node identifiers of the two nodes connected to the relationship record, as well as the creation timestamp of the relationship record. Then, the electronic device determines the time window to which the relationship record belongs based on the creation timestamp and obtains the sequence identifier of the time window. The node identifier is a unique identifier for the node; in a financial risk control scenario, the node identifier can be an account number, a unique device identifier, a mobile phone number, etc. The electronic device performs joint processing on the sequence identifier of the time window and the node identifier of either of the two nodes connected to the relationship record to determine the shard identifier of the relationship record. This shard identifier is used to uniquely identify the storage shard to which the relationship record should be allocated.

[0063] Optionally, the method for determining the shard identifier of the relationship record is as follows: the electronic device performs a joint hash calculation on the sequence identifier of the time window and the node identifier according to a preset hash algorithm to obtain a hash value; the hash value is then moduloed by the total number of shards, and the modulo result is the shard identifier. Since the calculation of the shard identifier depends on both the time window and the node identifier, relationship records within the same time window will be allocated to several storage shards corresponding to that time window, rather than being distributed across all storage shards.

[0064] This storage shard is a physical storage unit used for horizontally partitioning data in a distributed graph database. After calculating the shard identifier of a relation record, the electronic device writes the relation record into the storage shard corresponding to that identifier. For all relation records within the same time window, since all relation records within the same time window have the same time window sequence identifier, the shard identifiers of all relation records within the same time window are limited to a preset number of K possible values, i.e., these preset number K storage shards, and will not fall into other storage shards outside of these preset number K storage shards. This preset number K is a pre-configured constant, and it is less than the total number of shards in the distributed graph database.

[0065] Optionally, when the electronic device writes a relation record to a storage shard, it uses the timestamp field of the relation record as the highest-order prefix of the storage key in the underlying key value within that storage shard, placing it before the node identifier field of the node to which the relation record is connected. Through this storage key concatenation method, all relation records stored within the same storage shard and belonging to the same time window are arranged consecutively on the physical disk according to the chronological order of their timestamp fields. This chronological order is the order of the relation records' creation timestamps from earliest to latest. The electronic device writes these relation records sequentially to the contiguous physical address space of the disk according to this chronological order.

[0066] Understandably, this solves the problem of efficient querying of time-series data in dynamic time-series graphs. In financial risk control scenarios, identifying fraudulent activities requires tracing back the relationships within a specific time window, such as "the last three months" or "January". Traditional graph databases default to hash sharding based on node identifiers, resulting in data within the same time window being scattered across all storage shards. Queries require scanning all storage shards, triggering a full network scan. Furthermore, the underlying storage is sorted by node identifiers, causing data within the same time window to be scattered across disks, requiring numerous random reads during queries.

[0067] The storage method of this embodiment limits relationship records within the same time window to a preset number of K storage slices. During a query, only these preset number of K storage slices need to be accessed, eliminating the need to access other storage slices. Simultaneously, at the storage layer, relationship records within the same time window are arranged consecutively on the disk according to timestamps. During a query, only a sequential range scan starting from the beginning timestamp is needed, transforming random reading into sequential reading and significantly reducing I / O overhead. The advantages of this storage method are evident in step S1 when acquiring graph data. Specifically, the graph data of the object to be explored can be quickly obtained directly from the dynamic time-series graph. Furthermore, in the subsequent step S4, when each sub-agent extracts sub-graph data from the graph data according to time indications, time-series data filtering can be completed with extremely low I / O overhead.

[0068] For example, to help understand the implementation process of the multi-agent-based risk detection method obtained by combining this embodiment with the above embodiments, please refer to... Figure 2 Divide the continuous time axis into discrete time windows of fixed duration (e.g., one day). Figure 2 The time window is numbered from "Day 1", "Day 2" to "Day n", and a unique sequence identifier is assigned to each window, i.e., 1, 2, 3...n represents the sequence identifier of the window. When data is entered into the database, the sequence identifier of the time window to which each relation record belongs and the node identifier of the nodes it connects to are extracted. These two are then used to perform a joint hash calculation to determine the shard identifier of the record (i.e., 1, 2, 3...x represents the shard identifier). Thus, all relation records belonging to the same time window (such as...) Figure 2 All records in Day 1 are routed and written only to a preset number of specific storage shards (i.e., Figure 2 Instead of scattering them across all storage shards, the shards are padded with P(1,1) ~ P(x,1); P(1,2) ~ P(x,2); P(1,n) ~ P(x,n)). This sharding strategy allows irrelevant shards to be directly padded during subsequent queries, completely avoiding the high I / O overhead of a full network scan.

[0069] In one feasible implementation, the exploration task information includes the exploration direction for the object to be explored and the time range corresponding to the exploration direction; in step S3, the step of generating an exploration sub-task carrying a time indication based on the exploration task information and distributing the exploration sub-task to each sub-agent includes: Step S31: Generate an exploration sub-task according to the exploration direction, and label the exploration sub-task with a time tag according to the time range; It should be noted that the main intelligent agent has already parsed the exploration task information from the target compressed digest in step S3. This exploration task information includes the exploration direction for the object to be explored and the corresponding time range. The exploration direction is the specific relationship dimension that the main intelligent agent parsed from the target compressed digest, which needs to be explored regarding the object to be explored. In a financial risk control scenario, this exploration direction can be specific exploration dimensions such as "transfer transaction exploration," "device association exploration," "IP address aggregation exploration," and "mobile phone number binding exploration." The time range is the time constraint corresponding to the exploration direction, that is, the time interval that the exploration direction should cover, as parsed from the target compressed digest by the main intelligent agent. In a financial risk control scenario, this time range can be described as "the past three months," "January 2011," or "from January 1, 2011 to June 30, 2011," etc.

[0070] Optionally, after obtaining the exploration task information, the main agent generates a corresponding exploration subtask based on the exploration direction. This exploration subtask encapsulates the exploration direction into an atomic exploration unit that can be executed independently in a single dimension. Optionally, when the exploration task information contains multiple exploration directions, the main agent generates multiple corresponding exploration subtasks for each exploration direction, with each subtask corresponding to one exploration direction. Simultaneously, the main agent labels the exploration subtask with a time tag based on the time range corresponding to the exploration direction. This time tag is a explicitly marked time range constraint within the exploration subtask, indicating that the execution scope of the exploration subtask should be limited to this time range. Optionally, the main agent converts the time range into a standardized time interval format as the time tag, for example, converting "the last three months" into the specific start and end dates of three months backward from the current date, such as "2011-01-01 to 2011-04-01". The main agent writes the timestamp into the attribute field of the exploration subtask, thus enabling the exploration subtask to carry explicit time constraint information. After completing the generation and labeling of all exploration subtasks, the main agent proceeds to step S32.

[0071] Understandably, step S31 concretizes the exploration direction in the natural language intent of business personnel into an executable exploration subtask, and explicitly transforms the implicit time constraints into standardized time labels, so that each sub-agent can accurately filter data based on the time label when executing the exploration subtask, avoiding deviations in the exploration range caused by time semantic ambiguity.

[0072] Step S32: Distribute the exploration subtasks labeled with the time tags as exploration subtasks carrying time indications to each sub-agent.

[0073] It should be noted that after the main agent generates the probe subtask labeled with the time tag in step S31, it uses the probe subtask labeled with the time tag as a probe subtask carrying a time indication. The time indication is the time tag labeled in the probe subtask, which is used to indicate the time range constraint of the probe subtask to the sub-agent receiving the probe subtask.

[0074] Optionally, the master agent distributes the probing subtask carrying the time indication to each sub-agent. This distribution is the action of the master agent transmitting the probing subtask to the corresponding sub-agent via network communication or inter-process communication. During the distribution process, the master agent distributes the probing subtask to the corresponding type of sub-agent based on the probing direction corresponding to different probing sub-tasks. Optionally, the sub-agent may include a risk analysis sub-agent and a data analysis sub-agent. The master agent distributes probing sub-tasks with a business analysis direction to the risk analysis sub-agent, and probing sub-tasks with a data processing direction to the data analysis sub-agent. When there are multiple probing sub-tasks, the master agent distributes each probing sub-task to multiple sub-agents respectively, so that each sub-agent can execute its received probing sub-task in parallel. After receiving the probing subtask carrying the time indication, each sub-agent proceeds to step S4.

