Risk analysis method, device, processing equipment, program product and storage medium

Abstract

Embodiments of the present application provide a risk analysis method and device, processing equipment, program product and storage medium, which are applied to the technical field of deep learning. The method comprises: obtaining user behavior sequence data of a target user in at least one first time window; extracting at least one behavior feature information of the target user through a target sequence pattern mining algorithm according to the user behavior sequence data; inputting the at least one behavior feature information into a target model to obtain time sequence feature information of the target user output by the target model, the target model being a model constructed based on a stacked bidirectional long short-term memory (LSTM) model combined with a time-aware attention mechanism, and the time sequence feature information being used to reflect time dependence and dynamic change trend of user behavior; and obtaining a risk assessment result for the target user based on the at least one behavior feature information and the time sequence feature information. By using the method, the problem of lag and low precision in risk identification in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of deep learning technology, specifically to a risk analysis method, apparatus, processing equipment, program product, and storage medium. Background Technology

[0002] Financial user behavior sequence risk analysis is a method for assessing the potential risks posed by user behavior patterns in financial products or services. It identifies anomalous behavior, fraud, or credit risk by mining time-series data of user actions, and combines data mining, machine learning, and statistical techniques to reveal the risk characteristics behind user behavior. Its value lies in its ability to help financial institutions intervene promptly, prevent the spread of risk, improve risk control efficiency, ensure financial market stability, and optimize user experience by monitoring user behavior sequences.

[0003] However, existing methods typically rely on static feature engineering, which makes it difficult to effectively capture the dynamic evolution of behavioral patterns, resulting in a lag in the identification of hidden risks across cycles and platforms. Moreover, traditional time series models are prone to missing important signals and having low early warning sensitivity due to insufficient high-dimensional sparse data processing capabilities and a lack of focusing mechanisms on key risk nodes. Summary of the Invention

[0004] The purpose of this application is to provide a risk analysis method, apparatus, processing equipment, program product, and storage medium to solve the problems of lag and low accuracy in risk identification in the prior art.

[0005] One embodiment of this application provides a risk analysis method, including: Acquire user behavior sequence data of the target user within at least one first time window; Based on the user behavior sequence data, at least one behavioral feature information of the target user is extracted using a target sequence pattern mining algorithm. The behavioral feature information is used to reflect the statistical regularity of historical user behavior. At least one of the behavioral feature information is input into the target model to obtain the temporal feature information of the target user output by the target model. The target model is a model constructed based on a stacked bidirectional long short-term memory (LSTM) network combined with a time-aware attention mechanism. The temporal feature information is used to reflect the time dependence and dynamic change trend of user behavior. Based on at least one of the behavioral feature information and the temporal feature information, a risk probability assessment is performed to obtain a risk assessment result for the target user.

[0006] Optionally, the behavioral feature information includes user behavior sequence pattern feature information; The step of extracting at least one behavioral feature information of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm includes: Based on the user behavior sequence data, at least one frequent pattern of the target user is extracted using a target sequence pattern mining algorithm. The frequent pattern is a user behavior pattern with a support greater than or equal to a threshold. The user behavior pattern includes at least two consecutive user behaviors of the target user on the time axis. Based on the at least one frequent pattern, a pattern transition matrix is ​​generated, wherein the elements in the pattern transition matrix are used to represent the transition probabilities between different frequent patterns; Based on the pattern transition matrix, the pattern entropy value of the target user is calculated, and the pattern entropy value is used to reflect the stability of the user behavior pattern of the target user; Based on the at least one frequent pattern, determine the pattern weight of each user behavior pattern of the target user; Based on the pattern entropy value and the pattern weight, user behavior sequence pattern feature information of the target user is generated. The user behavior sequence pattern feature information is used to reflect the statistical regularity and risk characteristics of the target user's user behavior pattern.

[0007] Optionally, the step of extracting at least one frequent pattern of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm includes: The user behavior sequence data is divided into at least one sub-sequence data according to a second time window of a preset length; Encode the at least one subsequence data to obtain the behavior sequence vector of the target user; Based on the behavioral sequence vector, at least one frequent pattern of the target user is determined by a target sequence pattern mining algorithm.

[0008] Optionally, the step of performing risk probability assessment based on at least one of the behavioral feature information and the temporal feature information to obtain a risk assessment result for the target user includes: The basic credit score of the target user is determined based on at least one of the behavioral feature information; The delinquency probability of the target user is determined based on at least one of the behavioral feature information and the temporal feature information; Based on graph neural networks, the group fraud risk of the target users is assessed to obtain a group fraud risk value; The risk assessment result for the target user is determined based on the basic credit score, expected probability, and group fraud risk value. The behavioral characteristic information includes at least one of the following: transaction frequency characteristic information, transaction amount characteristic information, repayment on-time rate characteristic information, consumption type diversity characteristic information, and user behavior sequence pattern characteristic information.

[0009] Optionally, the stacked bidirectional LSTM model includes multiple hidden layers stacked sequentially, wherein the hidden layers employ a peephole connection mechanism, and a time decay factor is embedded in the calculation of the hidden states of the hidden layers.

[0010] Optionally, before acquiring user behavior sequence data of the target user within at least one first time window, the method further includes: Construct a user behavior dataset, which includes user behavior sequence data of at least one user; The construction of the user behavior dataset includes: Collect multidimensional behavioral data of at least one user; The multidimensional behavioral data is anonymized to obtain the first behavioral data; The first behavioral data is cleaned and standardized to obtain the user behavior dataset.

[0011] One embodiment of this application also provides a risk analysis device, the device comprising: The first acquisition module is used to acquire user behavior sequence data of the target user within at least one first time window; The first processing module is used to extract at least one behavioral feature information of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm. The behavioral feature information is used to reflect the statistical regularity of historical user behavior. The second processing module is used to input at least one of the behavioral feature information into the target model to obtain the temporal feature information of the target user output by the target model. The target model is a model constructed based on a stacked bidirectional long short-term memory network (LSTM) combined with a time-aware attention mechanism. The temporal feature information is used to reflect the time dependence and dynamic change trend of user behavior. The risk assessment module is used to perform risk probability assessment based on at least one of the behavioral feature information and the temporal feature information, and obtain risk assessment results for the target user.

[0012] One embodiment of this application also provides a processing device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the risk analysis method as described in any of the preceding claims.

[0013] One embodiment of this application also provides a computer program product, including computer instructions that, when executed by a processor, implement the steps of the risk analysis method as described in any of the preceding claims.

