An account risk dynamic grading method and system based on multi-modal behavior fusion

Abstract

The application relates to the technical field of financial information security, and discloses an account risk dynamic grading method and system based on multi-modal behavior fusion, which comprises the following steps: time sequence alignment, missing value filling and standardization are performed on multi-modal behavior data, and a multi-modal space-time coupling representation vector is generated; a business context parameter and a historical risk state vector are combined, attention interaction is performed with the multi-modal space-time coupling representation vector, and a context-aware risk fusion vector is obtained through weighted fusion; a state transition probability matrix and a state residence time length distribution parameter of a risk state observation chain hidden Markov model are used to predict a time sequence enhanced risk state vector; a modal consistency test is performed on the multi-modal space-time coupling representation vector to divide an abnormal modal subset and a normal modal subset, generate an adversarial robust weight coefficient, jointly determine an output risk grading result with the time sequence enhanced risk state vector, generate a risk attribution distribution vector, and adjust a sampling strategy, so that time sequence continuous and stable risk dynamic grading is realized.

Description

Technical Field

[0001] This invention relates to the field of financial information security technology, specifically to a method and system for dynamic classification of account risk based on multimodal behavior fusion. Background Technology

[0002] With the rapid development of digital financial services, online payments, mobile banking, and online wealth management are becoming increasingly popular. As a result, the threats to account security are becoming more complex and covert. The accuracy and stability of account risk identification directly impact fund security and user experience. Existing risk control systems typically collect account behavior data at preset intervals, extract features, and fuse them to output risk scores or risk levels, triggering corresponding intervention measures. However, account risk status is not an isolated event but a continuous evolutionary process over time. Normal and abnormal accounts exhibit different patterns in state transition paths and state dwell time. Existing judgments are mostly completed independently within a single period based on the data collected at that time. Independent judgments at each interval are insufficient to constrain the results of adjacent periods, and even occasional fluctuations in account behavior can cause a jump in risk level. Simultaneously, black market operators, using group control devices and automated scripts, can reproduce surface-level behavioral characteristics such as operation trajectories and keystroke rhythms, making the statistical distribution of individual modalities converge with that of real users. The inherent consistency between different modalities of real users is broken by forged data, making the fusion results based on the current observation easily skewed. Summary of the Invention

[0003] In view of the above problems, the present invention provides a method and system for dynamic risk classification of accounts based on multimodal behavior fusion. By characterizing the transfer and residence rules of risk status and verifying the consistency between modalities, it achieves temporally continuous and anti-counterfeiting risk classification.

[0004] To achieve the above objectives, in a first aspect, this application provides a method for dynamic account risk classification based on multimodal behavior fusion, comprising:

[0005] The system acquires operational behavior data, device environment data, transaction behavior data, and biological behavior data of the target account. It performs time-series alignment, missing value imputation, and standardization on the multimodal behavior data to obtain a multimodal behavior preprocessing sequence.

[0006] Single-modal feature extraction is performed on the multimodal behavior preprocessing sequence, and a temporal dependency code and a cross-modal spatial correlation code based on a gated loop structure are constructed. The joint mapping generates a multimodal spatiotemporal coupled representation vector.

[0007] Obtain business context parameters, combine them with historical risk state vectors to generate context risk situation codes, enable context risk situation codes to interact with multimodal spatiotemporal coupled representation vector attention, generate dynamic fusion weight coefficients corresponding to each modality, and generate context-aware risk fusion vectors through weighted fusion.

[0008] Obtain the risk classification result sequence of the target account within the historical time window, construct the risk status observation chain, calculate the state transition probability matrix and state residence duration distribution parameters based on the hidden Markov model, and combine the context-aware risk fusion vector prediction to obtain the time-series enhanced risk status vector.

[0009] The cosine similarity and relative entropy distance of each modal subvector in the multimodal spatiotemporal coupling representation vector are calculated. The modality consistency test is performed to obtain the modality consistency score matrix. Abnormal modality subsets and normal modality subsets are divided. The dynamic fusion weight coefficients of abnormal modality subsets and normal modality subsets are attenuated and enhanced respectively to generate adversarial robust weight coefficients. The multimodal spatiotemporal coupling representation vector is fused according to the adversarial robust weight coefficients and jointly judged with the temporal enhanced risk state vector to output the risk classification result.

[0010] Based on the risk classification results and the adversarial robustness weight coefficient, the attribution contribution of each modality is calculated, and a risk attribution distribution vector is generated. The sampling strategy of the behavioral data collection end is then adjusted accordingly.

[0011] In some embodiments, single-modal feature extraction is performed on the multimodal behavior preprocessing sequence, and a temporal dependency code and a cross-modal spatial correlation code based on a gated loop structure are constructed. A joint mapping is then performed to generate a multimodal spatiotemporally coupled representation vector, including:

[0012] Statistical features of each modality are extracted from the multimodal behavior preprocessing sequence to obtain an initial behavior feature vector sequence;

[0013] A gated loop structure containing update gates and reset gates is constructed for the initial behavior feature vector sequence. The initial behavior feature vector of the current time step and the hidden state vector of the previous time step are linearly transformed and activated by the update gate and reset gate to obtain the update gate control signal and the reset gate control signal. The reset gate control signal is used to filter the hidden state vector of the previous time step to generate candidate hidden states. The update gate control signal is used to weight and merge the hidden state vector of the previous time step and the candidate hidden states to obtain the temporal enhancement feature vector of the current time step. The temporal enhancement feature vector sequence is generated step by step.

[0014] For any two modal temporal enhancement feature vectors, the dimensions of the first projection weight matrix and the second projection weight matrix are transformed. The outer product operation is performed on the transformation result to obtain the correlation response tensor. The correlation response tensor is aggregated through the aggregation weight vector channel to obtain the correlation response value. The modal correlation response matrix is ​​generated by traversing each modal pair. The intermodal correlation response matrix is ​​added to the modal autocorrelation diagonal matrix to obtain the cross-modal coupling feature matrix.

[0015] The temporal enhanced feature vector sequence is linearly combined with the feature fusion weight matrix to obtain the temporal feature fusion vector. The cross-modal coupled feature matrix is ​​aggregated in the row and column directions of the correlation aggregation weight matrix to obtain the spatial correlation aggregation vector. The temporal feature fusion vector and the spatial correlation aggregation vector are concatenated and subjected to dimensional compression and semantic alignment by the joint mapping weight matrix to generate the multimodal spatiotemporal coupled representation vector.

[0016] In some embodiments, business context parameters are obtained, and a context risk posture code is generated by combining it with a historical risk state vector. This context risk posture code interacts with the attention of a multimodal spatiotemporally coupled representation vector to generate dynamic fusion weight coefficients corresponding to each modality. Weighted fusion is then used to generate a context-aware risk fusion vector, including:

[0017] The business scenario type identifier in the business context parameters is transformed by the business scenario embedding matrix to obtain the business scenario embedding vector. The business attribute parameters in the business context parameters are concatenated into a business attribute numerical vector. The business attribute numerical vector is transformed by the attribute transformation weight matrix to obtain the business attribute embedding vector. The historical risk state vector, the business scenario embedding vector and the business attribute embedding vector are concatenated into a joint situation vector. The joint situation vector is transformed by the situation coding weight matrix nonlinearly to obtain the context risk situation code.

[0018] The context risk situation encoding is linearly projected onto the query weight matrix to obtain the query vector. The modal sub-vectors in the multimodal spatiotemporal coupling representation vector are linearly projected onto the key weight matrix to obtain the key vector. The dot product similarity between the query vector and each key vector is calculated and converted into the initial value of attention weight through scaling and normalization exponential function. The initial value of attention weight is multiplied by the modal basic weight coefficient to obtain the dynamic fusion weight coefficient corresponding to each modality.

[0019] Each modal subvector is multiplied element-wise with its corresponding dynamic fusion weight coefficient to obtain a weighted feature vector. Each weighted feature vector is added element-wise to obtain a weighted fusion vector. The weighted fusion vector is concatenated with the context risk situation code and subjected to nonlinear transformation and dimensional compression of the fusion coding weight matrix to generate a context-aware risk fusion vector.

[0020] In some embodiments, the risk classification result sequence of the target account within a historical time window is obtained, a risk state observation chain is constructed, the state transition probability matrix and state dwell time distribution parameters are calculated based on a hidden Markov model, and a time-enhanced risk state vector is obtained by combining context-aware risk fusion vector prediction, including:

[0021] Obtain the risk classification results of the target account in each risk assessment period within the historical time window, arrange them in time sequence to obtain the risk classification result sequence, and map each risk classification result in the risk classification result sequence to a status code to obtain the risk status observation chain.

[0022] The state transition frequency matrix is ​​obtained by counting the number of transitions between adjacent states in the statistical risk state observation chain. The state transition probability matrix is ​​obtained by dividing the transition frequency from each source state to each target state by the total number of times the source state appears.

[0023] The number of consecutive occurrences of each risk state in the statistical risk state observation chain is used to obtain the dwell time sample set. Based on the dwell time sample set, the average dwell time and the variance of the dwell time of each risk state are calculated to obtain the state dwell time distribution parameters.

[0024] The context-aware risk fusion vector is linearly transformed and activated by the observation probability weight matrix to obtain the observation probability vector. Based on the risk state probability distribution, state transition probability matrix and observation probability vector of the previous time step, forward recursion is performed to obtain the unnormalized state probability distribution.

[0025] The unnormalized state probability distribution is corrected by time constraint based on the state dwell time distribution parameters, and the time-enhanced risk state vector is obtained by normalization operation.

[0026] In some embodiments, the unnormalized state probability distribution is corrected for duration constraints based on state dwell time distribution parameters, and a time-enhanced risk state vector is obtained after normalization, including:

[0027] Obtain the continuous dwell time of each risk state before the current time. The continuous dwell time is the number of time steps that each risk state has been continuously in the corresponding risk state before the current time.

[0028] Based on the average dwell time and dwell time variance in the state dwell time distribution parameters, the upper bound of the dwell time corresponding to each risk state is determined. The upper bound of the dwell time increases as the dwell time variance increases.

[0029] Based on the average dwell time in the state dwell time distribution parameters, the lower bound of the dwell time corresponding to each risk state is determined. The lower bound of the dwell time is a preset proportion of the average dwell time.

[0030] The continuous dwell time of each risk state is compared with the corresponding upper and lower limits of dwell time. Risk states with a continuous dwell time exceeding the corresponding upper limit of dwell time are identified as over-dwelling states, and risk states with a continuous dwell time below the corresponding lower limit of dwell time are identified as under-dwelling states.

[0031] For risky states with excessive dwell time, reduce the state probability value corresponding to the risky state in the unnormalized state probability distribution.

[0032] For risk states with insufficient residency, increase the probability weight of the risk state transitioning to other risk states;

[0033] Normalize the modified unnormalized state probability distribution to obtain the time-series enhanced risk state vector.