[0075] Understandably, the main agent distributes each exploration subtask to multiple sub-agents, and each sub-agent executes the exploration subtask in parallel within its own independent operating environment without interfering with each other. This distribution process ensures that the time indication of each exploration subtask is transmitted to the corresponding sub-agent along with the task, enabling each sub-agent in step S4 to accurately extract the subgraph data for the corresponding time range based on the time indication received from the exploration subtask.

[0076] This embodiment provides a multi-agent-based risk exploration method. By engaging in interactive dialogue with the target object within the main agent and incrementally compressing the dialogue content, a target compressed summary is obtained. This allows the main agent to continuously accumulate key information across rounds based on the target compressed summary, given a limited context window. This enables the parser of exploration task information for the target object, avoiding the critical path loss problem caused by random pruning when directly processing complete graph data in existing technologies. Furthermore, by generating exploration sub-tasks carrying time indicators based on the parsed exploration task information, and distributing these sub-tasks to sub-agents, the sub-agents do not need to carry the full map data. They only need to acquire sub-map data within the time range corresponding to the time indicator for inference. This decomposes the task of processing massive map data into multiple sub-tasks with clear time and exploration boundaries, which are executed in parallel. Each sub-agent only needs to process a limited amount of sub-map data related to a specific exploration direction and time range in an independent context, rather than loading all map data at once. This avoids truncating map data due to insufficient context windows, ensuring that key risk paths associated with the explored object are fully preserved and reducing the risk of missed detection of risk links. In the scheme of this application, each sub-agent only needs to process the subgraph data of its own dimension, which significantly reduces the response latency. The main agent, as the scheduler and decision-maker, only needs to process the target compressed summary and summarize the inference results returned by each sub-agent to generate risk exploration conclusions. It does not need to bear the computational burden of massive graph data. Thus, through the collaborative cooperation of the main agent and each sub-agent, a comprehensive and effective exploration of massive graph data can be achieved with limited computing power, while improving the accuracy and timeliness of risk exploration.

[0077] For example, to help understand the implementation process of the multi-agent-based risk detection method obtained by combining this embodiment with the above embodiments, please refer to... Figure 3 , Figure 3 (a) shows the complete graph data of the object to be explored after the risk exploration command is triggered. In this graph, 101 is a node, which can represent the object to be explored and its neighboring entities; 102 is an edge, which can represent the relationship record between the object to be explored and its neighboring entities. Figure 3 In the graph, black nodes represent objects to be investigated (such as suspected high-risk customers or suspicious devices), and nodes of different colors (blue, green, and gray) around them represent neighboring entities with various relationships with the object to be investigated (such as trading partners, frequently used devices, associated phone numbers, etc.). At this point, the graph shows the undirected network of relationships of the object to be investigated over the entire time range, reflecting the complete graph data of the object to be investigated.

[0078] Figure 3(b) illustrates the subgraph data obtained by each sub-agent based on the exploration sub-tasks. In the interactive dialogue, the main agent parses the exploration sub-tasks for specific exploration directions and time ranges using target compressed summaries, and distributes the sub-tasks carrying time indications to each sub-agent. Each sub-agent, based on its received time indication (e.g., "last three months"), extracts data from... Figure 3 (a) Extract the local graph structure within the time indication range from the complete graph data, i.e. Figure 3 (b) shows the subgraph. Compare. Figure 3 (a), Figure 3 In (b), the number of nodes is significantly reduced, and the connections between nodes are transformed into directional arrows. These directional arrows represent the local structure of risk links with clear temporal relationships and exploration directions extracted by each sub-agent based on exploration task information under specific time window constraints.

[0079] pass Figure 3 (a) to Figure 3 (b) In this application, the massive full graph data is precisely cropped into multiple subgraph data with time constraints and dimensional separation. Each sub-agent only needs to process this type of small-scale, well-defined subgraph data in an independent context, avoiding the problem of large models being forced to randomly crop due to insufficient context windows, resulting in the loss of key risk paths, and also significantly reducing inference latency.

[0080] Based on the above embodiments of this application, in another embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. Based on this, step S2, the step of incrementally compressing the interactive dialogue content to obtain the target compressed summary, includes: Step S21: During the interactive dialogue, the main agent compresses the current round's compressed summary based on the compressed summary of the previous round's dialogue and the dialogue content of the current round to obtain the current compressed summary of the current round.

[0081] It should be noted that in each round of interaction, the main agent needs to fuse and compress the dialogue content of the current round with the information accumulated in previous rounds to generate a compressed summary for that round. This compressed summary of the previous round's dialogue is generated by the main agent in the previous round of interaction and carries key semantic information from all historical dialogues up to the previous round. When the main agent is in the first round of interaction, the compressed summary of the previous round's dialogue is empty.

[0082] Optionally, the dialogue content of the current round is the original dialogue text generated in the current interaction round. In a financial risk control scenario, the dialogue content of the current round can be a newly input probing question from a business person, or the main agent's response to the probing question. The main agent takes the compressed summary of the previous round's dialogue and the dialogue content of the current round as input, compresses the dialogue content of the current round, and merges the compressed result with the compressed summary of the previous round's dialogue to obtain the current compressed summary of the current round. This current compressed summary carries the key semantic information of all dialogue content from the first round of interaction to the current round, and is used as the compressed summary of the previous round's dialogue in the next round of interaction. When the interaction ends, this current compressed summary is the target compressed summary.

[0083] Understandably, step S21 enables the continuous transmission of information across rounds. Currently, the agent can only obtain the dialogue content of the current round in each interaction, and cannot perceive the exploration elements already identified in previous rounds. By using the compressed summary of the previous round's dialogue and the dialogue content of the current round as compressed input, each round's new compressed summary can inherit key historical information while incorporating new information, thereby continuously accumulating complete exploration elements within a limited context window.

[0084] In one feasible implementation, step S21 includes: Step A21: Semantically compress the dialogue content of the current round to obtain an initial compressed summary; It should be noted that after receiving the dialogue content of the current round, the main agent performs semantic compression on the dialogue content of the current round, extracting key semantic information, filtering out redundant and irrelevant information, and generating an initial compressed summary of the dialogue content of the current round. This initial compressed summary is the result of compressing the dialogue content of the current round separately, containing the core semantic information of the current round, but it has not yet been merged with the compressed summary of the previous round. This initial compressed summary, as a semantic condensation representation of the dialogue content of the current round, will be merged with the compressed summary of the previous round in subsequent steps A22 and A23.

[0085] Understandably, step A21 independently compresses the dialogue content of the current round into an initial compressed summary, so that when calculating the dependency between the compressed summary of the previous round of dialogue and the dialogue content of the current round, the compressed semantic units can be used as the processing object, rather than the original long text, thereby reducing the computational complexity.

[0086] Step A22: Calculate the semantic dependency between the compressed summary of the previous round of dialogue and the initial compressed summary to obtain the cross-round semantic dependency weight; It should be noted that after generating the initial compressed summary in step A21, the compressed summary of the previous round of dialogue is obtained, and the semantic dependency between the compressed summary of the previous round of dialogue and the initial compressed summary is calculated. This semantic dependency is used to measure the strength of the association between each semantic unit in the initial compressed summary and each semantic unit in the compressed summary of the previous round of dialogue. Optionally, the semantic dependency can be calculated by comparing each semantic unit in the compressed summary of the previous round of dialogue with each semantic unit in the initial compressed summary using an attention mechanism, calculating the semantic similarity between each pair of semantic units, which is the quantitative representation of the semantic dependency. This quantitative representation of the semantic dependency is used as the cross-round semantic dependency weight. This cross-round semantic dependency weight is a weight distribution expressed in numerical form, used to indicate the strength of the association between the semantic information of each part of the dialogue content in the current round and the historical dialogue information.