[0014] One embodiment of this application also provides a readable storage medium, wherein a program is stored on the readable storage medium, and when the program is executed by a processor, it implements the steps in the risk analysis method as described in any of the preceding claims.

[0015] At least one of the above-mentioned technical solutions of this application has the following beneficial effects: In the risk analysis method of this application embodiment, by introducing a stacked bidirectional LSTM model, it is possible to deeply mine user behavior sequences, learn user historical behavior patterns, and capture the dynamic change trend of user current behavior, effectively enhancing the target model's ability to identify the evolution of user behavior patterns and improving the timeliness and accuracy of risk warnings. Moreover, by combining a time-aware attention mechanism, more weight can be given to key time steps, enabling the target model to focus on high-risk behavior moments, avoiding interference from redundant information, and improving the accuracy of risk identification. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating the risk analysis method according to one embodiment of this application; Figure 2 This is a schematic diagram of the structure of a risk analysis device according to one embodiment of this application. Detailed Implementation

[0017] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such terms can be used interchangeably where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first" and "second" are generally of the same class, and the number of objects is not limited; for example, the first object can be one or more.

[0018] In various embodiments of the present invention, it should be understood that the sequence number of each process described below does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0019] In the embodiments of this application, the term "and / or" describes the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. The character " / " generally indicates that the preceding and following associated objects have an "or" relationship.

[0020] It should be understood that "B corresponding to A" means that B is associated with A, and B can be determined based on A. However, it should also be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0021] In the embodiments of this application, the term "multiple" refers to two or more, and other quantifiers are similar.

[0022] In addition, the terms "system" and "network" are often used interchangeably in this article.

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0024] This application addresses the problems of lag and low accuracy in risk identification in existing technologies by providing a risk analysis method, apparatus, processing equipment, program product, and storage medium.

[0025] like Figure 1 As shown, one embodiment of this application provides a risk analysis method, including: Step 101: Obtain user behavior sequence data of the target user within at least one first time window.

[0026] In some embodiments, before acquiring user behavior sequence data of the target user within at least one first time window, the method further includes: constructing a user behavior dataset, the user behavior dataset including user behavior sequence data of at least one user.

[0027] It should be noted that the user behavior sequence data in step 101 is the full behavior data of a single user (such as a target user) obtained from the user behavior dataset. This user behavior sequence data includes the user's original transaction records, derived fields (such as transaction intervals), and statistical fields (such as the median transaction amount over 7 days), and is a collection of time-series behavioral data for an individual user.

[0028] Step 102: Based on the user behavior sequence data, extract at least one behavioral feature information of the target user using a target sequence pattern mining algorithm. The behavioral feature information is used to reflect the statistical regularity of historical user behavior.

[0029] Here, behavioral feature information can be obtained by extracting features from user behavior sequence data.

[0030] Step 103: Input at least one of the behavioral feature information into the target model to obtain the temporal feature information of the target user output by the target model. The target model is a model constructed based on a stacked bidirectional long short-term memory network (LSTM) combined with a time-aware attention mechanism. The temporal feature information is used to reflect the time dependence and dynamic change trend of user behavior.

[0031] In this step, a stacked bidirectional long short-term memory (LSTM) network model can be used to model user behavior sequences in order to capture the temporal dependence of user behavior.

[0032] It should be noted that after bidirectional LSTM modeling, a global temporal feature vector of the user behavior sequence (or a comprehensive feature representation integrating hidden states at multiple time steps) can be output. This feature vector captures the long-term temporal dependence and dynamic evolution of user behavior, providing core temporal feature support for the subsequent construction of a risk assessment indicator system.

[0033] Step 104: Based on at least one of the behavioral feature information and the temporal feature information, perform a risk probability assessment to obtain a risk assessment result for the target user.

[0034] In this embodiment, by introducing a stacked bidirectional LSTM model, it is possible to deeply mine user behavior sequences, learn historical user behavior patterns, and capture the dynamic changing trends of current user behavior. This effectively enhances the target model's ability to identify the evolution of user behavior patterns and improves the timeliness and accuracy of risk warnings. Moreover, by combining a time-aware attention mechanism, more weight can be assigned to key time steps, enabling the target model to focus on high-risk behavior moments, avoiding interference from redundant information, and improving the accuracy of risk identification.

[0035] In some specific embodiments, constructing the user behavior dataset includes the following steps: (a) Collect multidimensional behavioral data of the at least one user.

[0036] Here, data such as basic information, transaction behavior, repayment behavior, and consumption habits of consumer finance users can be collected to construct a user behavior dataset. Specifically, data collection needs to comprehensively cover multiple user information sources. In addition to basic identity information, transaction records, and repayment records, it can also integrate user consumption preference data from third-party platforms, device fingerprint information, geographic location trajectory, and social network association information. For example, it can connect to the internal systems of financial institutions, payment platforms, and e-commerce platforms in real time through API interfaces, while simultaneously importing historical offline data in batches to ensure the integrity and timeliness of the data source.

[0037] It should be noted that the data collection period needs to cover the user's entire lifecycle behavior, from registration, first loan, re-loan to settlement, with the smallest granularity recording down to the millisecond-level transaction timestamp, to provide a high-precision foundation for subsequent time series modeling.

[0038] (ii) The multidimensional behavioral data is anonymized to obtain the first behavioral data.

[0039] For example, a dynamic hierarchical desensitization framework based on attribute encryption can be used to process sensitive information (such as ID card numbers and bank card numbers) in multidimensional behavioral data, and SSL encryption protocol can be used to ensure data security during transmission.

[0040] For example, the specific implementation process of this desensitization process is as follows: First, classify the sensitivity of fields. For example, establish a multi-dimensional sensitivity assessment system and construct a third-order sensitivity matrix S that includes field type, business scenario, and privacy weight attributes, i.e., S = (field type, business scenario, privacy weight). In this way, the sensitivity of different data fields can be quantified and the risk level can be classified.

[0041] Secondly, perform real-time policy matching. Design a dynamic policy engine (DSE), for example, DSE = (S × user role × access channel) → desensitization method. In this way, the third-order sensitivity matrix S can be logically combined with multi-dimensional parameters such as user role identifier and access channel information. Furthermore, based on the calculation results, a targeted desensitization processing scheme can be generated and mapped from a preset policy library.