[0034] In some embodiments, cosine similarity and relative entropy distance are calculated for each modal sub-vector in the multimodal spatiotemporal coupled representation vector. A modal consistency test is performed to obtain a modal consistency score matrix. Abnormal modal subsets and normal modal subsets are divided. The dynamic fusion weight coefficients of the abnormal and normal modal subsets are attenuated and enhanced respectively to generate adversarial robust weight coefficients. The multimodal spatiotemporal coupled representation vector is fused based on the adversarial robust weight coefficients and jointly judged with the temporal-enhanced risk state vector to output a risk classification result, including:

[0035] The modal sub-vectors corresponding to each mode are separated from the multimodal spatiotemporal coupling representation vector. The cosine similarity of the two modal sub-vectors of any modal pair is calculated. The relative entropy distance is obtained by calculating the symmetric relative entropy after the two modal sub-vectors are subjected to distribution transformation. The cosine similarity and the scaled relative entropy distance are weighted and combined to obtain the consistency measure value of the modal pair. The modal consistency score matrix is ​​generated by traversing all modal pairs.

[0036] For each mode, the arithmetic mean of its consistency metric values ​​with the other modes is calculated to obtain the average consistency score. Modes with an average consistency score below the consistency threshold are classified into the abnormal mode subset, and modes with an average consistency score not lower than the consistency threshold are classified into the normal mode subset.

[0037] The dynamic fusion weight coefficients corresponding to each mode in the abnormal mode subset are multiplied by the attenuation coefficient, and the dynamic fusion weight coefficients corresponding to each mode in the normal mode subset are multiplied by the enhancement coefficient, and then normalized to obtain the anti-robust weight coefficients.

[0038] Each modal subvector is weighted and fused with its corresponding adversarial robustness weight coefficient to obtain an adversarial robustness fusion vector. The adversarial robustness fusion vector is then concatenated with the temporal enhanced risk state vector to form a joint decision vector. This joint decision vector is then input into the risk classification decision network to output the risk classification result.

[0039] In some embodiments, cosine similarity is calculated for the two modal subvectors of any modality pair; the relative entropy distance is obtained by calculating the symmetric relative entropy after performing distribution transformation on the two modal subvectors; the cosine similarity and the scaled relative entropy distance are weighted and combined to obtain the consistency metric of the modality pair; and a modality consistency score matrix is ​​generated by traversing all modality pairs, including:

[0040] From the multimodal spatiotemporal coupling representation vector, the modal sub-vectors corresponding to each mode are separated, and each modal sub-vector corresponds to each row of the mode;

[0041] For any two modal subvectors of a modality pair, the cosine similarity of the modality pair is obtained by dividing the dot product of the two modal subvectors by the product of their modal lengths. The dot product is the sum of the product of the corresponding elements of each dimension of the two modal subvectors, and the product of their modal lengths is the product of their respective modal lengths.

[0042] The two modal subvectors are transformed into probability distributions using a distribution transformation function, resulting in two probability distributions. The distribution transformation function converts the values ​​of each dimension of each modal subvector into non-negative probability values.

[0043] Calculate the forward relative entropy and the reverse relative entropy between two probability distributions, and use the sum of the forward relative entropy and the reverse relative entropy as the relative entropy distance of the mode pair;

[0044] The cosine similarity and the relative entropy distance scaled by a preset scaling factor are summed according to a preset weight to obtain the consistency metric of the mode pair. The consistency metric reflects both the closeness of the mode pair in direction and the difference in distribution pattern.

[0045] Traverse all modality pairs and arrange the consistency metrics of each modality pair into a modality consistency score matrix.

[0046] In some embodiments, each modality sub-vector is weighted and fused with its corresponding adversarial robustness weight coefficient to obtain an adversarial robustness fused vector. This adversarial robustness fused vector is then concatenated with the temporal augmentation risk state vector to form a joint decision vector. The joint decision vector is input into a risk classification network, which outputs risk classification results, including:

[0047] Each modality subvector is multiplied element-wise with its corresponding adversarial robustness weight coefficient to obtain the weighted subvector corresponding to each modality.

[0048] The weighted sub-vectors corresponding to each modality are added element by element to obtain the adversarial robust fusion vector. The adversarial robust fusion vector is the fusion representation of each modality sub-vector after being weighted by the adversarial robust weight coefficient.

[0049] The adversarial robust fusion vector and the temporal enhanced risk state vector are concatenated in a preset dimension order to obtain a joint decision vector. The joint decision vector carries both the spatial features after adversarial robust fusion and the temporal features of the historical risk state.

[0050] The joint decision vector is input into the risk classification decision network, which contains multiple hidden layers and an output layer. Each hidden layer contains a preset number of neurons and uses a non-linear activation function.

[0051] The joint decision vector is mapped to deep discriminative features by performing nonlinear activation transformation layer by layer through multiple hidden layers.

[0052] The output layer uses a normalized exponential activation function to output the probability value corresponding to each risk state. The output layer contains a number of neurons equal to the number of risk states, and the neurons in the output layer correspond one-to-one with each risk state.

[0053] The risk state with the highest probability value among all risk states is determined as the risk classification result.

[0054] In some embodiments, the attribution contribution of each modality is calculated based on the risk classification results and the adversarial robustness weight coefficient, generating a risk attribution distribution vector, and the sampling strategy at the behavioral data collection end is adjusted accordingly, including:

[0055] For each modality, the adversarial robustness weight coefficient corresponding to the modality is multiplied by the judgment confidence corresponding to the risk classification result to obtain the risk contribution benchmark value. The modality subvector is projected onto the neuron weight vector corresponding to the risk classification result in the risk classification judgment network to obtain the projection similarity. The risk contribution benchmark value and the projection similarity are weighted and combined to obtain the attribution contribution of the modality. The attribution contribution of each modality is concatenated to form a risk attribution distribution vector, and each dimension in the risk attribution distribution vector corresponds to the attribution contribution of each modality.

[0056] The values ​​of each dimension in the risk attribution distribution vector are compared with the attribution threshold. Dimensions with values ​​higher than the attribution threshold are identified as high-risk contribution dimensions, and dimensions with values ​​lower than the attribution threshold are identified as low-risk contribution dimensions.

[0057] For modalities corresponding to high-risk contribution dimensions, the sampling frequency is increased, the sampling time window is extended, and the feature extraction granularity is refined. For modalities corresponding to low-risk contribution dimensions, the sampling frequency is reduced, the sampling time window is shortened, and the feature extraction granularity is coarsened. The updated sampling frequency, sampling time window length, and feature extraction granularity are encapsulated into a sampling strategy update instruction and sent to the behavior data collection terminal, so that subsequent risk assessment cycles will execute data collection according to the updated sampling strategy.

[0058] In a second aspect, the present invention also provides a dynamic account risk classification system based on multimodal behavior fusion, used to execute the method described in the first aspect. The system includes a behavior data acquisition module, a data preprocessing module, a spatiotemporal coupling coding module, a context-aware fusion module, a temporal state prediction module, a modal consistency verification and adversarial robustness assessment module, and a risk attribution and sampling strategy adjustment module. The behavior data acquisition module is used to collect operational behavior data, equipment environment data, transaction behavior data, and biological behavior data of the target account. The data preprocessing module is used to perform temporal alignment, missing value imputation, and standardization on the multimodal behavior data to obtain a multimodal behavior preprocessed sequence. The spatiotemporal coupling coding module is used to perform single-modal feature extraction on the multimodal behavior preprocessed sequence, construct temporal dependency coding and cross-modal spatial association coding, and jointly map to generate a multimodal spatiotemporal coupling representation vector. The context-aware fusion module is used to combine business context parameters with… The historical risk state vector generates a contextual risk situation code, which interacts with the multimodal spatiotemporal coupled representation vector through attentional interaction to generate dynamic fusion weight coefficients and weighted fusion to generate a context-aware risk fusion vector. The temporal state prediction module is used to construct a risk state observation chain, calculate the state transition probability matrix and state dwell time distribution parameters based on a hidden Markov model, and predict the temporal enhanced risk state vector by combining the context-aware risk fusion vector. The modality consistency test and adversarial robustness determination module is used to perform modality consistency tests, generate adversarial robustness weight coefficients, fuse the multimodal spatiotemporal coupled representation vector based on the adversarial robustness weight coefficients, and jointly determine the risk classification result with the temporal enhanced risk state vector. The risk attribution and sampling strategy adjustment module is used to generate a risk attribution distribution vector based on the risk classification result and the adversarial robustness weight coefficients, and adjust the sampling strategy of the behavioral data acquisition end based on the risk attribution distribution vector.

[0059] Unlike existing technologies, the above technical solution provides a method and system for dynamic account risk classification based on multimodal behavior fusion. It generates a multimodal spatiotemporal coupled representation vector by temporally aligning, imputing missing values, and standardizing multimodal behavior data. This vector is then combined with business context parameters and historical risk state vectors, and through attention interaction with the multimodal spatiotemporal coupled representation vector, a weighted fusion is performed to obtain a context-aware risk fusion vector. Based on this, a temporally enhanced risk state vector is predicted using the state transition probability matrix and state dwell time distribution parameters of a hidden Markov model of the risk state observation chain. A modality consistency test is performed on the multimodal spatiotemporal coupled representation vector to divide it into abnormal and normal modal subsets, generating adversarial robustness weight coefficients. These coefficients are then jointly used with the temporally enhanced risk state vector to determine and output the risk classification result. A risk attribution distribution vector is generated to adjust the sampling strategy, achieving a temporally continuous and stable dynamic risk classification even when account behavior evolves over time and may be forged.

[0060] The above description of the invention is merely an overview of the technical solution of this application. In order to enable those skilled in the art to better understand the technical solution of this application and to implement it based on the description and drawings, and to make the above-mentioned objectives and other objectives, features and advantages of this application easier to understand, the following description is provided in conjunction with the specific embodiments and drawings of this application. Attached Figure Description

[0061] The accompanying drawings are only used to illustrate the principles, implementation methods, applications, features, and effects of specific embodiments of the present invention and other related contents, and should not be considered as limitations on this application.

[0062] In the accompanying drawings of the instruction manual:

[0063] Figure 1 This is a schematic diagram illustrating steps S101 to S106 of the method described in the specific implementation embodiment;

[0064] Figure 2 This is a schematic diagram illustrating steps S201 to S204 of the method described in a specific implementation.

[0065] Figure 3 This is a schematic diagram illustrating steps S301 to S305 of the method described in a specific implementation.

[0066] Figure 4 This is a schematic diagram illustrating steps S401 to S404 of the method described in a specific embodiment;

[0067] Figure 5 This is a schematic diagram of the structure of the dynamic account risk classification system described in a specific implementation.

[0068] The reference numerals used in the above figures are explained as follows:

[0069] 1. Dynamic Account Risk Classification System; 11. Behavioral Data Acquisition Module; 12. Data Preprocessing Module; 13. Spatiotemporal Coupling Coding Module; 14. Context-Aware Fusion Module; 15. Temporal State Prediction Module; 16. Modal Consistency Test and Adversarial Robustness Judgment Module; 17. Risk Attribution and Sampling Strategy Adjustment Module. Detailed Implementation

[0070] To illustrate the possible application scenarios, technical principles, implementable specific solutions, and achievable objectives and effects of this application in detail, the following description, in conjunction with the listed specific embodiments and accompanying drawings, provides a detailed explanation. The embodiments described herein are merely illustrative of the technical solutions of this application and are therefore intended to limit the scope of protection of this application.

[0071] In this document, the term "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The term "embodiment" appearing in various places throughout the specification does not necessarily refer to the same embodiment, nor does it specifically limit its independence or connection with other embodiments. In principle, in this application, as long as there are no technical contradictions or conflicts, the technical features mentioned in each embodiment can be combined in any way to form corresponding implementable technical solutions.