[0087] Understandably, step A22 determines the semantic correlation between the current round of dialogue and historical dialogue content. In multi-round dialogues within a financial risk control scenario, the information mentioned by business personnel in different rounds is interconnected. For example, the first round mentions "Zhang San," the second round mentions "his transfer records," and the third round mentions "the devices used for these transfers." There is a semantic progression and dependency between each round. By calculating cross-round semantic dependency weights, the logical connections between key information in different rounds can be accurately captured, avoiding treating each round of dialogue content as isolated fragments.

[0088] Step A23: Based on the cross-round semantic dependency weights, fuse the compressed summary of the previous round of dialogue with the initial compressed summary to obtain the compressed summary of the current round.

[0089] It should be noted that after obtaining the cross-round semantic dependency weight in step A22, the compressed summary of the previous round of dialogue and the initial compressed summary are obtained, and the information fusion strategy is determined based on the cross-round semantic dependency weight. This information fusion is the process of merging two parts of information from different rounds into a unified semantic representation. Optionally, the semantic units in the initial compressed summary are weighted according to the weight values ​​in the cross-round semantic dependency weight: semantic units with higher semantic dependency weights (e.g., weights greater than or equal to 0.5) indicate that the semantic unit has a higher degree of correlation with the compressed summary of the previous round of dialogue and should be retained and focused on fusion; semantic units with lower semantic dependency weights (e.g., weights less than 0.5) indicate that the semantic unit has a lower degree of correlation with the compressed summary of the previous round of dialogue and can be discarded, but a lower semantic dependency weight may also belong to the new information in the current round. Therefore, it can be set that semantic units with a weight less than 0.5 in two consecutive rounds are discarded, and if only one of the two consecutive rounds has a weight less than 0.5, it is retained to supplement the missing content in the historical information. Based on the weighted adjustment result, the compressed summary of the previous round of dialogue is concatenated and compressed with the initial compressed summary to generate the compressed summary of the current round. The compressed summary of the current round contains both historical key information from the compressed summary of the previous round of dialogue and newly added key information from the initial compressed summary, and the degree of retention of each piece of information is dynamically adjusted by the cross-round semantic dependency weight.

[0090] Optionally, after fusion, data cleaning or filtering can be performed (i.e., if the weights of two consecutive rounds are both less than 0.5, the data is discarded), and then a compressed summary of the current round is obtained.

[0091] Understandably, step A23 completes the fusion and compression of cross-round information. Guided by the cross-round semantic dependency weights, the compressed summary of the current round can adaptively retain both historical and newly added key information: if a semantic unit in the current round's dialogue content is highly relevant to historical information, it is merged and enhanced with historical information; if a semantic unit in the current round's dialogue content is weakly related to historical information, it is added as a new exploration element. This dynamic adjustment mechanism ensures that as the dialogue rounds increase, the compressed summary always maintains the most complete cross-round semantic logic chain within the preset compression ratio, neither losing key information due to over-compression nor exceeding the context window limit due to retaining too much redundant information.

[0092] Based on the above embodiments of this application, in another embodiment of this application, the same or similar content as the above embodiments can be referred to the above description, and will not be repeated hereafter. This application further provides a knowledge accumulation step after the risk exploration conclusion is generated, used to transform the effective risk links discovered during this risk exploration process into reusable experience assets for the system.

[0093] Based on this, after step S5, which generates the risk investigation conclusion of the object to be investigated, the following steps are included: Step A51: Determine the key sub-graph data on which the risk investigation conclusion is based, and convert the key sub-graph data into a natural language description; It should be noted that after generating the risk investigation conclusion in step S5, the electronic device extracts the complete inference link upon which the risk investigation conclusion was based, and determines the corresponding key subgraph data based on the complete inference link. This key subgraph data is the core evidence subset used by the main agent in step S5 for fusion analysis; that is, the subgraph structure composed of nodes and relationship records directly related to the risk investigation conclusion in the graph data of the object to be investigated. The complete inference link is the risk transmission path identified by the main agent from the inference results of each sub-agent in step S5. For example, "Customer A logged in through device X on July 1st, transferred money to customer B on July 3rd, and customer B logged in again through device Y on July 5th" is a complete inference link. The nodes in the key subgraph data can include the object to be investigated and its directly or indirectly related neighboring entities, and the relationship records in the key subgraph data can include the temporal edge relationships connecting the nodes.

[0094] Optionally, after determining the key subgraph data, the electronic device converts the key subgraph data into a natural language description. This natural language description is the translation of the graph structure data into a textual expression easily understood by a large language model. This natural language description is used as input to the large language model in subsequent step A52. The implementation method for converting the key subgraph data into a natural language description by the electronic device can be as follows: The electronic device first traverses each node and relation record in the key subgraph data, and statistically analyzes the graph structure statistics in the key subgraph data. These statistics include the total number of nodes, the total number of edges, the degree of each node, the clustering coefficient, and the number of connected components in the key subgraph data. Then, based on the graph structure statistics, the electronic device describes the overall topological shape of the key subgraph data as a textual graph structure feature description, such as "star structure," "chain structure," or "ring structure." The electronic device then concatenates the attribute information of each node, the type of each relation, and the timestamp, according to the connection order in the key subgraph data, into a textual description of the complete structure of the key subgraph data. This textual description is the natural language description. For example, the natural language description could be: "Customer A (node) and device X (node) had a login relationship (edge) at 10:30 on January 1, 2011; Customer A (node) and customer B (node) had a transfer relationship (edge) at 14:20 on January 3, 2011, with a transfer amount of 500,000 yuan; Customer B (node) and device Y (node) had a login relationship (edge) at 09:15 on January 5, 2011. This subgraph contains 3 nodes and 3 edges, forming a chain structure." Understandably, step A51 converts the graph structure data into a natural language description, solving the problem that large language models are not good at directly understanding graph structures. This natural language description generated in step A51 will be used in step A52 as input to the large language model.

[0095] Step A52: Input the natural language description into the large language model to generate candidate risk features; It should be noted that after generating the natural language description in step A51, the electronic device sends the natural language description as input to the large language model. This large language model is a large artificial neural network model with natural language understanding and text generation capabilities. Optionally, this large language model can be the same model used by the main agent on the electronic device, or it can be a separately deployed large language model dedicated to risk feature generation.

[0096] Optionally, when the electronic device inputs data into the large language model, it also simultaneously inputs a preset prompt word template. This preset prompt word template constrains the output format and generation direction of the large language model. The preset prompt word template may include role definition information, few-shot thought chain demonstration information, standardized output format requirements, and generation strategy constraint information. The role definition information instructs the large language model to generate risk features in the role of an anti-fraud domain expert. The few-shot thought chain demonstration information provides the large language model with several labeled risk feature generation examples to guide it in generating new risk features along similar reasoning paths. The standardized output format requirements constrain the output of the large language model to include feature names, derivation logic, risk identification purpose, and corresponding graph query statements. The generation strategy constraint information instructs the large language model to generate only risk features related to the input natural language description and not to generate content unrelated to the input.

[0097] Optionally, after the electronic device inputs the natural language description and the preset prompt word template into the large language model, the large language model performs semantic understanding of the natural language description based on the guidance of the preset prompt word template, identifies the risk patterns that may be implicit in the natural language description, and generates candidate risk features that conform to the standardized output format requirements based on the risk patterns. The candidate risk feature is a judgment rule used to describe the identification of specific risk patterns. The candidate risk feature may include a feature name, specific judgment conditions, risk identification purpose, and corresponding graph query statement. Optionally, the feature name is a short identifier for the candidate risk feature, such as "chain transfer anomaly feature"; the specific judgment conditions for the candidate risk feature are, for example, "in a chain structure, if the transfer amount between two login relationships is greater than 300,000 yuan, it is marked as abnormal"; the risk identification purpose is a description of what type of risk the candidate risk feature is used to identify, such as "used to identify the risk of gang fraud in cross-device chain transfers"; the graph query statement is the graph query code corresponding to the candidate risk feature, such as a Cypher query statement used to extract subgraph structures that conform to the derivation logic from the graph. After generating the candidate risk feature, the large language model returns the candidate risk feature to the electronic device.

[0098] Optionally, the electronic device can generate one or more candidate risk features by invoking the large language model. When multiple candidate risk features are generated, each candidate risk feature is independent of the others and corresponds to a different risk pattern.