[0042] Here, user roles refer to business participants with different permissions within a financial institution, such as: Risk control auditors: need to review users' complete transaction records for risk verification, with a relatively low level of anonymization; Customer service personnel: Only anonymized user information (such as a phone number with the middle part hidden) is required for business inquiries; Data analysts are required to encrypt sensitive user fields (such as ID card numbers) before performing batch statistical analysis. System administrators can access raw data but must pass multi-factor authentication; the data anonymization strategy is adapted to scenarios with the highest privileges.

[0043] Finally, specific security protection operations are performed on the data through a reversible processing layer. For example, for identity-related fields, the highly secure AES-GCM encryption algorithm is used for encryption protection; for transaction amount-related fields, differential privacy technology can be used to add perturbation terms to meet the privacy and usability requirements during data use.

[0044] (iii) Perform data cleaning and standardization on the first behavior data to obtain the user behavior dataset.

[0045] Here, data preprocessing (including data cleaning and standardization) is required to ensure the quality of the user behavior dataset.

[0046] For example, the data cleaning process includes at least one of the following operations: (1) Based on business logic, remove abnormal data.

[0047] For example, abnormal records such as a single transaction amount exceeding 200% of the credit limit or more than 10 repayments in a single day are identified as abnormal data that do not conform to business logic and can be removed.

[0048] (2) Identify data items that deviate from the normal distribution, that is, identify outliers.

[0049] It should be noted that the identified outliers can serve as risk warning signals. For example, outliers such as "more than 10 repayments in a single day" can enhance the identification of fraudulent behaviors such as "frequent small repayments to cover up overdue payments".

[0050] As an alternative example, outliers can be identified based on statistical models, including the Isolation Forest algorithm and Mahalanobis distance correction. Specifically, the Isolation Forest algorithm can be used to detect outliers in non-Gaussian distributed data, and then Mahalanobis distance can be introduced to correct the outlier scores, thereby more accurately identifying outliers in user behavior.

[0051] The weighted path depth detection process designed for non-Gaussian distributions is as follows: 1) Perform non-Gaussian feature transformation: Perform Box-Cox transformation on the skewed field, and estimate the fitted distribution parameter λ through kernel density to transform the original non-normal data into an approximate normal distribution, thereby eliminating the influence of data skewness on the statistical model.

[0052] For example, embodiments of the present invention can perform Box-Cox transformation on non-Gaussian distributed behavioral data (such as daily transaction frequency) to correct data distribution and eliminate skewness.

[0053] 2) The subsample size can be adjusted based on the kurtosis of the data distribution to achieve dynamic subsampling. For example, the sampling size can be increased when the kurtosis is high to ensure the sensitivity of anomaly detection. An exemplary expression for adjusting the subsample size based on the kurtosis k of the data distribution is: m = ×256 , where m is the subsample size and k is the kurtosis of the data distribution.

[0054] 3) Perform anomaly confidence calculation: In the risk analysis of consumer finance user behavior, the anomaly confidence calculation uses Mahalanobis distance to correct the anomaly score output by the isolated forest algorithm, so as to more accurately identify outliers in user behavior.

[0055] For example, the specific process of introducing Mahalanobis distance to correct outlier scores is as follows: First, the original outlier scores of the samples are obtained by traversing the sample path length using the Isolation Forest algorithm; then, based on the data covariance matrix after Box-Cox transformation... Σ Using formula DM = First, calculate the Mahalanobis distance of the samples. Finally, weightedly fuse the original outlier scores with the Mahalanobis distances to generate corrected outlier scores. The formula for this calculation is: Corrected score = α Raw fraction + (1 α ) DM. Wherein, the coefficient α It can be dynamically adjusted according to business scenarios (such as setting it in high-risk scenarios). α =0.3 (emphasizing statistical distance) to strengthen the weight of statistical distance in the evaluation, thereby filtering out misjudgments caused by differences in data units. Here, μ is the mean vector of the sample, representing the average value of the behavioral data across all dimensions; x represents the feature vector of the current sample, such as the transaction behavior characteristics of a user at a certain point in time.

[0056] Here, outliers can be identified by comparing the corrected anomaly score with a threshold. That is, the corrected score of user behavior (such as the anomaly score of the number of repayments in a single day) is compared with a preset threshold (such as an industry experience value or a critical value obtained from model training). The higher the score, the higher the degree of anomaly. When the score exceeds the threshold, it is marked as an outlier.

[0057] The above steps effectively address the limitations of traditional Euclidean distance-based algorithms when processing multidimensional data. For example, in response to the abnormal behavior of users making more than 10 repayments in a single day (often used as a covert fraudulent tactic to conceal overdue payments with frequent small repayments), this method enhances the ability to identify covert fraudulent operations through a modified score, thereby avoiding misjudgments caused by dimensional interference in traditional Euclidean distance.

[0058] (3) Fill in missing values.

[0059] Here, we exemplarily provide a differentiated data imputation strategy for missing data to improve the accuracy and adaptability of data imputation in different scenarios. Specific details are as follows: First, for numerical fields, time series interpolation is used to complete the feature data.

[0060] Here, in the context of consumer finance user behavior data, to address the issue of missing transaction timestamps or lost transaction amount records due to network transmission failures, equipment failures, or other reasons (such as some POS machines losing records due to network outages), intelligent interpolation can be performed based on a hybrid model of Autoregressive Integrated Moving Average (ARIMA) and Gated Recurrent Unit (GRU).

[0061] The specific implementation logic is as follows: Data preprocessing and stationarity test: The data is preprocessed, and missing positions are forcibly marked as NaN values. The difference order d is determined by the ADF test to eliminate non-stationarity (e.g., user monthly transaction amount series), laying the foundation for subsequent linear modeling.

[0062] ARIMA linear modeling: The Bayesian Information Criterion (BIC) is used to optimize the model parameters, comprehensively considering the autoregressive term, difference order, and moving average term, to select the optimal ARIMA from the predefined parameter space. p,d,q The parameters are used to perform linear trend prediction on the location of missing values ​​using this model, and to obtain preliminary fitted prediction values.

[0063] It should be noted that the input to ARIMA is preprocessed user behavior time series data, such as user monthly transaction amount series, repayment record series, etc.; the difference order d needs to be determined first through the ADF test to eliminate non-stationarity before it is input into the ARIMA model to predict the linear trend of missing points.

[0064] GRU Residual Learning: The ARIMA prediction residuals are input into the GRU network, which utilizes its powerful ability to capture nonlinear time series features to capture nonlinear time series patterns such as transaction surges and abnormal peaks during promotional activities, and corrects the linear prediction results.

[0065] Hybrid output: The final interpolation result is generated by summing the linear trend value predicted by ARIMA with the residual value corrected by the GRU network. That is, final interpolation = ARIMA predicted value + GRU residual correction value.