[0072] Unless otherwise defined, the technical terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the use of related terms herein is merely for the purpose of describing particular embodiments and is not intended to limit this application.

[0073] In the description of this application, the term "and / or" is used to describe the logical relationship between objects, indicating that three relationships can exist. For example, A and / or B means: A exists, B exists, and A and B exist simultaneously. Additionally, the character " / " in this document generally indicates that the preceding and following objects have an "or" logical relationship.

[0074] In this application, terms such as “first” and “second” are used only to distinguish one entity or operation from another, and do not necessarily require or imply any actual quantity, hierarchy or order relationship between these entities or operations.

[0075] Without further limitations, the use of terms such as “comprising,” “including,” “having,” or other similar open-ended expressions in this application is intended to cover non-exclusive inclusion, which does not exclude the presence of additional elements in a process, method, or product that includes the stated elements, such that a process, method, or product that includes a list of elements may include not only those defined elements but also other elements not expressly listed, or elements inherent to such a process, method, or product.

[0076] The processor described in the embodiments of this application can be implemented by hardware, firmware, software, or a combination thereof. It can be a circuit, one or more of an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field-programmable gate array (FPGA), a central processing unit (CPU), a controller, a microcontroller, or a microprocessor. It also includes other physical, biological, or chemical structures that can implement the same or equivalent functions as the processors listed above, such as biological neurons, quantum computing units, DNA computing units, etc., so that the processor can execute some or all of the steps in the computer program or method involved in the various embodiments of this application, or any combination of the steps mentioned therein.

[0077] The computer program involved in the embodiments can be stored in a computer device readable storage medium, which includes, but is not limited to, disks, magnetic tapes, magnetic cards, floppy disks, flash memory, optical disks, optical cards, read-only memory (ROM), random access memory (RAM), erasable programmable ROM (EPROM), and electrically erasable programmable ROM (EEPROM), etc., and also includes other biological, physical, or chemical structures that can achieve the same or equivalent functions as the storage media listed above, such as DNA, RNA, proteins, and other units with information storage capabilities. In specific embodiments, the storage medium involved can be one of the above-mentioned media types, or a combination of the above-mentioned media types. In different embodiments, the computer program involved in the embodiments can be centrally stored in a single medium, or distributed and stored in multiple media. The memory containing the computer device readable storage medium can be non-volatile memory or random access memory. These computer device readable storage media can be built into the device, or can be connected to the device involved in the embodiments as an external device or part of an external device. In some embodiments, the memory having a computer device readable storage medium is deployed locally; in other embodiments, the memory may be deployed remotely from the processor, for example, as a network-attached memory accessed via RF circuitry or an external port and a communication network, wherein the communication network may be the Internet, one or more intranets, a local area network (LAN), a wide area network (WLAN), a storage area network (SAN), or a suitable combination thereof, as long as computer device access to the memory is enabled. Furthermore, the computer program involved in the embodiments may be stored in plaintext / ciphertext form, or it may be designed as training data, integrated and recombined through model training and implicitly stored in the parameter states of a deep neural network or other machine learning model.

[0078] Please see Figure 1 In a first aspect, this embodiment provides a method for dynamic account risk classification based on multimodal behavior fusion, including:

[0079] S101. Obtain the target account's operational behavior data, device environment data, transaction behavior data, and biological behavior data. Perform time-series alignment, missing value imputation, and standardization on the multimodal behavior data to obtain a multimodal behavior preprocessing sequence.

[0080] S102. Perform single-modal feature extraction on the multimodal behavior preprocessing sequence, construct a time-dependent coding and cross-modal spatial correlation coding based on a gated loop structure, and jointly map to generate a multimodal spatiotemporal coupled representation vector;

[0081] S103. Obtain business context parameters, combine them with historical risk state vectors to generate context risk situation codes, enable context risk situation codes to interact with multimodal spatiotemporal coupled representation vector attention, generate dynamic fusion weight coefficients corresponding to each modality, and generate context-aware risk fusion vectors through weighted fusion.

[0082] S104. Obtain the risk classification result sequence of the target account within the historical time window, construct the risk status observation chain, calculate the state transition probability matrix and state residence duration distribution parameters based on the hidden Markov model, and combine the context-aware risk fusion vector prediction to obtain the time-series enhanced risk status vector.

[0083] S105. Calculate the cosine similarity and relative entropy distance of each modal subvector in the multimodal spatiotemporal coupling representation vector, perform modal consistency test to obtain modal consistency score matrix, divide abnormal modal subsets and normal modal subsets, attenuate and enhance the dynamic fusion weight coefficients of abnormal modal subsets and normal modal subsets respectively, generate adversarial robust weight coefficients, fuse the multimodal spatiotemporal coupling representation vector according to the adversarial robust weight coefficients, jointly determine with the temporal enhanced risk state vector, and output the risk classification result.

[0084] S106. Calculate the attribution contribution of each modality based on the risk classification results and the adversarial robustness weight coefficient, generate the risk attribution distribution vector, and adjust the sampling strategy of the behavioral data collection end accordingly.

[0085] In step S101, the operation behavior data may include mouse movement trajectory, click timestamp, keyboard key interval, and page access order; device environment data may include device hardware fingerprint, network access method, network latency, and geographical location; transaction behavior data may include transaction amount, counterparty account identifier, and channel type; and biometric behavior data may include touch screen pressing pressure, sliding acceleration, and grip posture tilt angle. Each of the four types of data has an independent timestamp. Time alignment is based on the business request trigger time to divide continuous time slice windows, and each modality record is assigned to its corresponding window according to its timestamp, with the statistics within the window serving as representative values. Missing value imputation generates imputation values ​​for windows without records based on the representative values ​​of adjacent windows. Standardization transforms the current data based on the historical mean and standard deviation of the target account over the most recent preset duration, mapping each dimension to a unified interval.

[0086] In step S102, single-modal feature extraction performs differential statistical feature extraction on each modality to obtain an initial behavioral feature vector sequence arranged in time; time-dependent coding based on a gated loop structure selectively retains and updates the hidden state of the previous time step through a gating signal, generating a time-enhanced feature vector sequence carrying historical information step by step; cross-modal spatial association coding calculates the interaction response between any two modal time-enhanced feature vectors to form an inter-modal association response matrix characterizing the inter-modal association strength, and obtains a cross-modal coupling feature matrix by combining the autocorrelation representation of each modality; joint mapping maps the time-series evolution information and the inter-modal spatial association information in a unified manner to generate a multi-modal spatiotemporal coupling representation vector.

[0087] In step S103, the business context parameters are provided by the business system when initiating a business request. These parameters may include the business scenario type, business risk baseline level, business sensitivity, and the number of business-related accounts, used to match the judgment strategy with the current scenario. The historical risk state vector is the risk state representation of the target account output in the previous risk judgment period. The context risk posture encoding is obtained by concatenating the vector representation of the business context parameters with the historical risk state vector and then performing a nonlinear transformation. The attention interaction uses the context risk posture encoding as the query basis to measure the correlation between the context risk posture encoding and each modality sub-vector. The higher the correlation, the more important the corresponding modality is to the judgment. Based on this, dynamic fusion weight coefficients are generated. The weighted fusion is performed by weighting each modality sub-vector according to the dynamic fusion weight coefficients and combining it with the context risk posture encoding transformation to obtain the context-aware risk fusion vector.

[0088] In step S104, the risk classification result sequence is a sequence of risk classification results output by the target account in each risk assessment period within the historical time window, arranged chronologically, and can be read from the stored historical risk assessment records. A risk state observation chain is constructed by mapping each risk classification result to a state code and arranging them chronologically. The Hidden Markov Model uses the risk state of the account in each risk assessment period as the state to be estimated, and the state code of the risk classification result output in each period as the observable representation of that state. The state transition probability matrix is ​​obtained by statistically analyzing the transitions of adjacent states in the risk state observation chain, representing the probability of mutual transitions between risk states. The state dwell time distribution parameter is obtained by statistically analyzing the number of consecutive occurrences of each risk state in the risk state observation chain, representing the duration of continuous state maintenance. After converting the context-aware risk fusion vector into an observation probability representation, forward recursion is performed based on the state probability distribution of the previous time step, the state transition probability matrix, and the observation probability representation. The obtained state probability distribution is then corrected and normalized based on the state dwell time distribution parameter to meet duration constraints.

[0089] In step S105, the modal sub-vectors are the sub-parts of the multimodal spatiotemporal coupling representation vectors corresponding to each behavioral modality. Cosine similarity measures the directional proximity of two modal sub-vectors, while relative entropy distance measures the difference in probability distribution patterns between two modal sub-vectors. Modal consistency testing preferably calculates the cosine similarity and relative entropy distance for any two modal sub-vectors and combines them to form a consistency metric for the modal pair. This process iterates through all modal pairs to form a modal consistency score matrix. The average consistency metric of each modality with the remaining modalities is calculated and compared with a consistency threshold. Values ​​lower than the threshold indicate significant deviations in behavioral characteristics from other modalities, suggesting a possible forgery; these are classified as abnormal modal subsets, while the rest are classified as normal modal subsets. The dynamic fusion weight coefficients corresponding to the abnormal modal subsets are multiplied by a coefficient less than one, and the dynamic fusion weight coefficients corresponding to the normal modal subsets are multiplied by a coefficient greater than one. After normalization, the adversarial robust weight coefficients are obtained. The multimodal spatiotemporal coupling representation vector is fused based on the adversarial robust weight coefficients. The resulting fused representation and the temporal enhanced risk state vector are then input into the risk classification judgment network to output the risk classification result.

[0090] In step S106, the attribution contribution rate characterizes the degree of contribution of each modality to the current risk classification result, and is obtained by combining the weight of the modality in the judgment and the correlation between the modality features and the current risk classification result; the risk attribution distribution vector is formed by concatenating the attribution contribution rates of each modality, with each dimension corresponding to a modality. The higher the value, the stronger the basis for the judgment of the current risk level of that modality. The granularity and coverage of data collection are improved for modalities with high contributions, and the data collection is appropriately reduced for modalities with low contributions. The adjusted sampling parameters are then sent to the behavioral data collection end, so that the detection resources in subsequent risk judgment cycles are tilted towards risk-sensitive modalities.

[0091] This embodiment transforms the determination of account risk status from a single, independent judgment to a probabilistic extrapolation along a time axis. Data reliability is assessed based on the consistency between modalities. The transition and persistence patterns of risk status ensure smooth changes in the classification results, avoiding jumps in levels caused by single behavioral fluctuations. Modal consistency checks automatically weaken the weight of some modalities when they are forged, shifting the judgment basis to other mutually corroborating modalities. Risk attribution results are fed back to the data collection stage, allowing detection resources to be dynamically allocated according to the source of risk. Thus, even in situations where account behavior continuously evolves and may be forged, stable, continuous, and interference-resistant risk classification results are obtained, improving the efficiency of data collection and computational resource utilization.