[0099] Understandably, step A52 utilizes the semantic understanding capabilities of the large language model to extract potential risk assessment rules from the natural language description in step A51. Compared to manually writing risk rules, automatically generating candidate risk features through the large language model significantly improves the efficiency of risk feature extraction. The candidate risk feature generated in step A52 will be used in step A53 to perform a quality score on the candidate risk feature.

[0100] Step A53: Obtain the graph structure features of the key subgraph data; based on the degree of matching between the graph structure features and the candidate risk features, score the quality of the candidate risk features to obtain the quality score of each candidate risk feature. It should be noted that after generating the candidate risk feature in step A52, the electronic device obtains the graph structure features of the key subgraph data determined in step A51. These graph structure features are quantitative indicators describing the structural attributes of the key subgraph data from a graph topology perspective. The graph structure features may include the subgraph size, subgraph density, connectivity, and node type diversity of the key subgraph data. Optionally, the subgraph size is the total number of nodes in the key subgraph data; the subgraph density is the ratio of the actual number of edges in the key subgraph data to the maximum possible number of edges; the connectivity is a measure of whether there is a path connecting any two nodes in the key subgraph data; and the node type diversity is the number of different node categories included in the key subgraph data, such as the distribution of customer nodes, device nodes, and mobile phone number nodes. The electronic device calculates the graph structure features of the above dimensions by performing graph statistical analysis on the key subgraph data.

[0101] Optionally, after acquiring the graph structure feature, the electronic device scores the candidate risk feature based on the degree of matching between the graph structure feature and the candidate risk feature. This degree of matching measures the consistency between the risk pattern described by the candidate risk feature and the actual topological structure of the key subgraph data. The electronic device can score the candidate risk feature as follows: it extracts graph structure type description information applicable to the candidate risk feature, such as whether the candidate risk feature contains graph structure type keywords like "star structure," "chain structure," or "ring structure." The electronic device compares the extracted graph structure type description information with the subgraph size, subgraph density, connectivity, and node type diversity in the graph structure feature to determine whether the graph structure type described by the candidate risk feature matches the actual graph structure feature of the key subgraph data. If the degree of matching is high, the candidate risk feature matches the key subgraph data well, and the candidate risk feature has high credibility. If the degree of matching is low, the candidate risk feature matches the key subgraph data poorly, and the candidate risk feature has low credibility.

[0102] Optionally, the determination of the degree of matching can be achieved by the electronic device by calculating the cosine similarity between the graph structure type description information in the candidate risk feature and the graph structure feature, or by the electronic device by looking up a table in a preset rule matching table.

[0103] Optionally, the electronic device assigns a quality score to the candidate risk feature based on the degree of matching. This quality score is a quantitative value reflecting the reliability of the candidate risk feature. Optionally, the quality score can use a traditional Information Value (IV) score as the base score, and then apply a correction factor to the base score based on the degree of matching. The higher the degree of matching, the higher the corrected quality score; the lower the degree of matching, the lower the corrected quality score. However, the binning strategies in traditional IV scoring (such as equal-frequency or equal-width binning) are suitable for linear distribution scenarios of continuous variables, but graph structure features usually exhibit nonlinearity, sparsity, and local clustering. Fixed binning lacks the ability to perceive the graph topology, which can easily lead to the dilution or misjudgment of anomalous signals. To address this, this solution proposes an improved scoring method—the S-IV scoring model based on graph structure features, which introduces a confidence penalty or reward mechanism to dynamically correct the confidence of important graph structure features. Specifically, key subgraph data associated with candidate risk features are extracted, and four graph structure indicators of the subgraph are calculated using a structural encoding function: subgraph size s1 (total number of nodes), subgraph density s2 (ratio of actual edges to maximum possible edges), connectivity s3 (percentage of the largest connected component), and node type diversity s4 (number of entity categories covered, such as users, devices, bank cards, IPs, etc.). These indicators together constitute the structural feature vector of the subgraph, used to quantify the credibility of the subgraph at the topological level. Combining these four indicators, the formula for calculating structural credibility can be expressed as: Structural credibility = f(s1, s2, s3, s4), where f is a weighted nonlinear combination function (e.g., using a weighted product or a weighted sum with a penalty term), and the specific weights can be dynamically adjusted according to the business scenario. This credibility serves as a correction factor, affecting the contribution value of each bin in the traditional IV scoring: when the subgraph corresponding to a bin exhibits large scale (high s1), high density (high s2), strong connectivity (high s3), and rich variety (high s4), it indicates that the subgraph is highly likely to correspond to a well-organized fraud gang. In this case, the IV contribution value of the bin is positively rewarded (multiplied by a coefficient greater than 1), increasing its weight in the final score; conversely, if the subgraph exhibits low density, weak connectivity, or fragmentation, a negative penalty is applied (multiplied by a coefficient less than 1) to suppress its impact on the score and avoid noise interference. Thus, the corrected quality score retains the statistical basis of traditional IV while incorporating prior information about the graph structure, significantly improving the accuracy and robustness of risk feature screening.

[0104] Optionally, the quality score can be a percentage score, such as 0 to 100. After calculating the quality score of the candidate risk feature, the electronic device stores the quality score and the candidate risk feature in correspondence. When there are multiple candidate risk features, the electronic device calculates the quality score of each candidate risk feature separately to obtain the quality score of each candidate risk feature.

[0105] Understandably, step A53 uses the graph structure features of the key subgraph data to score the quality of the candidate risk features, avoiding the mismatch between the risk features generated by the large language model and the actual graph data. If candidate risk features are generated solely based on the large language model without quality verification, these features may not match the actual topological structure of the key subgraph data, leading to low recall or precision in practical applications of skills generated based on these features. The quality scores of each candidate risk feature obtained in step A53 will be used in step A54 as the basis for selecting target risk features.

[0106] Step A54: Select the candidate risk features whose quality scores are greater than a preset score threshold as target risk features; It should be noted that after obtaining the quality score of each candidate risk feature in step A53, the electronic device compares the quality score of each candidate risk feature with a preset score threshold. This preset score threshold is a pre-configured threshold value used by the system to screen high-quality candidate risk features. Optionally, this preset score threshold can be a fixed value configured based on historical experience, or it can be a value dynamically calculated based on the statistical distribution of the quality scores of all candidate risk features generated this time. For example, the preset score threshold can be set to 1.2 times the average or median of the quality scores of all candidate risk features generated this time.

[0107] Optionally, the electronic device uses candidate risk features with quality scores greater than the preset score threshold as target risk features. These target risk features are high-quality candidate risk features that have passed quality screening and can be encapsulated as callable experience. The electronic device marks candidate risk features with quality scores less than or equal to the preset score threshold as low-quality features and they will no longer participate in subsequent processing steps. Optionally, when there are no candidate risk features with quality scores greater than the preset score threshold, the electronic device terminates the current knowledge accumulation process and does not generate any risk detection skills.

[0108] Understandably, step A54 filters candidate risk features using a preset score threshold to ensure that only features that have passed quality verification can enter the subsequent encapsulation stage, thus preventing low-quality features from contaminating the skill library. The target risk feature obtained in step A54 will be used in step A55 as the basis for generating risk detection skills.

[0109] Step A55: Based on the target risk characteristics, generate a risk detection skill for the agent to invoke, wherein the risk detection skill includes a first risk detection skill for the main agent to invoke, or a second risk detection skill for the sub-agent to invoke.

[0110] It should be noted that after obtaining the target risk feature in step A54, the electronic device encapsulates the target risk feature to generate a risk detection skill that can be invoked by the main intelligent agent or the sub-intelligent agent. This risk detection skill is a reusable risk identification tool formed by encapsulating the risk feature in a standardized format. The risk detection skill includes three elements: the triggering condition, the judgment logic, and the handling action. The triggering condition describes the scenario in which the risk detection skill should be triggered and executed; this triggering condition can be the feature name of the target risk feature or a description of the applicable graph structure type. The judgment logic describes how the risk detection skill performs risk identification; this judgment logic is derived from the target risk feature's logic. The handling action describes what risk conclusion or suggestion the risk detection skill should output after identifying a risk; this handling action is the risk identification purpose of the target risk feature.