[0066] It should be noted that by filling in missing values, missing values ​​in a user's repayment records can be filled in (such as missing repayment data for a certain month), ensuring the continuity of subsequent behavior sequence modeling. For example, if a user suddenly experiences missing data after making normal repayments for three consecutive months, interpolation can be used to reconstruct the actual repayment behavior, avoiding misjudgment as credit deterioration.

[0067] (4) Data deduplication.

[0068] Furthermore, the standardization process described above includes: performing a logarithmic transformation on monetary features to eliminate dimensional differences; performing a Fourier transform on periodic behavioral data to extract time-series features; and other operations to standardize the data. After standardization, a three-tiered structured user behavior dataset containing original fields, derived fields, and statistical fields can be obtained.

[0069] The raw fields refer to the directly collected original user behavior data, which is the foundation for all subsequent analysis. This includes information such as the specific time of the transaction, the amount of each transaction, the merchant category corresponding to the consumption, and the actual repayment date of the user. This data is unprocessed and retains the original state at the time the behavior occurred.

[0070] Derived fields are composite fields calculated from the original fields to reflect user behavioral characteristics in greater depth. For example, the repayment delay rate can be obtained by dividing the difference between the actual repayment date and the due date by the cycle length; the nighttime transaction rate can be obtained by calculating the proportion of nighttime transactions to the total number of transactions; and the transaction interval can be obtained by calculating the time difference between two adjacent transactions. These fields can uncover behavioral patterns behind the raw data from different dimensions.

[0071] Statistical fields are aggregated fields obtained after statistical analysis of raw data, typically calculated based on a specific time window or group dimension. For example, the Hodges-Lehmann median of transaction amount within a 7-day time window, the Gini-Simpson index to measure user spending diversity, and the monthly repayment on-time rate to calculate the proportion of on-time repayments to total repayments within a month—these fields can intuitively reflect the overall trend and characteristic distribution of user behavior.

[0072] In some embodiments, the behavioral feature information includes user behavior sequence pattern feature information.

[0073] It should be noted that behavioral feature information such as transaction frequency features, transaction amount features, repayment on-time rate features, consumption type diversity features, and user behavior sequence pattern features can be extracted from user behavior datasets.

[0074] For example, a dynamic structure learning network can be constructed first. The system uses the BDeu (Bayesian Dirichlet equivalent uniform) scoring function to optimize the graph structure and introduces domain knowledge constraints. Prior edge constraints are explicitly set. For example, the prior edge E_prior={(occupation, consumption type),(age, merchant category)} is set, which establishes the relationship between "occupation-consumption type" and "age-merchant category" to enhance the physical interpretability and rationality of the model structure.

[0075] Here, graph structure optimization can improve feature quality. Specifically, BDeu scoring is used to optimize the graph structure, automatically learning the probabilistic dependencies between features, which can more accurately capture the inherent patterns of user behavior (such as the influence of occupation on consumption type). Domain knowledge constraints can reduce invalid features. Specifically, by pre-setting prior edges E_prior={(occupation, consumption type),(age, merchant category)}, business logic from the financial risk control domain is introduced (such as "white-collar occupations correspond to high-frequency office consumption" and "young users prefer catering and entertainment merchants"), which can avoid the model learning irrelevant feature associations and reduce the complexity of the feature space.

[0076] It should be noted that feature relationship modeling based on domain knowledge can make subsequent risk assessment results more consistent with business logic, making it easier for risk control experts to understand and implement, and enhancing the interpretability of the model; it also reduces redundant features and invalid calculations, speeds up feature engineering and model training, and improves the accuracy of risk identification and model efficiency.

[0077] Subsequently, systematic multidimensional feature engineering and sequence pattern mining are performed, as illustrated in the following example: a) Transaction frequency characteristics: The sliding window counting method is adopted, with window lengths τ = 7d / 30d / 90d (three levels). That is, for transaction data, the sliding window counting method is first used to extract transaction frequency characteristics, with window spans set to three standards: 7 days, 30 days, and 90 days.

[0078] b) Amount statistics: Amount statistics are calculated by estimating the Hodges-Lehmann median of the transaction amounts within the window; c) On-time rate characteristic: Define repayment delay rate δ = (actual date - due date) / cycle length; d) Consumption diversity: Consumption diversity is calculated using the Gini-Simpson index based on merchant category.

[0079] e) Sequence pattern features: This refers to in-depth mining of sequence patterns. The following focuses on the specific process of obtaining user behavior sequence pattern feature information.

[0080] In some embodiments, step 102 above, namely, extracting at least one behavioral feature information of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm, includes: Step 1021: Based on the user behavior sequence data, extract at least one frequent pattern of the target user using a target sequence pattern mining algorithm. The frequent pattern is a user behavior pattern with a support greater than or equal to a threshold. The user behavior pattern includes at least two consecutive user behaviors of the target user on the time axis.

[0081] Here, user behavior refers to various interactive data generated by users in the process of using financial products or services, such as repayment (early / overdue), transfer (outward), payment, top-up, withdrawal, buying, selling, order cancellation, etc.

[0082] Here, the PrefixSpan algorithm can be used to mine frequent patterns in user behavior sequences, with a support threshold θ=0.05. In other words, the support threshold θ=0.05 is the standard for determining a "frequent pattern": when the support s (i.e., the proportion of the pattern appearing in the user behavior sequence) of a certain behavior pattern is ≥0.05, the behavior pattern will be identified as a "frequent pattern". Here, support reflects the prevalence of a pattern in group or individual behavior; exceeding the threshold means that the pattern is statistically significant and needs to be included in subsequent risk analysis.

[0083] In some specific embodiments, step 1021, namely, extracting at least one frequent pattern of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm, includes: (1) Divide the user behavior sequence data into at least one sub-sequence data according to a second time window of a preset length.

[0084] Here, by dividing the user behavior sequence into subsequence data of fixed-length time windows, for example, the subsequence data of each window contains the user's most recent N transaction behaviors.

[0085] (2) Encode the at least one subsequence data to obtain the behavior sequence vector of the target user.

[0086] Here, one-hot encoding or multi-dimensional feature representation can be used to encode the behavior pattern within each time window, forming a behavior sequence vector.

[0087] (3) Based on the behavior sequence vector, determine at least one frequent pattern of the target user (that is, a frequent pattern in the user behavior sequence) through the target sequence pattern mining algorithm.