[0092] Please see Figure 2 In some embodiments, single-modal feature extraction is performed on the multimodal behavior preprocessing sequence, and a temporal dependency code and a cross-modal spatial association code based on a gated loop structure are constructed. A joint mapping is then performed to generate a multimodal spatiotemporally coupled representation vector, including:

[0093] S201. Extract the statistical features of each modality from the multimodal behavior preprocessing sequence to obtain the initial behavior feature vector sequence;

[0094] S202. Construct a gated loop structure containing update gate and reset gate for the initial behavior feature vector sequence. Linearly transform and activate the initial behavior feature vector of the current time step and the hidden state vector of the previous time step through update gate and reset gate to obtain update gate control signal and reset gate control signal. Use the reset gate control signal to filter the hidden state vector of the previous time step to generate candidate hidden states. Use the update gate control signal to weight and merge the hidden state vector of the previous time step and the candidate hidden states to obtain the temporal enhancement feature vector of the current time step. Generate a temporal enhancement feature vector sequence step by step.

[0095] S203. For any two modal temporal enhancement feature vectors, the dimensions of the first projection weight matrix and the second projection weight matrix are transformed. The outer product operation is performed on the transformation result to obtain the correlation response tensor. The correlation response tensor is aggregated through the aggregation weight vector channel to obtain the correlation response value. The modal correlation response matrix is ​​generated by traversing each modal pair. The modal correlation response matrix is ​​added to the modal autocorrelation diagonal matrix to obtain the cross-modal coupling feature matrix.

[0096] S204. The temporal enhanced feature vector sequence is linearly combined with the feature fusion weight matrix to obtain the temporal feature fusion vector. The cross-modal coupling feature matrix is ​​aggregated in the row direction and column direction of the correlation aggregation weight matrix to obtain the spatial correlation aggregation vector. The temporal feature fusion vector and the spatial correlation aggregation vector are concatenated and subjected to dimensional compression and semantic alignment by the joint mapping weight matrix to generate the multimodal spatiotemporal coupling representation vector.

[0097] In step S201, the statistical features of each modality are calculated based on the representative values ​​of each time slice window in the multimodal behavior preprocessing sequence. The operation behavior modality can extract statistical features such as the mean of trajectory curvature, the degree of fluctuation of keystroke interval, and the repetition of page access path. The device environment modality can extract statistical features such as hardware entropy, network latency jitter variance, and position drift speed. The transaction behavior modality can extract statistical features such as the deviation of transaction amount, the deviation index of transaction time distribution, and the correlation of counterparty risk. The biological behavior modality can extract statistical features such as the skewness of touch screen pressure distribution and the smoothness of sliding trajectory. The statistical features corresponding to each time slice window are arranged in chronological order to form the initial behavior feature vector sequence of each modality.

[0098] In step S202, before processing the initial behavior feature vector sequence, the hidden state vector of the gated loop structure can be initialized to a zero vector or determined by the hidden state vector of the previous time step; the activation of the update gate and reset gate can use the sigmoid function, and the calculation of the candidate hidden state can use the hyperbolic tangent function; each weight matrix and bias vector can be obtained offline from historical behavior sample data and updated with the risk policy version. During the time-step iteration process, the corresponding temporal enhancement feature vector is output at each time step, and the temporal enhancement feature vector sequence is obtained through time-step iteration.

[0099] In step S203, the first projection weight matrix and the second projection weight matrix respectively map the temporal enhancement feature vectors of the two modes to the same dimension; after mapping, the outer product of the two vectors is multiplied by corresponding elements to form a matrix, and the matrices obtained for each mode pair are stacked along the channel dimension to form the correlation response tensor; the aggregated weight vector is weighted and summed along the channel dimension to obtain the correlation response value of the mode pair. The diagonal elements of the modal autocorrelation diagonal matrix are the normalized values ​​of the modal temporal enhancement feature vectors, and the off-diagonal elements are zero. After being added to the inter-modal correlation response matrix, they together form the cross-modal coupling feature matrix; all the above weight matrices and aggregated weight vectors can be obtained by offline training from historical behavior samples.

[0100] In step S204, the feature fusion weight matrix assigns weights to each modality's temporal enhancement feature vector according to its modality and combines them linearly to obtain a temporal feature fusion vector; the association aggregation weight matrix aggregates the cross-modal coupling feature matrix along both the row and column directions, and the row and column aggregation results are concatenated to obtain a spatial association aggregation vector. The temporal feature fusion vector and the spatial association aggregation vector are concatenated in a preset order, compressed to a preset dimension by a linear transformation of the joint mapping weight matrix, and semantic alignment is completed to generate a multimodal spatiotemporal coupling representation vector. The sub-vectors corresponding to each modality in this representation vector maintain modal distinguishability, and the dimensions of each modal sub-vector are the same. They are concatenated in the modal arrangement order to form the multimodal spatiotemporal coupling representation vector. The feature fusion weight matrix, the association aggregation weight matrix, and the joint mapping weight matrix can all be obtained by offline training from historical behavior samples.

[0101] In this embodiment, the statistical features of each modality are filtered and merged step by step through a gated loop structure to obtain a temporal enhanced feature vector. The modal pairs are associated with each other through outer product interaction and channel aggregation. Combined with the modal autocorrelation representation, a cross-modal coupled feature matrix is ​​formed. The two are jointly mapped to generate a multimodal spatiotemporal coupled representation vector, which simultaneously carries the temporal evolution law of a single modality and the correlation between modalities, providing a unified feature representation for subsequent judgment.

[0102] In some embodiments, business context parameters are obtained, and a context risk posture code is generated by combining it with a historical risk state vector. This context risk posture code interacts with the attention of a multimodal spatiotemporally coupled representation vector to generate dynamic fusion weight coefficients corresponding to each modality. Weighted fusion is then used to generate a context-aware risk fusion vector, including:

[0103] The business scenario type identifier in the business context parameters is transformed by the business scenario embedding matrix to obtain the business scenario embedding vector. The business attribute parameters in the business context parameters are concatenated into a business attribute numerical vector. The business attribute numerical vector is transformed by the attribute transformation weight matrix to obtain the business attribute embedding vector. The historical risk state vector, the business scenario embedding vector and the business attribute embedding vector are concatenated into a joint situation vector. The joint situation vector is transformed by the situation coding weight matrix nonlinearly to obtain the context risk situation code.

[0104] The context risk situation encoding is linearly projected onto the query weight matrix to obtain the query vector. The modal sub-vectors in the multimodal spatiotemporal coupling representation vector are linearly projected onto the key weight matrix to obtain the key vector. The dot product similarity between the query vector and each key vector is calculated and converted into the initial value of attention weight through scaling and normalization exponential function. The initial value of attention weight is multiplied by the modal basic weight coefficient to obtain the dynamic fusion weight coefficient corresponding to each modality.

[0105] Each modal subvector is multiplied element-wise with its corresponding dynamic fusion weight coefficient to obtain a weighted feature vector. Each weighted feature vector is added element-wise to obtain a weighted fusion vector. The weighted fusion vector is concatenated with the context risk situation code and subjected to nonlinear transformation and dimensional compression of the fusion coding weight matrix to generate a context-aware risk fusion vector.

[0106] In this embodiment, the business scenario type identifier is used to distinguish the business category to which the current business request belongs. This may include account login, password modification, binding a new device, small-amount transfer, large-amount transfer, purchase of wealth management products, loan application, and account cancellation. This identifier is provided by the business system when the business request is initiated. The business attribute parameters are the parameters in the business context parameters other than the business scenario type identifier. Their values ​​are numericalized and concatenated in a preset order to form a business attribute value vector. Each row of the business scenario embedding matrix corresponds to a semantic representation of a business scenario type, and the number of rows equals the number of business scenario type categories. The business scenario embedding matrix, attribute transformation weight matrix, and situational encoding weight matrix are all obtained by iteratively updating elements through backpropagation and gradient descent until the preset loss function converges, using the business scenario type, business attribute parameters, and risk performance corresponding to historical business requests as samples. The situational encoding weight matrix performs a nonlinear transformation on the joint situational vector. The activation function can be a hyperbolic tangent function or a linear rectified function. The dimension of the resulting contextual risk situational encoding is consistent with the dimension of each modality sub-vector.

[0107] The query weight matrix and key weight matrix map the contextual risk profile encoding and each modality subvector to the same dimension. Both are trained offline using multimodal behavior data from historical account behavior samples as input and the sample's true risk level as the label, following the aforementioned backpropagation and gradient descent methods. The dot product similarity is obtained by multiplying the corresponding elements of the query vector and key vector and then summing the results. The scaling factor used in the scaling process can be the square root of the key vector dimension to avoid the normalized exponential function output becoming saturated and causing the attention weight distribution to become overly concentrated. The normalized exponential function converts the scaled dot product similarity into a probability distribution where the sum of the modality weights is one, yielding the initial attention weight values. The modality base weight coefficients characterize the prior importance of each modality when unaffected by contextual differences and can be pre-calibrated based on the accuracy of each modality used individually for risk assessment in historical risk samples. The weighted multiplication of the initial attention weight values ​​and the modality base weight coefficients is the multiplication of their corresponding elements, resulting in a dynamically fused weight coefficient that simultaneously reflects current contextual differences and the inherent importance of the modality.

[0108] The fusion coding weight matrix maps the weighted fusion vector and the vector concatenated with the context risk situation code to a context-aware risk fusion vector. The nonlinear transformation can be performed using a linear rectified function, the value of which can be obtained by offline training of historical account behavior samples. The output dimension can be pre-configured according to the input requirements of the subsequent state prediction stage.

[0109] In this embodiment, the business context parameters are embedded, transformed, and upgraded in dimensionality, and then co-encoded with the historical risk state vector to form a context risk situation code. The similarity between the code and each modal sub-vector is calculated and normalized and adjusted with prior coefficients to obtain a dynamic fusion weight coefficient. The code is then weighted and fused according to the dynamic fusion weight coefficient and co-encoded with the context risk situation code. This allows the context-aware risk fusion vector to reflect the risk attributes of the current business scenario while retaining the weighted fusion information of multimodal behavioral features, thereby enabling the risk judgment criteria to be adaptively adjusted according to different business scenarios.

[0110] Please see Figure 3 In some embodiments, the risk classification result sequence of the target account within a historical time window is obtained, a risk state observation chain is constructed, the state transition probability matrix and state dwell time distribution parameters are calculated based on a hidden Markov model, and a time-enhanced risk state vector is obtained by combining context-aware risk fusion vector prediction, including:

[0111] S301. Obtain the risk classification results output by the target account in each risk assessment period within the historical time window, arrange them in chronological order to obtain the risk classification result sequence, and map each risk classification result in the risk classification result sequence to a status code to obtain the risk status observation chain.

[0112] S302. The number of transitions between adjacent states in the statistical risk state observation chain is used to obtain the state transition frequency matrix. The transition frequency from each source state to each target state is divided by the total number of times the source state appears to obtain the state transition probability matrix.

[0113] S303. The number of consecutive occurrences of each risk state in the statistical risk state observation chain is used to obtain the residence time sample set. Based on the residence time sample set, the average residence time and variance of each risk state are calculated to obtain the state residence time distribution parameters.

[0114] S304. The context-aware risk fusion vector is linearly transformed and activated by the observation probability weight matrix to obtain the observation probability vector. Based on the risk state probability distribution, state transition probability matrix and observation probability vector of the previous time step, forward recursion is performed to obtain the unnormalized state probability distribution.