[0111] Optionally, when the electronic device encapsulates the target risk characteristic into a risk detection skill, it generates either a first risk detection skill or a second risk detection skill depending on the caller of the target risk characteristic. The first risk detection skill is a comprehensive skill for the main intelligent agent to invoke, which can be called during interactive dialogue based on the business personnel's detection intent. The second risk detection skill is a specialized skill for each sub-intelligent agent to invoke, which can be called according to its own detection dimension when performing detection sub-tasks.

[0112] Optionally, after generating the first risk detection skill or the second risk detection skill, the electronic device stores the first risk detection skill or the second risk detection skill in a skill library. This skill library is a database used to centrally store and manage all risk detection skills. Subsequently, when the main agent or its sub-agents perform risk detection tasks, they can retrieve and invoke matching risk detection skills from this skill library to accelerate the detection process.

[0113] Understandably, step A55 transforms the quality-verified target risk characteristics into standardized skills that can be invoked by the intelligent agent, realizing the transformation of business experience from "one-time manual investigation results" to "reusable system capabilities." After the first and second risk investigation skills are invoked by the main intelligent agent and its sub-agents, the risk identification experience discovered in this instance can be directly reused in subsequent risk investigation tasks without needing to re-execute the complete process from steps A51 to A54. As risk investigation tasks are continuously executed and knowledge accumulation steps are repeatedly triggered, the risk investigation skills in this skill set continuously accumulate, forming a human-machine collaborative evolution capability.

[0114] In one feasible implementation, a sandbox verification step is further provided after the risk detection skill is generated, which is used to perform performance evaluation and quality verification of the risk detection skill generated in step A55 in an offline environment, so as to ensure that the verified risk detection skill can be deployed to the real production environment.

[0115] After step A55, which generates the risk detection skill for the agent to invoke, the following steps are included: Step A56: Obtain simulated map data labeled with known risk tags; It should be noted that after generating the risk detection skill in step A55, the electronic device retrieves simulated graph data from the test data pool. This simulated graph data is a test graph dataset used to simulate real business scenarios in a sandbox environment. This simulated graph data has the same graph structure format as the graph data in the real production environment, containing nodes, relationships, and timestamp information corresponding to each relationship. The simulated graph data is labeled with known risk tags. These known risk tags are risk markers pre-labeled on each node or subgraph in the simulated graph data, used to indicate which nodes or subgraphs in the simulated graph data correspond to real fraud risks and which nodes or subgraphs represent normal behavior.

[0116] Optionally, the known risk label can be manually annotated based on historically confirmed fraud cases, or it can be automatically extracted from historical risk investigation conclusions. The simulated map data can include normal samples and risk samples, where the known risk label is marked on the risk samples and the normal samples are marked as risk-free.

[0117] Step A57: In a simulated environment, risk detection is performed on the simulated map data based on the risk detection skill to obtain a first detection result; It should be noted that this simulation environment is an independent test environment isolated from the real production environment. While it is configured with the same graph database and agent call chain as the real production environment, data traffic in this simulation environment will not affect the normal operation of the real production environment. This simulation environment is used to fully validate risk detection skills under offline conditions.

[0118] Optionally, after acquiring the simulated graph data, the electronic device inputs the simulated graph data into the risk detection skill, which then performs risk detection on the simulated graph data. This simulated environment is an independent test environment isolated from the real production environment. The simulated environment is configured with the same graph database and agent call chain as the real production environment, but the data traffic in the simulated environment does not affect the normal operation of the real production environment. This simulated environment is used to fully verify the risk detection skill under offline conditions. The implementation method of the risk detection skill performing risk detection on the simulated graph data is as follows: the judgment logic in the risk detection skill is applied to each node and relationship in the simulated graph data; the graph query statement in the judgment logic is executed on the simulated graph data to filter out subgraph structures that meet the triggering conditions and the judgment logic, and outputs corresponding risk markers according to the handling action. The electronic device records all risk markers output by the risk detection skill on the simulated graph data as the first detection result. This first detection result is the preliminary output result obtained after testing the risk detection skill in a sandbox environment. The results of this initial investigation will be used in step A58 to compare with the known risk label.

[0119] Step A58: Compare the first detection result with the known risk label to obtain the performance evaluation result of the risk detection skill; It should be noted that after obtaining the first detection result, the known risk label is read from the simulated atlas data, and the first detection result is compared with the known risk label. The implementation method for comparing the first detection result with the known risk label is as follows: the electronic device compares each location marked as risk by the risk detection skill in the first detection result with each location marked as risk in the known risk label, and calculates the degree of consistency between the first detection result and the known risk label. This degree of consistency may include the number of risk samples correctly identified by the risk detection skill, the number of normal samples mislabeled as risk by the risk detection skill, and the number of risk samples missed by the risk detection skill. The electronic device calculates the recall and precision of the risk detection skill based on the degree of consistency. The recall is the ratio of the number of risk samples correctly identified by the risk detection skill to the total number of all risk samples labeled with the known risk label in the simulated atlas data. The recall is used to measure the risk detection skill's coverage of risk samples. The precision rate is the ratio of the number of risk samples correctly identified by the risk detection skill to the total number of all samples marked as risk by the risk detection skill. The precision rate is used to measure the accuracy of the risk detection skill's identification results.

[0120] Optionally, after calculating the recall and precision, the electronic device generates a performance evaluation result for the risk detection skill based on the recall and precision. This performance evaluation result is a comprehensive assessment conclusion describing the detection capability of the risk detection skill in a sandbox environment. Optionally, the performance evaluation result may include the specific values ​​of the recall and precision, as well as a comprehensive score. Optionally, the comprehensive score may be the harmonic mean of the recall and precision. This performance evaluation result will be used as the basis for determining whether the risk detection skill passes the performance verification stage.

[0121] Understandably, steps A56 to A58 compare the output of the risk detection skill on the simulated graph data with known risk labels, and use recall and precision as quantitative indicators to evaluate the detection capability of the risk detection skill.

[0122] Step A59: Deploy the risk detection skills that have passed the performance evaluation to a real environment.

[0123] It should be noted that after obtaining the performance evaluation result of the risk detection skill, the electronic device determines whether the risk detection skill meets the preset deployment conditions. These preset deployment conditions are the minimum performance thresholds required for the risk detection skill to be allowed deployment in a real environment. These preset deployment conditions may include a recall rate greater than a first preset threshold and a precision rate greater than a second preset threshold. Optionally, the first and second preset thresholds can be configured according to actual business needs, for example, a recall rate greater than 80% and a precision rate greater than 85%. When the risk detection skill meets the preset performance conditions, the electronic device marks the risk detection skill as having passed performance verification and deploys it to the real environment, where it can be invoked by the main agent or its sub-agents in the production environment to perform risk detection on real business data. When the risk detection skill does not meet the preset performance conditions, the performance evaluation result of the risk detection skill is provided to business experts for review. Business experts can adjust and optimize the triggering conditions or judgment logic of the risk detection skill based on the performance evaluation result, and then re-execute steps A56 to A59 for sandbox performance verification of the optimized risk detection skill.

[0124] Understandably, steps A56 to A59, through a simulation verification mechanism in the sandbox environment, ensure that risk detection skills that have undergone quality verification can be deployed to the real production environment. In financial risk control scenarios, false positives can lead to a surge in workload for business personnel, while missed positives can directly cause financial losses. Therefore, newly generated risk detection skills need to undergo thorough offline verification before going live. This sandbox verification step evaluates risk detection skills using quantitative indicators such as recall and precision, providing business experts with clear decision-making support and achieving a complete closed loop from skill generation to skill verification to skill deployment.

[0125] In one feasible implementation, a stability verification step is further provided after the risk detection skill is generated. This step is used to evaluate the robustness of the risk detection skill that has passed performance verification when faced with variations in the graph structure. This ensures that the risk detection skill can maintain stable output under different graph structure morphologies and avoids the risk detection skill being effective only on specific graph structures and failing on mutated structures.