[0088] Here, a target sequence pattern mining algorithm (an improved sequence pattern mining algorithm that introduces an adjustment factor) can be used. α To enhance the feature weights for sparse patterns, frequent patterns are extracted from user behavior sequences. The specific process is as follows: Let the support be s, the user behavior sequence be X (i.e., the behavior sequence vector), and the frequent pattern be P. Then the formula for calculating the support of the frequent pattern P can be expressed as: ; Among them, | | is the number of subsequences containing frequent pattern P in user behavior sequence X, and |X| is the total number of subsequences in user behavior sequence X. α It is an adjustment factor used to enhance the effect of sparse patterns.

[0089] As mentioned above, when the support score s ≥ 0.05 for a behavioral pattern, the behavioral pattern will be identified as a "frequent pattern".

[0090] In the above steps, an improved sequence pattern mining algorithm is used. For user behavior sequence X and frequent pattern P, an adjustment factor α is introduced to optimize the support calculation formula, thereby enhancing the statistical significance of sparse patterns.

[0091] It should be noted that the support of the traditional PrefixSpan algorithm is usually the ratio of the number of subsequences containing pattern P |XP| to the total number of subsequences |X| (i.e., s = |XP| / |X|), while the support in this embodiment of the invention introduces an adjustment factor. α The impact of sparse patterns is enhanced through weighted calculations. Specifically, when pattern P belongs to a low-frequency but high-risk sparse pattern, α This will increase the weight of its support calculation, preventing it from being mistakenly filtered out due to its low original proportion. In this way, it can effectively capture hidden fraud patterns such as "frequent small repayments to cover up overdue payments", making up for the blind spots of traditional algorithms in recognizing sparse risk patterns.

[0092] Step 1022: Generate a pattern transition matrix based on the at least one frequent pattern, wherein the elements in the pattern transition matrix are used to represent the transition probabilities between different frequent patterns.

[0093] It should be noted that in step 1021, the PrefixSpan algorithm was used to mine K types of frequent patterns (such as "repayment → large consumption → transfer", "small amount multiple repayments", etc.). In step 1022, a pattern transition matrix M can be constructed based on these K types of frequent patterns. The pattern transition matrix M is used to represent the transition probability between different patterns (such as the frequency of occurrence from pattern i to pattern j), which is a quantification of the dynamic relationship between frequent patterns.

[0094] Here, the constructed mode transition matrix can be represented as: M∈ R represents the set of real numbers, that is, the elements in matrix M are real numbers between 0 and 1 (transition probabilities or frequencies), the matrix dimension is K×K, and K is the number of categories of frequent patterns.

[0095] Step 1023: Calculate the pattern entropy value of the target user based on the pattern transition matrix. The pattern entropy value is used to reflect the stability of the user behavior pattern of the target user.

[0096] Here, the mode entropy value H can be calculated as H=- As a feature description.

[0097] It should be noted that the pattern entropy value H is a core component of the sequence pattern feature and is a quantitative indicator of the randomness and complexity of user behavior patterns. For each user's independent behavior sequence, a unique pattern transition matrix M can be constructed, and a unique pattern entropy value H can be calculated. Therefore, each user can obtain a personalized sequence pattern feature, which can reflect the stability of the user's behavior pattern (the higher the entropy value, the more random the behavior pattern and the higher the risk of anomalies).

[0098] Step 1024: Determine the pattern weight of each user behavior pattern of the target user based on the at least one frequent pattern.

[0099] Here, the pattern feature weights for each pattern can be calculated based on the statistical characteristics of frequent patterns. (That is, the above-mentioned pattern weight), which reflects its importance in risk assessment.

[0100] For example, the formula for calculating pattern feature weights is: ; Here, IDF(P) is the inverse document frequency of frequent patterns P, used to measure the rarity of patterns.

[0101] It should be noted that once the pattern feature weights are calculated, they can be used in the construction of risk assessment indicator systems and the training of deep learning models. In the risk assessment indicator system, the pattern feature weights serve as a quantitative basis for feature importance. For example, assigning higher weights to high-risk patterns such as "small, multiple repayments → transfers" directly affects the calculation results of credit scores and fraud probabilities. During the training of models such as LSTM and XGBoost, the weights are used as weighting coefficients for the features, allowing the model to automatically focus on behavioral patterns with a greater impact on risk.

[0102] Here, risk value is differentiated by weighting patterns to avoid indiscriminate treatment of all behavioral patterns, improve the sensitivity of identifying abnormal behaviors such as covert fraud and gradual credit deterioration, and accurately identify risks; low-risk routine patterns (such as "salary deposit → daily consumption") are assigned low weights to reduce the probability of normal behavior being mislabeled as risk; combined with Shapley value attribution analysis, the weights can be dynamically adjusted with risk trends, making the model more adaptable to market changes and new fraud methods.

[0103] Step 1025: Generate user behavior sequence pattern feature information of the target user based on the pattern entropy value and the pattern weight. The user behavior sequence pattern feature information is used to reflect the statistical regularity and risk characteristics of the user behavior pattern of the target user.

[0104] It's important to note that feature engineering outputs structured feature vectors / feature datasets containing multi-dimensional features, essentially behavioral feature information. For example, the 32-dimensional feature vectors received by the LSTM input layer include transaction type, amount, and merchant category. These feature vectors integrate various features such as transaction frequency, amount statistics, repayment on-time rate, consumption diversity, and sequence patterns, providing a foundation for subsequent LSTM modeling and the construction of risk assessment indicator systems. Furthermore, inputting these feature vectors into a stacked bidirectional LSTM network can capture the temporal dependence of user behavior (such as changes in transaction intervals and evolution of repayment patterns).

[0105] In some embodiments, the stacked bidirectional LSTM model includes multiple hidden layers stacked sequentially, wherein the hidden layers employ a peephole connection mechanism and embed a time decay factor in the calculation of the hidden states of the hidden layers.

[0106] Here, the model's ability to remember key time points can be enhanced through the Peephole connection mechanism, and the decay rate of historical information can be controlled by embedding a time decay factor.

[0107] It should be noted that each time step of the stacked bidirectional LSTM outputs a hidden state vector, which contains the temporal characteristics of the user's behavior at that time step (such as the association pattern between the current transaction and historical / future transactions).

[0108] For example, in this embodiment of the invention, a stacked bidirectional LSTM network architecture can be constructed. Its input layer receives behavioral sequences sliced ​​through time windows, with each time step input containing a 32-dimensional feature vector including transaction type, amount, and merchant category. The network's hidden layers are designed as a four-layer structure, with each layer containing 256 neurons. Specifically, peephole connections (gate connections) are introduced into the LSTM units to enhance the network's ability to remember key time points (such as abnormal behavior before the repayment date).