[0115] S305. Based on the state dwell time distribution parameters, the unnormalized state probability distribution is corrected by time constraint, and the time-series enhanced risk state vector is obtained by normalization operation.

[0116] In step S301, the risk classification results can be pre-configured according to the risk distribution and risk handling requirements of historical risk samples, including normal, attention, suspected and high risk; the status code maps each risk classification result to a continuous integer in order of risk from low to high, and the mapping relationship remains unchanged during the observation process. The resulting integer sequence is the risk status observation chain.

[0117] In step S302, the elements of the state transition frequency matrix are the number of times a risk state transitions to another risk state in the risk state observation chain, and the total number of times the source state appears is the number of times the source state appears in the risk state observation chain. Each row element is divided by the total number of times the corresponding source state appears in that row to obtain the probability of transitioning from the source state to each target state, and the sum of the elements in each row is one. For transition relationships that do not appear in the risk state observation chain, their probability can be determined based on the statistical results of similar transition relationships in historical risk samples.

[0118] In step S303, the dwell time sample set is composed of the number of consecutive steps of the same risk state in the risk state observation chain, and each risk state corresponds to a dwell time sample set; the average dwell time is the arithmetic mean of all dwell time samples under the same risk state, and the dwell time variance is the arithmetic mean of the squares of the differences between each dwell time sample and the average dwell time under the same risk state.

[0119] In step S304, the observation probability weight matrix is ​​obtained by taking the context-aware risk fusion vector obtained from the previous steps using the multimodal behavior data of historical accounts as input and the actual risk classification result of the account in the corresponding risk assessment period as label, and updating iteratively through backpropagation and gradient descent until the preset loss function converges. It maps the context-aware risk fusion vector to a dimension with the same number of risk states and activates it with a normalized exponential function to obtain the observation probability vector. Each dimension of the observation probability vector represents the observation probability of the account being in each risk state under the current context-aware risk fusion vector. The initial value of the risk state probability distribution of the previous time step can be determined by the frequency of each risk state of the target account within the historical time window, and subsequent time steps take the output of the previous time step. In the forward recursive operation, the unnormalized probability of each risk state in the current time step is obtained by multiplying the weighted sum of the probabilities of each risk state in the previous time step according to the state transition probability matrix by the observation probability of the corresponding risk state in the observation probability vector. Traversing all risk states yields the unnormalized state probability distribution.

[0120] In step S305, the duration constraint correction adjusts the state probability values ​​in the unnormalized state probability distribution that do not match the residence statistics based on the residence statistics of each risk state in the state residence duration distribution parameters; the normalization operation divides the corrected probability value of each risk state by the sum of the probability values ​​of all risk states, and the resulting time-series enhanced risk state vector has each dimension corresponding to the probability of each risk state at the current time.

[0121] This embodiment obtains a risk state observation chain by mapping the risk classification results to state encoding, obtains a state transition probability matrix by statistically analyzing the transitions of adjacent states, and obtains a state dwell time distribution parameter by statistically analyzing the number of consecutive steps of the same state. After the context-aware risk fusion vector is converted into an observation probability vector through the observation probability weight matrix, it participates in the forward recursion together with the risk state probability distribution and the state transition probability matrix of the previous time step to obtain an unnormalized state probability distribution. After time constraint correction and normalization, a time-enhanced risk state vector is obtained. Thus, the risk state determination at the current moment is superimposed with the historical state transition possibilities and dwell patterns in addition to the current observation results, so that the risk state probability distribution changes smoothly on the time axis, providing a stable time-series state basis for subsequent risk classification.

[0122] In some embodiments, the unnormalized state probability distribution is corrected for duration constraints based on state dwell time distribution parameters, and a time-enhanced risk state vector is obtained after normalization, including:

[0123] Obtain the continuous dwell time of each risk state before the current time. The continuous dwell time is the number of time steps that each risk state has been continuously in the corresponding risk state before the current time.

[0124] Based on the average dwell time and dwell time variance in the state dwell time distribution parameters, the upper bound of the dwell time corresponding to each risk state is determined. The upper bound of the dwell time increases as the dwell time variance increases.

[0125] Based on the average dwell time in the state dwell time distribution parameters, the lower bound of the dwell time corresponding to each risk state is determined. The lower bound of the dwell time is a preset proportion of the average dwell time.

[0126] The continuous dwell time of each risk state is compared with the corresponding upper and lower limits of dwell time. Risk states with a continuous dwell time exceeding the corresponding upper limit of dwell time are identified as over-dwelling states, and risk states with a continuous dwell time below the corresponding lower limit of dwell time are identified as under-dwelling states.

[0127] For risky states with excessive dwell time, reduce the state probability value corresponding to the risky state in the unnormalized state probability distribution.

[0128] For risk states with insufficient residency, increase the probability weight of the risk state transitioning to other risk states;

[0129] Normalize the modified unnormalized state probability distribution to obtain the time-series enhanced risk state vector.

[0130] In this embodiment, the continuous dwell time is determined by the continuous state records before the current moment in the risk state observation chain. For risk states that have not appeared before the current moment, the continuous dwell time is set to zero.

[0131] The upper bound of residence duration can be obtained by adding the product of the residence duration variance and the positive coefficient to the average residence duration. The positive coefficient can be determined by the quantile of the residence duration distribution for each risk state in the historical normal account sample. The lower bound of residence duration is obtained by multiplying the average residence duration by a preset proportion less than one. The preset proportion can also be determined by the quantile of the residence duration distribution for the corresponding risk state in the historical normal account sample. The comparison of each risk state is independent of each other. Risk states with continuous residence durations between the lower and upper bounds of residence duration are not modified.

[0132] The state probability value is reduced by multiplying the value of the overstayed state in the unnormalized state probability distribution by a decay coefficient less than one. The decay coefficient can be determined by the statistical results of the state probability distribution and the actual state switching in historical normal account samples.

[0133] The weighting of transition probabilities is applied to the state transition probability matrix by multiplying the off-diagonal elements of the row containing underrepresented states by an enhancement coefficient greater than one, and then normalizing the elements of that row. This increases the probability of the underrepresented state transitioning to other risk states. The enhancement coefficient can be determined by the state switching frequency in a historical sample of normal accounts. After normalizing the row containing underrepresented states, the normalized transition probabilities of the corresponding other risk states in that row can be used as a distribution ratio. The state probability values ​​of the underrepresented state in the unnormalized state probability distribution are then distributed to the other risk states according to this distribution ratio, resulting in the corrected unnormalized state probability distribution.

[0134] This embodiment uses the comparison between the continuous dwell time of each risk state and the corresponding upper and lower bounds of dwell time as the criterion to identify over-dwelling and under-dwelling states. For over-dwelling states, its value in the state probability distribution is suppressed, while for under-dwelling states, its probability weight for transitioning to other risk states is increased. These two types of corrections make the normalized state probability distribution conform to both the current observation results and the state dwell time pattern. The resulting time-series enhanced risk state vector is smoother and more stable on the time axis, providing a more reliable time-series state basis for subsequent risk classification.

[0135] Please see Figure 4 In some embodiments, cosine similarity and relative entropy distance are calculated for each modal sub-vector in the multimodal spatiotemporal coupled representation vector. A modal consistency test is performed to obtain a modal consistency score matrix. Abnormal modal subsets and normal modal subsets are divided. The dynamic fusion weight coefficients of the abnormal and normal modal subsets are attenuated and enhanced respectively to generate adversarial robustness weight coefficients. The multimodal spatiotemporal coupled representation vector is fused based on the adversarial robustness weight coefficients and jointly judged with the temporal enhanced risk state vector to output a risk classification result, including:

[0136] S401. Separate the modal sub-vectors corresponding to each modality from the multimodal spatiotemporal coupling representation vector. Calculate the cosine similarity between the two modal sub-vectors of any modal pair. Calculate the relative entropy distance by performing distribution transformation on the two modal sub-vectors respectively. Combine the cosine similarity with the scaled relative entropy distance in a weighted manner to obtain the consistency metric of the modal pair. Iterate through all modal pairs to generate the modal consistency score matrix.

[0137] S402. For each mode, calculate the arithmetic mean of its consistency metric values ​​with the other modes to obtain the average consistency score. Classify modes with an average consistency score lower than the consistency threshold into the abnormal mode subset, and classify modes with an average consistency score not lower than the consistency threshold into the normal mode subset.

[0138] S403. Multiply the dynamic fusion weight coefficients corresponding to each mode in the abnormal mode subset by the attenuation coefficient, and multiply the dynamic fusion weight coefficients corresponding to each mode in the normal mode subset by the enhancement coefficient, and then perform normalization to obtain the anti-robust weight coefficients.

[0139] S404. Weigh and fuse each modal subvector with its corresponding adversarial robustness weight coefficient to obtain an adversarial robustness fusion vector. We concatenate the adversarial robustness fusion vector with the temporal enhanced risk state vector to form a joint decision vector. We input the joint decision vector into the risk classification decision network and output the risk classification result.

[0140] In step S401, the separation of each modal sub-vector can be based on the dimension range occupied by each modality during the joint mapping of the multimodal spatiotemporal coupling representation vector, so that each modal sub-vector corresponds one-to-one with each row of the modality; the rows and columns of the modality consistency score matrix correspond to each row of the modality, the matrix elements are the consistency metric values ​​of the corresponding modality pairs, and the diagonal elements are the consistency metric values ​​of the modality itself.

[0141] In step S402, the consistency threshold can be determined based on the distribution of the average consistency scores of each modality in the historical normal samples. The quantile of the average consistency score of each modality in the historical normal samples can be selected as the consistency threshold, so that the consistency threshold can distinguish the modal consistency of normal accounts from the modal deviation when the modality is forged; the object of threshold comparison is the average consistency score of each modality.

[0142] In step S403, the attenuation coefficient and the enhancement coefficient can be determined by the correspondence between modal consistency and modal reliability in historical normal samples. The attenuation coefficient is a value less than one, and the enhancement coefficient is a value greater than one. The normalization operation divides all the adjusted modal weight coefficients by the sum of all modal weight coefficients, so that the sum of all modal weight coefficients is one.

[0143] In step S404, the concatenation of the adversarial robust fusion vector and the temporal enhanced risk state vector can be performed according to the order of the modalities and the order of the temporal state dimensions, so that the joint judgment vector simultaneously contains the spatial features after modal fusion and the temporal features of the risk state; the risk classification judgment network can be obtained by taking the joint judgment vector obtained from the multimodal behavior data of historical accounts through the aforementioned steps as input, and taking the real risk classification result of the account in the corresponding risk judgment period as label, and then training iteratively through backpropagation and gradient descent.

[0144] This embodiment calculates the cosine similarity and relative entropy distance of each modal subvector in the multimodal spatiotemporal coupling representation vector to obtain the modality consistency score matrix. The abnormal modality subset and the normal modality subset are divided by comparing the average consistency score and the consistency threshold. The dynamic fusion weight coefficient of the abnormal modality subset is attenuated and the dynamic fusion weight coefficient of the normal modality subset is enhanced and then normalized to obtain the adversarial robustness weight coefficient. The multimodal spatiotemporal coupling representation vector is fused with the adversarial robustness weight coefficient and jointly judged with the temporal enhanced risk state vector to output the risk classification result. When some modalities are forged, their weights are suppressed and the judgment basis is transferred to other mutually corroborating modalities, thereby maintaining the accuracy of the risk classification result in the adversarial attack scenario.