[0126] After step A56, which involves obtaining simulated map data labeled with known risk tags, the method further includes: Step B57: Perform graph structure mutation processing on the simulated graph data to obtain mutated graph data; It should be noted that after acquiring the simulated graph data, the electronic device performs graph structure mutation processing on the simulated graph data. This graph structure mutation processing involves artificially perturbing the graph topology in the simulated graph data to generate a mutated version. The mutated graph data is a perturbed test dataset generated by performing graph structure mutation processing on the simulated graph data. This mutated graph data is used to test whether the risk detection skill can maintain stable output results when faced with data whose distribution is inconsistent with the original graph structure. The implementation methods of graph structure mutation processing on the simulated graph data by the electronic device include at least one of the following: adding noisy nodes, i.e., randomly adding isolated nodes that have no actual connection with the original nodes to the simulated graph data; deleting some edge relationships, i.e., randomly removing a certain proportion of edge relationships from the simulated graph data; adjusting the timestamps of relationships, i.e., shifting the timestamps of some edge relationships in the simulated graph data forward or backward by a preset time; and merging adjacent nodes, i.e., merging adjacent nodes with the same type and similar attributes in the simulated graph data into a single supernode.

[0127] Optionally, the graph structure mutation processing can employ any one or more combinations of the methods described above. When performing graph structure mutation processing, the electronic device records the specific details of each mutation operation, such as the identifier of the deleted edge relationship, the original value of the adjusted timestamp, and the adjusted value.

[0128] Step B58: In a simulated environment, risk detection is performed on the mutation map data based on the risk detection skill to obtain a second detection result; It should be noted that after obtaining the variant graph data, the electronic device inputs the variant graph data into the risk detection skill in a simulation environment, and the risk detection skill performs risk detection on the variant graph data. The implementation method of the risk detection skill performing risk detection on the variant graph data can be as follows: the judgment logic in the risk detection skill is applied to each node and relationship in the variant graph data; the graph query statement in the judgment logic is executed on the variant graph data to filter out subgraph structures that meet the triggering conditions and the judgment logic, and outputs corresponding risk markers according to the handling action. The electronic device records all risk markers output by the risk detection skill on the variant graph data as the second detection result. This second detection result is the output result obtained after stability testing of the risk detection skill in a sandbox environment. When there are multiple graph structure mutation handling methods or multiple variant graph data with different mutation degrees, the electronic device performs the above-mentioned risk detection on each variant graph data separately to obtain the corresponding second detection result.

[0129] Step B59: Compare the second exploration result with the first exploration result to obtain the stability evaluation result of the risk exploration skill; It should be noted that after obtaining the second exploration result, the second exploration result is compared with the known risk label. The first exploration result is the exploration result output by the risk exploration skill on the original simulated graph data without graph structure mutation processing, and the second exploration result is the exploration result output by the risk exploration skill on the mutated graph data after graph structure mutation processing. The implementation method for comparing the second exploration result with the first exploration result is as follows: the electronic device compares each location marked as risk by the risk exploration skill in the second exploration result with each location marked as risk by the risk exploration skill in the first exploration result, and calculates the degree of difference between the second exploration result and the first exploration result. This degree of difference may include the number of locations newly marked as risk by the risk exploration skill on the mutated graph data, the number of risk locations omitted by the risk exploration skill on the mutated graph data, and the number of risk locations marked by the risk exploration skill on the mutated graph data that are completely consistent with the first exploration result.

[0130] Optionally, the electronic device generates a stability evaluation result for the risk detection skill based on the degree of difference. This stability evaluation result is an assessment conclusion describing the stability of the output of the risk detection skill in the face of variations in map structure. The smaller the difference between the second detection result and the first detection result, the higher the stability of the risk detection skill; that is, the risk detection skill can maintain an output consistent with the original input when facing variations in map structure, and its robustness is stronger. Conversely, the larger the difference between the second detection result and the first detection result, the lower the stability of the risk detection skill; that is, the output of the risk detection skill is highly sensitive to variations in map structure, and the robustness of the risk detection skill is insufficient. Optionally, the stability evaluation result may include a specific numerical value for the degree of difference, such as the number or proportion of inconsistent risk markers.

[0131] Understandably, the reason for directly comparing the second detection result with the first detection result, rather than with known risk labels, is that the stability evaluation focuses on the consistency of the risk detection skill's output, not its accuracy. The accuracy issue has already been assessed in the performance verification phase by comparing the first detection result with known risk labels; therefore, the stability verification phase only needs to focus on whether the risk detection skill's output remains consistent before and after the map structure variation. If the second detection result is directly compared with known risk labels, the comparison result is influenced by the risk detection skill's own detection capability and cannot independently reflect the robustness of the risk detection skill.

[0132] Step B60: Deploy the risk detection skill, for which both the stability evaluation result and the performance evaluation result are passed, into a real environment.

[0133] It should be noted that after obtaining the stability evaluation result of the risk detection skill, the electronic device determines whether the risk detection skill meets a preset stability condition. This preset stability condition is the minimum stability threshold required for the risk detection skill to be allowed to be deployed in a real environment. The preset stability condition may include the difference between the second detection result and the first detection result being less than a preset difference threshold. Optionally, this preset difference threshold can be configured by business experts according to actual business needs; for example, the proportion of risk tags with inconsistencies between the second and first detection results to the total number of risk tags is less than 10%.

[0134] When the risk detection skill meets the preset stability conditions and its performance evaluation result is passed, the electronic device deploys the risk detection skill to a real-world environment. This real-world environment is a production environment running real business data and real traffic. After deployment, the risk detection skill can be invoked by the main agent or its sub-agents in the production environment to perform risk detection on real business data. It is worth noting that when the risk detection skill is deployed to the real-world environment, it has simultaneously met both the preset performance conditions (passed performance verification) and the preset stability conditions (passed stability verification), meaning that the risk detection skill possesses both sufficient detection capability and sufficient robustness.

[0135] When the risk detection skill does not meet the preset stability conditions, the electronic device will not deploy the risk detection skill to the real environment. The electronic device can record the stability evaluation results of the risk detection skill for review by business experts. Business experts can adjust and optimize the triggering conditions or judgment logic of the risk detection skill based on the stability evaluation results, re-execute steps A56 to A59 for performance verification of the optimized risk detection skill, and re-execute steps B57 to B60 for stability verification after passing the performance verification.

[0136] Understandably, using mutated graph data to specifically verify the stability of risk detection skills that have passed performance validation ensures that these skills maintain stable output even when the graph structure is disturbed. In financial risk control scenarios, fraudsters constantly change their methods, causing the distribution and structure of graph data to evolve continuously. If a risk detection skill is only effective on a specific graph structure and fails on mutated structures, it will be quickly evaded by fraudsters after deployment. By introducing graph structure mutation processing to generate mutated graph data, and comparing the output of the risk detection skill with the output on the original simulated graph data based on this mutated graph data, risk detection skills with output differences within an acceptable range can be deployed to the real environment. This avoids the problem of risk detection skills performing poorly in real-world environments due to overfitting to specific graph structures. The stability verification step complements the performance verification step, comprehensively evaluating the risk detection skill from two dimensions: detection capability (compared with known risk labels) and output stability (compared with the original output results). Together, they constitute a complete solution for the risk detection skill from generation to performance verification, stability verification, and finally deployment.

[0137] In one feasible implementation, a post-implementation elimination mechanism for risk detection skills is further provided. This mechanism continuously monitors and periodically evaluates risk detection skills deployed in the real environment, removing low-value risk detection skills that have not been effectively utilized for a long time or have low output value from the real environment. This prevents the accumulation of a large number of invalid skills in the skill library, which would consume system resources and query links. Following the deployment to the real environment step, the mechanism also includes: After the risk detection skill is applied to a real environment, the operational indicator data of the risk detection skill is collected, wherein the operational indicator data includes at least the number of hits or the frequency of invocation; Risk detection skills whose operational metrics fall below a preset elimination threshold are removed from the real-world environment.

[0138] It should be noted that after the risk detection skill is deployed to the real-world environment and begins to be applied to risk detection of real business data, the electronic device continuously monitors the operation of the risk detection skill in that environment and collects operational indicator data. This operational indicator data is a numerical metric used to quantitatively describe the actual operating status and output of the risk detection skill in the real-world environment. This operational indicator data includes at least the number of hits and the frequency of invocation of the risk detection skill.