[0109] Here, the 32-dimensional feature vector is the result of multi-source feature integration and standardization. The specific generation logic includes: (1) Basic field encoding, for example: perform one-hot encoding or embedded encoding on the original fields (such as transaction type, merchant category) to convert categorical data into numerical vectors; standardize numerical fields such as amount and time interval (such as logarithmic transformation, normalization).

[0110] (2) Behavioral features extracted by feature engineering, such as transaction frequency features (e.g., number of transactions in 7 days), transaction amount features (e.g., median amount within the window), repayment on-time rate features (e.g., delay δ), and consumption diversity features (e.g., Gini-Simpson index).

[0111] (3) Dimension compression and concatenation: The above encoded basic fields are concatenated with the above behavioral feature information. Through feature selection or dimensionality reduction (such as PCA), a 32-dimensional fixed-length feature vector is finally obtained to ensure the dimensionality consistency of the input LSTM.

[0112] In some embodiments, for the problem of variable-length sequences with varying user transaction lengths, a dynamic RNN mechanism can be configured in the TensorFlow framework to automatically handle zero-padding data. This mechanism can automatically identify and ignore zero-padding data at the end of the sequence, achieving efficient processing.

[0113] It should be noted that the above stacked bidirectional LSTM model can deeply characterize time dependencies through both data-level and architecture-level mechanisms: At the data level: the input sequence is arranged strictly in chronological order, and the time interval (Δt) between adjacent time steps is used as an additional feature input. This dimension can reflect the differences in user activity in different scenarios (for example, the interval between two transactions of 2 hours vs. 2 days can reflect the difference in user activity; a 2-hour interval may represent normal activity, while a 2-day interval may represent potential anomalies).

[0114] At the architectural level: an explicit time decay factor γ is injected into the computation of the LSTM hidden state, as follows: γ=exp(-( - ) / τ); Wherein, τ is a learnable decay parameter used to control the rate at which historical information is forgotten over time (i.e., to control the decay rate of historical information), ensuring that the model can weigh the relevance of past and current behavior. Indicates the timestamp of the current time step; This represents the timestamp of the previous time step.

[0115] To further enhance focus on risk-sensitive periods, the model introduces a time-aware attention mechanism, which can be used to calculate time-related weights using the following formula. : =softmax( tanh( [ t; ])).

[0116] Where t is the relative time code. This is the hidden state of the LSTM. Through this weighting mechanism, weights are dynamically allocated at different time steps, clarifying the implementation path of time dependence. The model can automatically assign higher weights to risk-sensitive periods (such as concentrated consumption at the end of the month) while weakening the interference of regular nodes.

[0117] Here, the calculated time-related weights The weighted feature can be fused with the hidden state at the corresponding time step output of the LSTM. This process can be simplified to the following formula: Weighted Feature = ×hidden state_t + (1- The fused features can be used as input for subsequent risk assessment models. This allows for dynamic focusing on risk-sensitive periods, such as end-of-month concentrated spending or unusual transactions before repayment dates, assigning higher weights to strengthen the model's focus on key risk points. It also suppresses irrelevant noise, such as reducing the weight of time steps related to users' daily risk-free behavior, minimizing interference from invalid information. Furthermore, it accurately captures fraud patterns across time steps, such as frequent small transfers before repayment dates, compensating for the insufficient focus of traditional LSTM on local key features and improving the identification of hidden risks.

[0118] It should also be noted that during the model training phase, a curriculum learning strategy is employed. The model first learns simple patterns over shorter periods (e.g., a 7-day window) and then gradually increases to longer periods (e.g., a 90-day window) to improve its adaptability to complex data. Simultaneously, the optimizer uses the Nesterov momentum algorithm to accelerate gradient descent convergence, avoid local optima, and maintains a 1:3 positive-to-negative sample ratio in each batch of sampling to effectively address prediction bias caused by class imbalance.

[0119] This invention can also establish a three-tiered progressive assessment system for risk probability assessment, that is, to establish a tiered financial risk assessment mechanism that integrates multi-dimensional user characteristics, including but not limited to credit scores, delinquency probability, and fraud probability, aiming to accurately characterize risk features of different dimensions through a progressive structure. Specific implementation schemes are as follows: Establish a three-tiered, progressive evaluation system. The system, from the basic level to the top level, includes: Basic Layer: Integrates the credit score output by the traditional FICO scoring card. The indicators of this layer are strictly matched with the basic feature dimensions such as transaction frequency and amount distribution evaluated by the statistical layer, providing a basic profile of the user's ability to fulfill obligations. Middle layer: The XGBoost model is used to calculate the dynamic overdue probability. The indicators of this layer are strictly matched with the behavioral pattern transfer entropy, sequence abnormality and other feature dimensions evaluated by the sequence layer to characterize the user's dynamic behavior trajectory. Top layer: Introducing graph neural networks to mine fraud risks associated with users. The indicators of this layer are strictly matched with the feature dimensions such as social propagation risk and group association strength evaluated by the graph network layer, capturing potential group risks.

[0120] It should be noted that the aforementioned statistical layer is the foundational layer of the three-tiered progressive risk assessment system. Its core is based on assessing a user's basic credit risk using static statistical characteristics, focusing on the overall patterns of the user's historical transactions. Its features primarily originate from transaction frequency and transaction amount characteristics extracted through feature engineering, such as the number of transactions a user makes within a fixed time window, the median or distribution of transaction amounts, etc. By analyzing these statistical characteristics, a preliminary assessment of a user's transaction activity, spending power, and other basic creditworthiness can be made, providing underlying data support for subsequent, more in-depth risk assessments. This is the core basis for traditional credit scoring (such as the FICO scoring card).

[0121] The aforementioned sequence layer is the dynamic risk assessment layer in the system, focusing on capturing the evolution of user behavior patterns based on time-series behavioral features to assess dynamic risk. Its feature sources are richer, including both time-series features output through LSTM modeling, which reflect the long-term time dependence and dynamic trends of user behavior, and sequence pattern features extracted through feature engineering, such as frequent patterns of user behavior and pattern transition probabilities. The sequence layer overcomes the limitations of static analysis in the statistical layer, enabling it to identify abnormal fluctuations and pattern mutations in user behavior, such as sudden changes in repayment habits or abnormal transaction sequences, thereby more accurately capturing potential credit deterioration or fraud risks.