[0145] In some embodiments, cosine similarity is calculated for the two modal subvectors of any modality pair; the relative entropy distance is obtained by calculating the symmetric relative entropy after performing distribution transformation on the two modal subvectors; the cosine similarity and the scaled relative entropy distance are weighted and combined to obtain the consistency metric of the modality pair; and a modality consistency score matrix is ​​generated by traversing all modality pairs, including:

[0146] From the multimodal spatiotemporal coupling representation vector, the modal sub-vectors corresponding to each mode are separated, and each modal sub-vector corresponds to each row of the mode;

[0147] For any two modal subvectors of a modality pair, the cosine similarity of the modality pair is obtained by dividing the dot product of the two modal subvectors by the product of their modal lengths. The dot product is the sum of the product of the corresponding elements of each dimension of the two modal subvectors, and the product of their modal lengths is the product of their respective modal lengths.

[0148] The two modal subvectors are transformed into probability distributions using a distribution transformation function, resulting in two probability distributions. The distribution transformation function converts the values ​​of each dimension of each modal subvector into non-negative probability values.

[0149] Calculate the forward relative entropy and the reverse relative entropy between two probability distributions, and use the sum of the forward relative entropy and the reverse relative entropy as the relative entropy distance of the mode pair;

[0150] The cosine similarity and the relative entropy distance scaled by a preset scaling factor are summed according to a preset weight to obtain the consistency metric of the mode pair. The consistency metric reflects both the closeness of the mode pair in direction and the difference in distribution pattern.

[0151] Traverse all modality pairs and arrange the consistency metrics of each modality pair into a modality consistency score matrix.

[0152] In this embodiment, the dimension of each modal sub-vector separated from the multimodal spatiotemporal coupling representation vector is the same as the dimension assigned to each behavior mode during joint mapping. The dimensions of each modal sub-vector are consistent to ensure that the two modal sub-vectors of any modal pair can be directly subjected to dot product and modulus operations.

[0153] In cosine similarity, when the magnitude of any modal subvector is zero, the cosine similarity of the modal pair can be set to zero to avoid the denominator being zero and thus causing the calculation to be undefined.

[0154] The distribution transformation function can be a normalized exponential function, which involves exponentially operating on the values ​​of each dimension of the modal subvector and then dividing by the sum of the exponential results of all dimensions, so that the sum of the probabilities of each dimension in the resulting probability distribution is one; alternatively, an absolute value normalization method can be used, which involves dividing the absolute value of each dimension of the modal subvector by the sum of the absolute values ​​of all dimensions. To make the relative entropy distance computable, a smoothing term can be added to the probability values ​​of each dimension in the resulting probability distribution, so that the probability value of any dimension is not zero.

[0155] The forward relative entropy is calculated using one probability distribution as the reference distribution and the other probability distribution as the distribution to be compared. The reverse relative entropy is calculated after swapping the roles of the two probability distributions. The two measure the difference between the two probability distributions in two directions, respectively. The sum of the forward and reverse relative entropies ensures that the relative entropy distance of the mode pair does not change with the order of the two mode subvectors.

[0156] The preset scaling factor can be determined by the quantiles of the relative entropy distance distribution of modal pairs in historical normal samples, ensuring that the scaled relative entropy distance and cosine similarity are within a similar numerical range. The preset weights can be determined based on the ability of cosine similarity and relative entropy distance to distinguish modal consistency in historical normal samples, ensuring that the consistency metric reflects both directional similarity and distributional differences. Specifically, the preset weight corresponding to the relative entropy distance is negative, causing the consistency metric to increase with increasing cosine similarity and decrease with increasing relative entropy distance.

[0157] The consistency metric values ​​of each mode pair are symmetric about the order of the mode pairs, and the two elements corresponding to the same mode pair in the mode consistency score matrix are equal.

[0158] In this embodiment, the consistency metric incorporates both cosine similarity and relative entropy distance. Cosine similarity reflects the proximity of two modal subvectors in direction, while relative entropy distance reflects the difference in probability distribution between two modal subvectors. The modal consistency score matrix obtained by weighted combination of the two can comprehensively measure whether each modality corroborates the other from both directional and distributional perspectives, providing a numerical basis for subsequent identification of inconsistencies between modalities.

[0159] In some embodiments, each modality sub-vector is weighted and fused with its corresponding adversarial robustness weight coefficient to obtain an adversarial robustness fused vector. This adversarial robustness fused vector is then concatenated with the temporal augmentation risk state vector to form a joint decision vector. The joint decision vector is input into a risk classification network, which outputs risk classification results, including:

[0160] Each modality subvector is multiplied element-wise with its corresponding adversarial robustness weight coefficient to obtain the weighted subvector corresponding to each modality.

[0161] The weighted sub-vectors corresponding to each modality are added element by element to obtain the adversarial robust fusion vector. The adversarial robust fusion vector is the fusion representation of each modality sub-vector after being weighted by the adversarial robust weight coefficient.

[0162] The adversarial robust fusion vector and the temporal enhanced risk state vector are concatenated in a preset dimension order to obtain a joint decision vector. The joint decision vector carries both the spatial features after adversarial robust fusion and the temporal features of the historical risk state.

[0163] The joint decision vector is input into the risk classification decision network, which contains multiple hidden layers and an output layer. Each hidden layer contains a preset number of neurons and uses a non-linear activation function.

[0164] The joint decision vector is mapped to deep discriminative features by performing nonlinear activation transformation layer by layer through multiple hidden layers.

[0165] The output layer uses a normalized exponential activation function to output the probability value corresponding to each risk state. The output layer contains a number of neurons equal to the number of risk states, and the neurons in the output layer correspond one-to-one with each risk state.

[0166] The risk state with the highest probability value among all risk states is determined as the risk classification result.

[0167] In this embodiment, the dimension of the adversarial robust fusion vector is consistent with the dimension of each modality sub-vector, and the dimension of the temporal augmentation risk state vector is consistent with the number of risk states. The adversarial robust fusion vector and the temporal augmentation risk state vector are concatenated in a preset dimensional order, which can be that the dimensions of the adversarial robust fusion vector come first and the dimensions of the temporal augmentation risk state vector come last. The dimension of the resulting joint decision vector is the sum of the dimensions of the two, so that the modality fusion features and temporal state features in the joint decision vector remain distinguishable in terms of dimension.

[0168] The number of hidden layers and the number of neurons in each hidden layer in the risk classification network can be determined based on the size of the historical account sample and the complexity of the risk classification task. Alternatively, the optimal value for risk classification accuracy can be selected from the validation samples through cross-validation. The nonlinear activation function used in the hidden layers can be a linear rectified function or a hyperbolic tangent function. The deep discriminative features obtained after the joint decision vector undergoes linear and nonlinear activation transformations layer by layer in each hidden layer represent the feature representation of the joint decision vector in the hidden layer output space.

[0169] The probability values ​​output by each neuron node in the output layer represent the probability that the target account is in the corresponding risk state during the current risk assessment period. They are constrained by the normalized exponential activation function to form the probability distribution of each risk state. The risk state with the highest probability value corresponds to the risk classification result.

[0170] This embodiment uses an adversarial robustness weight coefficient to weight and sum the sub-vectors of each modality, thereby weakening the influence of the identified anomalous modalities in the fusion result. The fusion result mainly reflects the common characteristics of each normal modality. The obtained adversarial robust fusion vector is concatenated with the temporally enhanced risk state vector carrying historical risk state evolution information, so that the risk classification network can simultaneously utilize the consistency of the current multimodal behavior fusion result and the temporal continuity of the risk state when making judgments. The network extracts deep discrimination features through nonlinear transformation of the hidden layer, and normalizes them into the probability distribution of each risk state through the output layer. The one with the highest probability is taken as the risk classification result. Thus, even when some modalities are forged, the network can still give a risk classification result based on other mutually corroborating modalities and stable historical states.

[0171] In some embodiments, the attribution contribution of each modality is calculated based on the risk classification results and the adversarial robustness weight coefficient, generating a risk attribution distribution vector, and the sampling strategy at the behavioral data collection end is adjusted accordingly, including:

[0172] For each modality, the adversarial robustness weight coefficient corresponding to the modality is multiplied by the judgment confidence corresponding to the risk classification result to obtain the risk contribution benchmark value. The modality subvector is projected onto the neuron weight vector corresponding to the risk classification result in the risk classification judgment network to obtain the projection similarity. The risk contribution benchmark value and the projection similarity are weighted and combined to obtain the attribution contribution of the modality. The attribution contribution of each modality is concatenated to form a risk attribution distribution vector, and each dimension in the risk attribution distribution vector corresponds to the attribution contribution of each modality.

[0173] The values ​​of each dimension in the risk attribution distribution vector are compared with the attribution threshold. Dimensions with values ​​higher than the attribution threshold are identified as high-risk contribution dimensions, and dimensions with values ​​lower than the attribution threshold are identified as low-risk contribution dimensions.

[0174] For modalities corresponding to high-risk contribution dimensions, the sampling frequency is increased, the sampling time window is extended, and the feature extraction granularity is refined. For modalities corresponding to low-risk contribution dimensions, the sampling frequency is reduced, the sampling time window is shortened, and the feature extraction granularity is coarsened. The updated sampling frequency, sampling time window length, and feature extraction granularity are encapsulated into a sampling strategy update instruction and sent to the behavior data collection terminal, so that subsequent risk assessment cycles will execute data collection according to the updated sampling strategy.

[0175] In this embodiment, the confidence level corresponding to the risk classification result can be taken from the probability value output by the neuron node corresponding to the risk classification result in the output layer of the risk classification network. The higher the probability value, the higher the certainty of the risk classification network for the current risk classification result. The projection similarity obtained by projecting the modality subvector onto the neuron weight vector corresponding to the risk classification result in the risk classification network can be obtained by first mapping the modality subvector to the same dimension as the neuron weight vector through a preset attribution projection weight matrix, and then calculating the cosine similarity between the mapping result and the neuron weight vector. The attribution projection weight matrix can be obtained by offline training of historical account behavior samples. The higher the cosine similarity, the closer the representation of the modality subvector after mapping is to the direction of the neuron weight vector that determines the current risk classification result. The weights on which the weighted combination of the risk contribution benchmark value and the projection similarity is based can be calibrated according to the degree of contribution of each of the two to the actual attribution result in the historical attribution samples. The attribution contribution of each modality can also be normalized so that the sum of the values ​​of each dimension in the risk attribution distribution vector is one.

[0176] In determining the attribution threshold, it can be set according to the distribution of attribution contribution of each modality within the historical time window. For example, the median or average of the attribution contribution of each modality can be taken as the attribution threshold, or the average score of the attribution contribution can be taken according to the number of modalities, so that the attribution threshold can be updated as the account risk status evolves. The comparison operation is performed dimension by dimension, and the comparison of the values ​​of each dimension with the attribution threshold is independent of each other.