[0139] Optionally, the hit count refers to the number of times the risk detection skill's judgment logic is triggered and outputs risk tags when applied in a real-world environment. In other words, it represents the number of times the risk detection skill successfully identifies subgraph structures that meet the triggering conditions and judgment logic on real business data. When the risk detection skill outputs a risk tag after performing a detection on a given set of input data, it is counted as one hit. This hit count reflects the frequency with which the risk detection skill actually functions in real-world business, i.e., its ability to discover real risks. If the hit count of the risk detection skill remains consistently low, it indicates that the risk pattern targeted by the skill is not common in the current business scenario, or that the triggering conditions for the skill are set too strictly, making it difficult to trigger.

[0140] Optionally, the call frequency refers to the total number of times the risk detection skill is called by the main agent or its sub-agents during real-world application, including calls that output risk markers and calls that do not output risk markers. This call frequency reflects the activity level of the risk detection skill in the skill library, indicating its retrieval and selection by agents. If the call frequency of the risk detection skill remains consistently low, it indicates that the risk detection skill is not preferentially chosen by the main agent or its sub-agents. This may be because the risk scenarios covered by the risk detection skill are no longer common in current business operations, or the detection direction corresponding to the risk detection skill has been replaced by other more efficient risk detection skills.

[0141] The electronic device collects the operational indicator data as follows: When the risk detection skill is invoked, the electronic device embeds log recording points in the invocation chain. Each invocation records the timestamp, caller identifier, and invocation result. The electronic device summarizes and statistically analyzes the invocation logs of the risk detection skill within a preset statistical period, such as daily or weekly, calculating the invocation frequency and hit count within that period. The electronic device stores this operational indicator data in the operational record corresponding to the risk detection skill in the skill library. This operational indicator data will be used in step A62 as a quantitative basis for determining whether the risk detection skill should be phased out.

[0142] After collecting the operational indicator data of the risk detection skill, the electronic device compares each indicator in the operational indicator data with the corresponding preset elimination threshold. The preset elimination threshold is a pre-configured threshold used by the system to determine whether a risk detection skill should be eliminated due to long-term low value. The preset elimination threshold may include a lower limit threshold for the number of hits and a lower limit threshold for the number of calls. Optionally, the lower limit threshold for the number of hits can be the lowest number of hits within each statistical period, such as less than 3 hits in the past 30 days; the lower limit threshold for the number of calls can be the lowest number of calls within each statistical period, such as less than 10 calls in the past 30 days. Optionally, the preset elimination threshold can be configured based on actual business experience, or it can be dynamically calculated based on the statistical distribution of the operational indicator data of all risk detection skills in the skill library. For example, the preset elimination threshold can be set to 20% of the median of the indicator for all risk detection skills in the skill library.

[0143] When the operational metrics of the risk detection skill fall below the preset elimination threshold—that is, when the hit count of the risk detection skill is less than the lower limit threshold for hit count, or the call frequency is less than the lower limit threshold for call frequency—the electronic device marks the risk detection skill as a low-value skill and removes it from the real environment. Removal from the real environment means deleting the risk detection skill from the available skill call list of the main agent and each sub-agent; the risk detection skill will no longer be retrieved, matched, or called by the main agent or any sub-agent. Optionally, when removing the risk detection skill from the real environment, the electronic device can either physically delete the risk detection skill from the skill library, or mark the risk detection skill as "eliminated" and archive it in the historical skill storage area, preventing it from participating in the skill retrieval and matching process in the real environment, while retaining the historical operational record of the risk detection skill for subsequent audit analysis.

[0144] When the operational indicator data of the risk detection skill is not lower than the preset elimination threshold, the electronic device retains the risk detection skill in the real environment, continues to be available for use by the main intelligent agent and its sub-intelligent agents, and continues to collect and monitor the operational indicator data for the next statistical cycle.

[0145] Understandably, by introducing an elimination mechanism based on operational metrics data, the skill library achieves continuous purification. In financial risk control scenarios, fraud patterns evolve over time, and some risk detection skills that were effective at the time of generation may gradually lose their applicability as fraud methods change. Without periodic elimination, the skill library will accumulate a large number of low-value or invalid risk detection skills, requiring redundant matching when the main agent and its sub-agents invoke skills, reducing efficiency. Simultaneously, the continued existence of low-value skills will interfere with the generation and selection of new skills. By periodically collecting operational metrics data and removing risk detection skills below a preset elimination threshold from the real environment, it ensures that the skill library always retains high-value risk detection skills validated by real business operations. This forms a complete closed loop from skill generation to performance verification, stability verification, deployment, operational monitoring, and elimination, enabling the continuous evolution of business experience from discovery, accumulation, reuse, and updating.

[0146] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the risk exploration method based on multi-agent systems in this application. Any simple variations based on this technical concept, such as the interaction and combination of various embodiments, are all within the protection scope of this application.

[0147] This application also provides a risk detection device, please refer to... Figure 4 The risk detection device includes: Data acquisition module 10 is used to acquire the map data of the object to be explored in response to a risk exploration command triggered for the object to be explored; The interactive dialogue module 20 is used to conduct interactive dialogue with the main intelligent agent on the object to be explored, obtain interactive dialogue content, and incrementally compress the interactive dialogue content to obtain a target compressed summary. The generation and invocation module 30 is used to determine the exploration task information based on the target compressed digest through the main intelligent agent, generate exploration sub-tasks carrying time indications according to the exploration task information, and distribute the exploration sub-tasks to each sub-intelligent agent; The data reasoning module 40 is used to obtain sub-graph data corresponding to the time range of the time indication from the graph data through each of the sub-intelligent agents according to the time indication of the exploration sub-task, and to reason about the sub-graph data, and return the reasoning results obtained by each to the main intelligent agent. The risk detection module 50 is used to generate a risk detection conclusion for the object to be detected by the main intelligent agent based on the reasoning results of each sub-intelligent agent.

[0148] Optionally, the risk detection device further includes: a construction and sorting module, used to determine the fragment identifier of each relationship record based on the sequential identifier of the time window to which the relationship record belongs and the node identifier of the connected nodes, and to store the relationship record to the corresponding storage fragment according to the fragment identifier, wherein the relationship record is used to characterize the association relationship between two nodes in the graph data, and the node is the object to be detected; Among them, all relationship records belonging to the same time window are allocated to a preset number of storage shards corresponding to the time window, and the relationship records stored in the same storage shard and belonging to the same time window are arranged in chronological order.

[0149] Optionally, the interactive dialogue module is used to compress the current compressed summary of the current round of dialogue by the main intelligent agent during the interactive dialogue process, based on the compressed summary of the previous round of dialogue and the dialogue content of the current round.

[0150] Optionally, the interactive dialogue module is used to perform semantic compression on the dialogue content of the current round to obtain an initial compressed summary; Calculate the semantic dependency between the compressed summary of the previous round of dialogue and the initial compressed summary to obtain the cross-round semantic dependency weight; Based on the cross-round semantic dependency weights, the compressed summary of the previous round of dialogue is fused with the initial compressed summary to obtain the compressed summary of the current round.

[0151] Optionally, the generation and invocation module is used to generate exploration sub-tasks according to the exploration direction and to label the exploration sub-tasks with time tags according to the time range; The exploration subtasks labeled with the time tags are distributed to each sub-agent as exploration subtasks carrying time indications.

[0152] Optionally, the risk detection device further includes: a skill generation module, used to determine the key subgraph data on which the risk detection conclusion is based, and to convert the key subgraph data into a natural language description; The natural language description is input into a large language model to generate candidate risk features; Obtain the spectral structure features of the key subgraph data, and score the candidate risk features based on the degree of matching between the spectral structure features and the candidate risk features to obtain the quality score of each candidate risk feature; Candidate risk features whose quality scores are greater than a preset score threshold are used as target risk features; Based on the target risk characteristics, a risk detection skill is generated for the agent to invoke, wherein the risk detection skill includes a first risk detection skill for the main agent to invoke, or a second risk detection skill for the sub-agent to invoke.