[0122] The aforementioned graph network layer is the group risk assessment layer in the system. It primarily assesses group fraud risk based on social relationship characteristics and uncovers risk propagation paths among users. Its features mainly come from external social network data and shared debt risk coefficients, such as users' social relationship networks and multiple borrowing information. By constructing a user relationship graph, the graph network layer can discover fraudulent behaviors hidden within groups, such as gang fraud and the propagation of shared debt risk, thus compensating for the shortcomings of the first two layers, which only focus on individual behavior. This layer can identify systemic risks from a macro perspective, providing financial institutions with a more comprehensive risk control perspective and effectively preventing covert fraudulent operations across users and platforms.

[0123] In some specific embodiments, step 104 above, namely, performing a risk probability assessment based on at least one of the behavioral feature information and the temporal feature information to obtain a risk assessment result for the target user, includes: Step 1041: Determine the basic credit score of the target user based on at least one of the behavioral feature information, wherein the behavioral feature information includes at least one of the following: transaction frequency feature information, transaction amount feature information, repayment on-time rate feature information, consumption type diversity feature information, and user behavior sequence pattern feature information.

[0124] In this step, the target user's basic credit score output by the FICO scoring card can be used as the basis for the assessment done in the aforementioned basic layer.

[0125] Step 1042: Determine the delinquency probability of the target user based on at least one of the behavioral feature information and the temporal feature information.

[0126] Here, the XGBoost model can be used to calculate the dynamic delinquency probability, which is the assessment done by the intermediate layer mentioned above.

[0127] Step 1043: Based on the graph neural network, assess the group fraud risk of the target users and obtain the group fraud risk value.

[0128] In this step, graph neural networks can be introduced to mine the fraud risk of associated users, which is the assessment done at the top level mentioned above.

[0129] Step 1044: Determine the risk assessment result of the target user based on the basic credit score, expected probability, and group fraud risk value.

[0130] For example, the analytic hierarchy process (AHP) can be used to assign weights to indicators. For instance, risk control experts can conduct pairwise importance comparisons of key variables, including the 15 core features mentioned above, construct a judgment matrix, and solve for the eigenvectors to determine the weight ratios between each level and feature, thus ensuring the scientific validity of the assessment results.

[0131] Here, the 15 core features can specifically include: (1) 7-day / 30-day / 90-day transaction frequency: The number of transactions in different periods is counted by the sliding window counting method, reflecting the user's transaction activity.

[0132] (2) Hodges-Lehmann median of transaction amount within the window: a more robust statistical indicator of amount, avoiding interference from extreme values ​​and reflecting the user's spending power.

[0133] (3) Transaction time interval distribution: the time difference characteristics of adjacent transactions, used to reflect the regularity and sudden behavior of user transactions.

[0134] (4) Merchant category distribution entropy: Based on the information entropy of merchant categories, it is used to measure the degree of dispersion of transaction scenarios.

[0135] (5) Repayment delay rate δ: (actual repayment date - due date) / cycle length, used to quantify repayment timeliness.

[0136] (6) Monthly repayment on time rate: that is, the proportion of on-time repayments to the total number of repayments, which is used to reflect long-term repayment credit.

[0137] (7) Repayment amount fluctuation coefficient: The coefficient of variation of the repayment amount is used to reflect the stability of repayment ability.

[0138] (8) Consumption diversity Gini-Simpson index: calculated based on the diversity of merchant categories, used to reflect the breadth of user consumption preferences.

[0139] (9) Impulsive consumption index: The weighted value of the proportion of nighttime transactions and the frequency of luxury goods purchases, used to measure irrational consumption tendencies.

[0140] (10) Periodic consumption intensity: Periodic transaction characteristics extracted by Fourier transform are used to reflect the time pattern of user consumption.

[0141] (11) Behavioral pattern entropy H: The entropy calculated by the pattern transition matrix measures the randomness and complexity of user behavior patterns.

[0142] (12) Sequence anomaly: The degree to which the behavioral sequence output by the LSTM model deviates from the normal pattern, capturing abnormal behavior.

[0143] (13) Frequent pattern support: The proportion of high-frequency behavior patterns mined by the PrefixSpan algorithm, which is used to reflect the typical behavior path of users.

[0144] (14) Joint Debt Risk Coefficient: A risk index calculated based on multiple borrowing data, used to measure the user's debt pressure.

[0145] (15) Social connection strength: The connection weight between users and high-risk nodes in the graph network, used to reflect the risk of group fraud propagation.

[0146] The above-described process of constructing a judgment matrix and solving for the eigenvectors involves using an N×N matrix (N=15, representing the number of core features) built based on pairwise comparisons by experts. The matrix element a_ij represents the importance score of feature i relative to feature j. The eigenvectors are the eigenvectors corresponding to the largest eigenvalue of the judgment matrix, with each element representing the weight coefficient of the corresponding core feature. For example, if the eigenvector is [0.5, 0.3, 0.2], it indicates that transaction frequency has a weight of 50%, repayment timeliness rate is 30%, and consumption diversity is 20%. Ultimately, the eigenvectors will serve as the basis for weighting each feature in the risk assessment indicator system.

[0147] In response to the unique characteristics of consumer finance scenarios, the system has also added scenario-specific indicators: Impulsive Consumption Index (calculated based on the proportion of nighttime transactions and the frequency of luxury goods purchases) and Multiple Debt Risk Coefficient (based on real-time capture of multiple borrowing data) to enhance the ability to identify specific risk scenarios.

[0148] In addition, a dynamic iterative maintenance mechanism can be implemented. The indicator system verifies the overall contribution of each feature to the risk control model every quarter through Shapley value attribution analysis, regularly eliminates ineffective indicators, and incorporates emerging risk dimensions into the system to ensure the effectiveness of risk identification throughout the entire lifecycle.

[0149] In some embodiments, an improved deep learning algorithm can be used to train a risk assessment model that integrates an attention mechanism and an autoencoder to output a risk assessment result. That is, the user behavior sequence is encoded using an autoencoder with an attention mechanism, and the risk assessment result is output by combining it with a fully connected layer; simultaneously, an improved Focal Loss is used as the loss function, and the model parameters are optimized through backpropagation and gradient descent to minimize the weighted combination of reconstruction loss and risk assessment loss, ultimately completing model training and outputting a user risk probability value r∈[0,1]. For example, this includes the following four parts: ① Construct a parameterized variational autoencoder to learn a low-dimensional representation of user behavior sequences. The autoencoder consists of two parts: an encoder and a decoder.