[0177] The sampling frequency, sampling time window length, and feature extraction granularity can be adjusted by pre-defined levels. The sampling frequency can be divided into several levels from low to high, the sampling time window length can be divided into several levels from narrow to wide, and the feature extraction granularity can be divided into several levels from coarse to fine. The values ​​of each level can be pre-configured based on the acquisition capabilities and computing resources of the behavioral data acquisition terminal. Increasing the sampling frequency, extending the sampling time window, and refining the feature extraction granularity means switching from the current level to the adjacent higher, wider, and finer levels, while decreasing, shortening, and coarsening means switching to the adjacent lower, narrower, and coarser levels.

[0178] The sampling strategy update instruction may include fields such as modality identifier, updated sampling frequency, sampling time window length and feature extraction granularity. After being encapsulated according to modality, it is sent to the behavior data acquisition terminal through the communication channel and takes effect from the next risk assessment cycle, so that the behavior data acquisition terminal will perform data acquisition according to the updated level in subsequent cycles.

[0179] This embodiment combines the adversarial robustness weight coefficient of each modality with the contribution direction of the modality subvector to the current risk classification result to obtain the attribution contribution degree, which reflects the degree of contribution of each modality to the current risk classification result. This makes the risk attribution distribution vector not only reflect the weight of the modality in the fusion, but also the degree of consistency between the modality features and the judgment criteria. Accordingly, the sampling level corresponding to the modality with a higher attribution contribution degree is increased, and the sampling level corresponding to the modality with a lower attribution contribution degree is decreased. The detection resources are dynamically allocated according to the risk source, which reduces the consumption of data acquisition and computing resources while maintaining the accuracy of risk judgment, and makes the sampling strategy continuously updated with the risk attribution results in subsequent risk judgment cycles.

[0180] Please see Figure 5In a second aspect, this embodiment also provides an account risk dynamic classification system 1 based on multimodal behavior fusion, used to execute the method described in the first aspect. The system includes a behavior data acquisition module 11, a data preprocessing module 12, a spatiotemporal coupling coding module 13, a context-aware fusion module 14, a time-series state prediction module 15, a modality consistency test and adversarial robustness determination module 16, and a risk attribution and sampling strategy adjustment module 17. The behavior data acquisition module 11 is used to collect operational behavior data, equipment environment data, transaction behavior data, and biological behavior data of the target account; the data preprocessing module 12 is used to perform temporal alignment, missing value imputation, and standardization on the multimodal behavior data to obtain a multimodal behavior preprocessing sequence; the spatiotemporal coupling coding module 13 is used to perform single-modal feature extraction on the multimodal behavior preprocessing sequence, construct temporal dependency coding and cross-modal space association coding, and jointly map to generate a multimodal spatiotemporal coupling representation vector; the context-aware fusion module 14 is used to combine... The system combines business context parameters and historical risk state vectors to generate a contextual risk situation code. This contextual risk situation code interacts with the multimodal spatiotemporal coupled representation vector through attention interaction, generating dynamic fusion weight coefficients and weighted fusion to generate a context-aware risk fusion vector. The temporal state prediction module 15 is used to construct a risk state observation chain. Based on a hidden Markov model, it calculates the state transition probability matrix and state dwell time distribution parameters, and combines them with the context-aware risk fusion vector to predict the temporal enhanced risk state vector. The modality consistency test and adversarial robustness determination module 16 is used to perform modality consistency tests, generate adversarial robustness weight coefficients, and fuse the multimodal spatiotemporal coupled representation vector based on the adversarial robustness weight coefficients. It then jointly determines the risk classification result with the temporal enhanced risk state vector. The risk attribution and sampling strategy adjustment module 17 is used to generate a risk attribution distribution vector based on the risk classification result and the adversarial robustness weight coefficients, and adjust the sampling strategy of the behavioral data acquisition end based on the risk attribution distribution vector.

[0181] In this embodiment, the behavior data acquisition module 11 is deployed on the user terminal side, while the remaining modules are deployed on the server-side computing nodes. The modules sequentially transmit data via communication connections. The risk attribution and sampling strategy adjustment module 17 communicates bidirectionally with the behavior data acquisition module 11 to send back sampling strategy update instructions. During system operation, each module sequentially completes preprocessing, spatiotemporal coupling coding, context-aware fusion, temporal state prediction, modality consistency verification, and adversarial robustness assessment of multimodal behavior data. It outputs risk classification results and generates a risk attribution distribution vector to adjust the sampling strategy, thereby outputting stable, continuous, and interference-resistant risk classification results even when account behavior continuously evolves and some modalities may be forged.

[0182] By adopting the above technical solutions, this invention differs from existing technologies and has the following beneficial effects: It achieves standardized and unified multimodal behavioral data through temporal alignment, missing value imputation, and standardization of operational behavior data, equipment environment data, transaction behavior data, and biological behavior data; it obtains a multimodal spatiotemporal coupled representation vector that simultaneously carries the temporal evolution law of single modality and the intermodal correlation relationship based on the joint mapping of single-modal feature extraction and temporal dependency encoding based on gated loop structure and cross-modal spatial association encoding; and it uses the attention interaction between the context risk situation encoding generated by business context parameters and historical risk state vectors and the multimodal spatiotemporal coupled representation vector, enabling the dynamic fusion weight coefficients to adapt to the business scenario. A context-aware risk fusion vector should be generated and weighted. Based on the state transition probability matrix and state dwell time distribution parameters of the Hidden Markov Model, probabilistic extrapolation is performed on this context-aware risk fusion vector to obtain a smooth and continuous temporally enhanced risk state vector on the time axis. Modality consistency checks using cosine similarity and relative entropy distance are used to divide the abnormal modality subset into a normal modality subset, and the dynamic fusion weight coefficients are attenuated and enhanced respectively. This allows the adversarial robustness weight coefficients to automatically weaken their influence when some modalities are forged. The risk attribution distribution vector obtained from the risk classification results and the adversarial robustness weight coefficients is then used to adjust the sampling strategy at the behavioral data acquisition end, dynamically tilting detection resources towards risk-sensitive modalities. This technical solution enables stable, continuous, and interference-resistant risk classification results even when account behavior is constantly evolving and may be forged, and improves the utilization efficiency of data acquisition and computing resources.

[0183] Finally, it should be noted that although the above embodiments have been described in the text and drawings of this application, this should not limit the scope of patent protection of this application. Any technical solutions that are based on the essential concept of this application and utilize the content described in the text and drawings of this application, resulting in equivalent structural or procedural substitutions or modifications, as well as the direct or indirect application of the technical solutions of the above embodiments to other related technical fields, are all included within the scope of patent protection of this application.

Claims

1. A dynamic account risk classification method based on multimodal behavior fusion, characterized in that, include: The system acquires operational behavior data, device environment data, transaction behavior data, and biological behavior data of the target account. It performs time-series alignment, missing value imputation, and standardization on the multimodal behavior data to obtain a multimodal behavior preprocessing sequence. Single-modal feature extraction is performed on the multimodal behavior preprocessing sequence, and a temporal dependency code and a cross-modal spatial correlation code based on a gated loop structure are constructed. The joint mapping generates a multimodal spatiotemporal coupled representation vector. Obtain business context parameters, combine them with historical risk state vectors to generate context risk situation codes, enable context risk situation codes to interact with multimodal spatiotemporal coupled representation vector attention, generate dynamic fusion weight coefficients corresponding to each modality, and weighted fusion to generate context-aware risk fusion vectors. Obtain the risk classification result sequence of the target account within the historical time window, construct the risk status observation chain, calculate the state transition probability matrix and state residence duration distribution parameters based on the hidden Markov model, and combine the context-aware risk fusion vector prediction to obtain the time-series enhanced risk status vector. The cosine similarity and relative entropy distance of each modal subvector in the multimodal spatiotemporal coupling representation vector are calculated. The modality consistency test is performed to obtain the modality consistency score matrix. Abnormal modality subsets and normal modality subsets are divided. The dynamic fusion weight coefficients of abnormal modality subsets and normal modality subsets are attenuated and enhanced respectively to generate adversarial robust weight coefficients. The multimodal spatiotemporal coupling representation vector is fused according to the adversarial robust weight coefficients and jointly judged with the temporal enhanced risk state vector to output the risk classification result. Based on the risk classification results and the adversarial robustness weight coefficient, the attribution contribution of each modality is calculated, and a risk attribution distribution vector is generated. The sampling strategy of the behavioral data collection end is then adjusted accordingly.

2. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 1, characterized in that, Single-modal feature extraction is performed on the preprocessed multimodal behavior sequence. Temporal dependency coding and cross-modal spatial correlation coding based on a gated recurrent structure are constructed, and joint mapping is used to generate a multimodal spatiotemporally coupled representation vector, including: Statistical features of each modality are extracted from the multimodal behavior preprocessing sequence to obtain an initial behavior feature vector sequence; A gated loop structure containing update gates and reset gates is constructed for the initial behavior feature vector sequence. The initial behavior feature vector of the current time step and the hidden state vector of the previous time step are linearly transformed and activated by the update gate and reset gate to obtain the update gate control signal and the reset gate control signal. The reset gate control signal is used to filter the hidden state vector of the previous time step to generate candidate hidden states. The update gate control signal is used to weight and merge the hidden state vector of the previous time step and the candidate hidden states to obtain the temporal enhancement feature vector of the current time step. The temporal enhancement feature vector sequence is generated step by step. For any two modal temporal enhancement feature vectors, the dimensions of the first projection weight matrix and the second projection weight matrix are transformed. The outer product operation is performed on the transformation result to obtain the correlation response tensor. The correlation response tensor is aggregated by the aggregation weight vector channel to obtain the correlation response value. The modal correlation response matrix is ​​generated by traversing each modal pair. The intermodal correlation response matrix is ​​added to the modal autocorrelation diagonal matrix to obtain the cross-modal coupling feature matrix. The temporal enhanced feature vector sequence is linearly combined with the feature fusion weight matrix to obtain a temporal feature fusion vector. The cross-modal coupling feature matrix is ​​aggregated in the row and column directions of the correlation aggregation weight matrix to obtain a spatial correlation aggregation vector. The temporal feature fusion vector and the spatial correlation aggregation vector are concatenated and subjected to dimensional compression and semantic alignment by the joint mapping weight matrix to generate a multimodal spatiotemporal coupling representation vector.

3. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 1, characterized in that, Obtain business context parameters, combine them with historical risk state vectors to generate contextual risk posture codes, and enable attention interaction between the contextual risk posture codes and multimodal spatiotemporally coupled representation vectors to generate dynamic fusion weight coefficients corresponding to each modality. Weighted fusion is then used to generate a context-aware risk fusion vector, including: The business scenario type identifier in the business context parameters is transformed by the business scenario embedding matrix to obtain the business scenario embedding vector. The business attribute parameters in the business context parameters are concatenated into a business attribute numerical vector. The business attribute numerical vector is transformed by the attribute transformation weight matrix to obtain the business attribute embedding vector. The historical risk state vector, the business scenario embedding vector and the business attribute embedding vector are concatenated into a joint situation vector. The joint situation vector is transformed by the situation coding weight matrix nonlinearly to obtain the context risk situation code. The context risk situation encoding is linearly projected onto the query weight matrix to obtain the query vector. Each modal sub-vector in the multimodal spatiotemporal coupling representation vector is linearly projected onto the key weight matrix to obtain the key vector. The dot product similarity between the query vector and each key vector is calculated and converted into an initial value of attention weight through scaling and normalization exponential function. The initial value of attention weight is multiplied by the modal basic weight coefficient to obtain the dynamic fusion weight coefficient corresponding to each modality. Each modal subvector is multiplied element-wise with its corresponding dynamic fusion weight coefficient to obtain a weighted feature vector. Each weighted feature vector is added element-wise to obtain a weighted fusion vector. The weighted fusion vector is concatenated with the context risk situation code and subjected to nonlinear transformation and dimensional compression of the fusion coding weight matrix to generate a context-aware risk fusion vector.

4. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 1, characterized in that, Obtain the risk classification result sequence of the target account within a historical time window, construct a risk state observation chain, calculate the state transition probability matrix and state residence duration distribution parameters based on a hidden Markov model, and combine context-aware risk fusion vector prediction to obtain a time-series enhanced risk state vector, including: Obtain the risk classification results output by the target account in each risk assessment period within the historical time window, arrange them in chronological order to obtain a risk classification result sequence, and map each risk classification result in the risk classification result sequence to a status code to obtain a risk status observation chain. The state transition frequency matrix is ​​obtained by counting the number of transitions between adjacent states in the risk state observation chain. The state transition probability matrix is ​​obtained by dividing the transition frequency from each source state to each target state by the total number of times the source state appears. The number of consecutive occurrences of each risk state in the risk state observation chain is counted to obtain a residence time sample set. Based on the residence time sample set, the average residence time and variance of each risk state are calculated to obtain the state residence time distribution parameters. The context-aware risk fusion vector is linearly transformed and activated by the observation probability weight matrix to obtain the observation probability vector. Based on the risk state probability distribution of the previous time step, the state transition probability matrix and the observation probability vector, a forward recursive operation is performed to obtain the unnormalized state probability distribution. The unnormalized state probability distribution is corrected by time constraint based on the state dwell time distribution parameters, and the time-enhanced risk state vector is obtained by normalization operation.

5. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 4, characterized in that, Based on the state dwell time distribution parameters, the unnormalized state probability distribution is corrected for duration constraints, and a time-series enhanced risk state vector is obtained after normalization, including: Obtain the continuous dwell time of each risk state before the current time, where the continuous dwell time is the number of time steps that each risk state was continuously in the corresponding risk state before the current time. Based on the average dwell time and dwell time variance in the state dwell time distribution parameters, the upper bound of the dwell time corresponding to each risk state is determined, and the upper bound of the dwell time increases as the dwell time variance increases. Based on the average dwell time in the state dwell time distribution parameters, a lower bound for the dwell time corresponding to each risk state is determined, and the lower bound for the dwell time is a preset proportion of the average dwell time. The continuous dwell time of each risk state is compared with the corresponding upper and lower limits of dwell time. Risk states with a continuous dwell time exceeding the corresponding upper limit of dwell time are identified as over-dwelling states, and risk states with a continuous dwell time below the corresponding lower limit of dwell time are identified as under-dwelling states. For the risk state of the overstaying state, reduce the state probability value corresponding to the risk state in the unnormalized state probability distribution; For the risky state of insufficient residence, increase the probability weight of the risky state transitioning to other risky states; Normalize the modified unnormalized state probability distribution to obtain the time-series enhanced risk state vector.

6. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 1, characterized in that, The cosine similarity and relative entropy distance are calculated for each modal subvector in the multimodal spatiotemporal coupled representation vector. A modality consistency test is performed to obtain a modality consistency score matrix. Abnormal modality subsets and normal modality subsets are divided. The dynamic fusion weight coefficients of the abnormal and normal modality subsets are attenuated and enhanced respectively to generate adversarial robustness weight coefficients. The multimodal spatiotemporal coupled representation vector is fused based on these adversarial robustness weight coefficients and jointly judged with the temporal-enhanced risk state vector. The risk classification result is output, including: From the multimodal spatiotemporal coupling representation vector, the modal sub-vectors corresponding to each modality are separated. The cosine similarity of the two modal sub-vectors of any modality pair is calculated. The relative entropy distance is obtained by calculating the symmetric relative entropy after the two modal sub-vectors are subjected to distribution transformation. The cosine similarity and the scaled relative entropy distance are weighted and combined to obtain the consistency metric of the modality pair. The modality consistency score matrix is ​​generated by traversing all modality pairs. For each modality, the arithmetic mean of its consistency metric values ​​with the other modalities is calculated to obtain an average consistency score. Modalities with an average consistency score lower than a consistency threshold are classified into an abnormal modality subset, and modalities with an average consistency score not lower than the consistency threshold are classified into a normal modality subset. The dynamic fusion weight coefficients corresponding to each mode in the abnormal mode subset are multiplied by the attenuation coefficient, and the dynamic fusion weight coefficients corresponding to each mode in the normal mode subset are multiplied by the enhancement coefficient, and then normalized to obtain the anti-robust weight coefficients. Each modal subvector is weighted and fused with its corresponding adversarial robustness weight coefficient to obtain an adversarial robustness fusion vector. The adversarial robustness fusion vector is then concatenated with the temporal enhanced risk state vector to form a joint decision vector. The joint decision vector is then input into the risk classification decision network to output the risk classification result.

7. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 6, characterized in that, For any modality pair, calculate the cosine similarity between the two modal subvectors. After performing distribution transformations on each of the two modal subvectors, calculate the symmetric relative entropy to obtain the relative entropy distance. Weight the cosine similarity and the scaled relative entropy distance to obtain the consistency metric of the modality pair. Iterate through all modality pairs to generate a modality consistency score matrix, including: From the multimodal spatiotemporal coupling representation vector, the modal sub-vectors corresponding to each mode are separated, and each modal sub-vector corresponds to each behavior mode; For any two modal subvectors of a modality pair, the cosine similarity of the modality pair is obtained by dividing the dot product of the two modal subvectors by the product of their modal lengths. The dot product is the sum of the product of the corresponding elements of each dimension of the two modal subvectors, and the product of their modal lengths is the product of their respective modal lengths. The two modal subvectors are converted into probability distributions by a distribution transformation function, resulting in two probability distributions. The distribution transformation function converts the values ​​of each dimension of each modal subvector into non-negative probability values. Calculate the positive relative entropy and the negative relative entropy between two probability distributions, and use the sum of the positive relative entropy and the negative relative entropy as the relative entropy distance of the mode pair; The cosine similarity and the relative entropy distance scaled by a preset scaling factor are summed according to a preset weight to obtain the consistency metric of the mode pair. The consistency metric reflects both the degree of closeness of the mode pair in direction and the degree of difference in distribution pattern. Traverse all modality pairs and arrange the consistency metrics of each modality pair into a modality consistency score matrix.

8. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 6, characterized in that, Each modality sub-vector is weighted and fused with its corresponding adversarial robustness weight coefficient to obtain an adversarial robustness fused vector. This adversarial robustness fused vector is then concatenated with the temporal enhancement risk state vector to form a joint decision vector. This joint decision vector is input into a risk classification network, which outputs risk classification results, including: Each modality subvector is multiplied element-wise with its corresponding adversarial robustness weight coefficient to obtain the weighted subvector corresponding to each modality. The weighted sub-vectors corresponding to each modality are added element by element to obtain the adversarial robust fusion vector, which is the fusion representation of each modality sub-vector weighted by the adversarial robust weight coefficient. The adversarial robust fusion vector and the temporal enhanced risk state vector are concatenated in a preset dimensional order to obtain a joint decision vector. The joint decision vector carries both the spatial features after adversarial robust fusion and the temporal features of the historical risk state. The joint decision vector is input into the risk classification decision network, which contains multiple hidden layers and an output layer. Each hidden layer contains a preset number of neurons and uses a non-linear activation function. The joint decision vector is mapped to deep discriminative features by performing nonlinear activation transformation layer by layer through the multiple hidden layers. The output layer uses a normalized exponential activation function to output the probability value corresponding to each risk state. The output layer contains a number of neuron nodes equal to the number of risk states, and the neuron nodes of the output layer correspond one-to-one with each risk state. The risk state with the highest probability value among all risk states is determined as the risk classification result.

9. The method for dynamic account risk classification based on multimodal behavior fusion according to claim 1, characterized in that, Based on the risk classification results and adversarial robustness weighting coefficients, the attribution contribution of each modality is calculated, and a risk attribution distribution vector is generated. The sampling strategy at the behavioral data collection end is then adjusted accordingly, including: For each modality, the adversarial robustness weight coefficient corresponding to the modality is multiplied by the decision confidence corresponding to the risk classification result to obtain the risk contribution benchmark value. The modality subvector is projected onto the neuron weight vector corresponding to the risk classification result in the risk classification decision network to obtain the projection similarity. The risk contribution benchmark value and the projection similarity are weighted and combined to obtain the attribution contribution of the modality. The attribution contribution of each modality is concatenated to form a risk attribution distribution vector, where each dimension of the risk attribution distribution vector corresponds to the attribution contribution of each modality. The values ​​of each dimension in the risk attribution distribution vector are compared with the attribution threshold. Dimensions with values ​​higher than the attribution threshold are identified as high-risk contribution dimensions, and dimensions with values ​​lower than the attribution threshold are identified as low-risk contribution dimensions. For the modalities corresponding to the high-risk contribution dimension, the sampling frequency is increased, the sampling time window is extended, and the feature extraction granularity is refined. For the modalities corresponding to the low-risk contribution dimension, the sampling frequency is decreased, the sampling time window is shortened, and the feature extraction granularity is coarsened. The updated sampling frequency, sampling time window length, and feature extraction granularity are encapsulated into a sampling strategy update instruction and sent to the behavior data collection terminal, so that subsequent risk assessment cycles will perform data collection according to the updated sampling strategy.

10. A dynamic account risk classification system based on multimodal behavior fusion, characterized in that, The system for performing the method according to any one of claims 1 to 9, the system comprising: The behavioral data acquisition module is used to collect operational behavior data, device environment data, transaction behavior data, and biometric behavior data of the target account. The data preprocessing module is used to perform temporal alignment, missing value imputation, and standardization on the multimodal behavior data to obtain a multimodal behavior preprocessing sequence; The spatiotemporal coupling coding module is used to perform single-modal feature extraction on the multimodal behavior preprocessing sequence, construct temporal dependency coding and cross-modal spatial correlation coding, and jointly map to generate multimodal spatiotemporal coupling representation vectors; The context-aware fusion module is used to combine business context parameters and historical risk state vectors to generate context risk situation codes, and to enable the context risk situation codes to interact with the multimodal spatiotemporal coupled representation vector attention to generate dynamic fusion weight coefficients and weighted fusion to generate a context-aware risk fusion vector. The temporal state prediction module is used to construct a risk state observation chain, calculate the state transition probability matrix and state dwell time distribution parameters based on the hidden Markov model, and predict the temporal enhanced risk state vector by combining the context-aware risk fusion vector. The modal consistency test and adversarial robustness determination module is used to perform modal consistency test, generate adversarial robustness weight coefficients, fuse the multimodal spatiotemporal coupling representation vector with the adversarial robustness weight coefficients, and jointly determine the risk classification result with the temporal enhanced risk state vector. The risk attribution and sampling strategy adjustment module is used to generate a risk attribution distribution vector based on the risk classification results and the adversarial robustness weight coefficients, and adjust the sampling strategy of the behavioral data acquisition end according to the risk attribution distribution vector.

Images