[0153] Optionally, the risk detection device also includes: a skills verification module for acquiring simulated map data labeled with known risk tags; In a simulated environment, risk detection is performed on the simulated map data based on the risk detection skill to obtain a first detection result; The first detection result is compared with the known risk label to obtain the performance evaluation result of the risk detection skill; The risk detection skills that pass the performance evaluation are deployed in a real environment.

[0154] Optionally, the skill verification module is used to perform graph structure mutation processing on the simulated graph data to obtain mutated graph data; In a simulated environment, risk detection is performed on the mutation map data based on the risk detection skill to obtain a second detection result; The second exploration result is compared with the first exploration result to obtain the stability evaluation result of the risk exploration skill; The risk detection skill, for which both stability and performance evaluation results are passed, is deployed to a real-world environment.

[0155] The risk detection device provided in this application employs the multi-agent-based risk detection method described in the above embodiments, which can solve the technical problems of insufficient accuracy and timeliness in existing risk detection methods. Compared with the prior art, the beneficial effects of the risk detection device provided in this application are the same as those of the multi-agent-based risk detection method provided in the above embodiments, and other technical features in the risk detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0156] This application provides an electronic device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the multi-agent-based risk detection method in the first embodiment described above.

[0157] The following is for reference. Figure 5 It shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of this application. Figure 5 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0158] like Figure 5 As shown, the electronic device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the electronic device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. The communication device 1009 allows the electronic device to communicate wirelessly or wiredly with other devices to exchange data. Although the diagrams show electronic devices with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems may be implemented alternatively.

[0159] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0160] The electronic device provided in this application employs the multi-agent-based risk detection method described in the above embodiments, which can solve the technical problems of insufficient accuracy and timeliness in existing risk detection methods. Compared with the prior art, the beneficial effects of the electronic device provided in this application are the same as those of the multi-agent-based risk detection method provided in the above embodiments, and other technical features of this electronic device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0161] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0162] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0163] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the multi-agent-based risk detection method in the above embodiments.

[0164] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0165] The aforementioned computer-readable storage medium may be included in an electronic device or may exist independently without being assembled into an electronic device.

[0166] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0167] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0168] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0169] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described multi-agent-based risk detection method, thereby solving the technical problems of insufficient accuracy and timeliness in existing risk detection methods. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the multi-agent-based risk detection method provided in the above embodiments, and will not be repeated here.

[0170] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the multi-agent-based risk detection method described above.

[0171] The computer program product provided in this application can solve the technical problems of insufficient accuracy and timeliness in existing risk detection methods. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the multi-agent-based risk detection method provided in the above embodiments, and will not be repeated here.

[0172] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A risk detection method based on multi-agent systems, characterized in that, The multi-agent-based risk detection method includes: In response to a risk investigation command triggered for an object to be investigated, the map data of the object to be investigated is obtained; By engaging in interactive dialogue with the main intelligent agent regarding the object to be explored, the content of the interactive dialogue is obtained, and the interactive dialogue content is incrementally compressed to obtain a target compressed summary. The main agent determines exploration task information based on the target compressed digest, generates exploration sub-tasks carrying time indications according to the exploration task information, and distributes the exploration sub-tasks to each sub-agent. Each of the sub-agents obtains sub-graph data corresponding to the time range of the time indication from the graph data according to the time indication of the exploration sub-task, performs reasoning on the sub-graph data, and returns the reasoning results obtained by each to the main agent; The main agent generates a risk assessment conclusion for the object to be investigated based on the reasoning results of each sub-agent.

2. The method as described in claim 1, characterized in that, Before the step of acquiring the map data of the object to be investigated, the following steps are included: For each relationship record, the fragment identifier of the relationship record is determined according to the sequence identifier of the time window to which the relationship record belongs and the node identifier of the connected node. The relationship record is then stored in the corresponding storage fragment according to the fragment identifier. The relationship record is used to characterize the association between two nodes in the graph data, and the node is the object to be explored. Among them, all relationship records belonging to the same time window are allocated to a preset number of storage shards corresponding to the time window, and the relationship records stored in the same storage shard and belonging to the same time window are arranged in chronological order.

3. The method as described in claim 1, characterized in that, The step of incrementally compressing the interactive dialogue content to obtain a target compressed summary includes: During the interactive dialogue, the main intelligent agent compresses the current round's compressed summary based on the compressed summary of the previous round's dialogue and the current round's dialogue content to obtain the current compressed summary of the current round.

4. The method as described in claim 3, characterized in that, The step of compressing the current round's compressed summary based on the compressed summary of the previous round's dialogue and the current round's dialogue content by the main intelligent agent to obtain the current compressed summary of the current round includes: Get a compressed summary of the previous round of conversation and the content of the current round of conversation; Semantic compression is performed on the dialogue content of the current round to obtain an initial compressed summary; Calculate the semantic dependency between the compressed summary of the previous round of dialogue and the initial compressed summary to obtain the cross-round semantic dependency weight; Based on the cross-round semantic dependency weights, the compressed summary of the previous round of dialogue is fused with the initial compressed summary to obtain the compressed summary of the current round.

5. The method as described in claim 1, characterized in that, The exploration task information includes the exploration direction for the object to be explored and the time range corresponding to the exploration direction; the step of generating exploration sub-tasks carrying time indications based on the exploration task information and distributing the exploration sub-tasks to each sub-agent includes: An exploration subtask is generated based on the exploration direction, and a time tag is added to the exploration subtask according to the time range; The exploration subtasks labeled with the time tags are distributed to each sub-agent as exploration subtasks carrying time indications.

6. The method as described in claim 1, characterized in that, After the step of generating the risk investigation conclusion of the object to be investigated, the following is included: Identify the key subgraph data on which the risk investigation conclusion is based, and convert the key subgraph data into a natural language description; The natural language description is input into a large language model to generate candidate risk features; Obtain the graph structure features of the key subgraph data, and score the candidate risk features based on the degree of matching between the graph structure features and the candidate risk features to obtain the quality score of each candidate risk feature; Candidate risk features whose quality scores are greater than a preset score threshold are used as target risk features; Based on the target risk characteristics, a risk detection skill is generated for the agent to invoke, wherein the risk detection skill includes a first risk detection skill for the main agent to invoke, or a second risk detection skill for the sub-agent to invoke.

7. The method as described in claim 6, characterized in that, Following the step of generating the risk detection skill for agent invocation, the following is included: Obtain simulated map data labeled with known risk tags; In a simulated environment, risk detection is performed on the simulated map data based on the risk detection skill to obtain a first detection result; The first detection result is compared with the known risk label to obtain the performance evaluation result of the risk detection skill; The risk detection skills that pass the performance evaluation are deployed in a real environment.

8. The method as described in claim 7, characterized in that, Following the step of acquiring simulated atlas data labeled with known risk tags, the method further includes: The simulated spectral data is subjected to graph structure mutation processing to obtain mutated spectral data; In a simulated environment, risk detection is performed on the mutation map data based on the risk detection skill to obtain a second detection result; The second exploration result is compared with the first exploration result to obtain the stability evaluation result of the risk exploration skill; The risk detection skill, for which both stability and performance evaluation results are passed, is deployed to a real-world environment.

9. A risk detection device, characterized in that, The risk detection device includes: The data acquisition module is used to acquire the map data of the object to be explored in response to a risk exploration command triggered for the object to be explored; The interactive dialogue module is used to conduct interactive dialogue with the main intelligent agent on the object to be explored, obtain the interactive dialogue content, and incrementally compress the interactive dialogue content to obtain the target compressed summary. The generation and invocation module is used to determine exploration task information based on the target compressed digest through the main intelligent agent, generate exploration sub-tasks carrying time indications according to the exploration task information, and distribute the exploration sub-tasks to each sub-intelligent agent; The data reasoning module is used to obtain sub-graph data corresponding to the time range of the time indication from the graph data through each of the sub-intelligent agents according to the time indication of the exploration sub-task, and to reason about the sub-graph data, and return the reasoning results obtained by each to the main intelligent agent. The risk detection module is used to generate a risk detection conclusion for the object to be detected by the main agent based on the reasoning results of each sub-agent.

10. An electronic device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the multi-agent-based risk detection method as described in any one of claims 1 to 8.

Images