[0150] Encoder: A 4-layer Temporal Convolutional Neural Network (TCN) architecture is adopted, with dilation factors set for each layer as [1,2,4,8], which effectively expands the receptive field of the network and captures features across different time spans.

[0151] Latent space: the mean μ and variance σ of the encoder output latent states, μ,σ=f_enc(X),z=μ+σ⊙ε.

[0152] Where f_enc(X) represents the encoder function, which maps the input sequence X to the mean μ and standard deviation σ of the latent variables; μ represents the mean vector of the latent variables; σ represents the standard deviation vector of the latent variables; ε represents the noise vector sampled from the standard normal distribution, used for reparameterization; ⊙ represents element-wise multiplication; z represents the sampling result of the latent variables, used by the decoder to reconstruct the input.

[0153] Decoder: It employs a two-layer gated recurrent unit (GRU) combined with a temporal attention mechanism to reconstruct the original user behavior sequence from latent space variables.

[0154] Regularization: Add mutual information constraints to ELBO.

[0155] ② Introduction of attention mechanism: Based on the autoencoder, an attention mechanism is introduced to enable the temporal attention module in the risk assessment model to focus on the more important parts of the behavioral sequence.

[0156] For example, the formula for calculating attention weights is as follows: ; in, Indicates weight, It is the energy value of the i-th feature at the t-th time step. It is the energy value of the j-th feature at the t-th time step. It is calculated using the following formula: ; Among them, v, and It is a learnable weight matrix. It is the hidden state of the encoder output. It is the hidden state of the decoder at time step t.

[0157] The temporal attention module is constructed as follows: By adding multi-head attention (4 heads) to the top layer of the LSTM, the position-sensitive energy calculation formula is designed as follows: .

[0158] in, Let represent the energy value at time step t, used to calculate the attention weights, and v represent the learnable weight vector. and This represents the learnable weight matrix. This represents the hidden state at the current time step t. This represents the hidden state at a time step that differs from the current time step by Δ. represents the bias term; tanh represents the activation function.

[0159] The weighting formula for introducing the time decay factor is as follows:

[0160] in, This represents the attention weight at time step t. This represents the attention score at position t. Let λ represent the attention score at position k, λ represent the hyperparameter used to control the influence strength of the time distance penalty term, t represent the relative time encoding (time step t), and |t - k| represent the absolute time distance between time steps t and k.

[0161] It should be noted that the input to the temporal attention module includes: LSTM hidden states. Relative time encoding t and hidden states of adjacent time steps (Used to capture local temporal dependencies); the output of the temporal attention module is: time step weights. (Obtained through softmax normalization, with a value range of [0,1]), representing the importance of the corresponding time step features in risk assessment.

[0162] The temporal attention module is a core component of the autoencoder, embedded in the decoder layer. The encoder (a 4-layer TCN network) is responsible for encoding high-dimensional action sequences into low-dimensional latent vectors, while the decoder (a 2-layer GRU with a temporal attention mechanism) utilizes the weights of the temporal attention module. We reconstruct the latent vectors at different time steps with weights, and focus on key risk nodes (such as abnormal transactions before the repayment date) for risk assessment tasks, thus achieving multi-task learning of "sequence reconstruction + risk assessment".

[0163] ③ Risk assessment model training: Use an autoencoder with attention mechanism to encode user behavior sequences and output risk assessment results through a fully connected layer.

[0164] Here, the following improved Focal Loss function can be used: FL = -α log( .

[0165] in, ={risk assessment score, if y=11-risk assessment score, if y=0}.

[0166] Output: User risk probability value r, r∈[0,1].

[0167] It should be noted that, It is a model output probability mapping dynamically defined based on the true label y of the sample. Specifically, when y=1 (the sample is a positive example, i.e., a real high-risk user),... The risk assessment score output by the model (i.e., the probability that the model judges the user to be high-risk); when y=0 (the sample is a negative example, i.e., a real low-risk user). =1 - Risk assessment score (i.e., the probability that the model judges the user to be low-risk). This unifies the loss calculation logic for positive and negative examples, combined with FocalLoss. This feature can automatically reduce the loss weight of easily classified samples (such as obviously low-risk users) and force the model to focus on difficult-to-classify samples (such as users who are secretly committing fraud), thereby improving the accuracy of risk assessment.

[0168] The input to the risk assessment model is behavioral feature information after feature engineering, such as transaction frequency, amount, sequence pattern, etc., which are encoded into a 32-dimensional fixed-length feature vector sequence.

[0169] It should also be noted that the credit score, delinquency probability, and fraud probability mentioned above constitute the dimensional framework of risk assessment, while r is the comprehensive risk probability value output by the model. Specifically, r can directly correspond to "fraud probability" or "delinquency probability" (defined according to the training labels); and the basic credit score obtained from the credit score can be mapped and transformed through r (e.g., r∈[0,0.2] corresponds to a credit score of 800-900). The three together constitute a complete risk assessment system, with r being the quantitative result output by the underlying model, and the credit score and delinquency probability being the business-oriented interpretation of r.

[0170] ④ Model optimization: The model parameters are optimized using the backpropagation algorithm and gradient descent method to minimize the loss function.

[0171] For example, the improved loss function is: ;in, It is the reconstruction loss. It is a risk assessment loss. and These are the weighting coefficients of the loss function.

[0172] In the above embodiments, the calculation process for the user risk probability value r mainly includes: During the encoding phase, the autoencoder (a 4-layer TCN network) encodes the behavior sequence into a latent space vector z, capturing the potential risk features of the sequence. In multi-task learning, the decoder reconstructs the original behavior sequence based on the latent vector z (calculating the reconstruction loss Lrecon), and simultaneously outputs the risk probability r through a fully connected layer (calculating the risk assessment loss Lrisk). During loss optimization, the combined loss function is minimized through backpropagation. The model parameters are iteratively optimized to finally obtain a stable risk probability r∈[0,1].

[0173] In some embodiments, the accuracy and stability of the model (i.e., the risk assessment model that integrates attention mechanism and autoencoder) can also be verified by methods such as cross-validation and adjusting model parameters, thereby optimizing the model and ensuring its accuracy, stability and generalization ability, so as to provide a guarantee for the final launch.

[0174] Specifically, during model validation and optimization, K-fold hierarchical cross-validation is first used to ensure generalization ability; secondly, adversarial validation is used to detect differences in the distribution of the training set and online data; then, adversarial example generation technology is used to test the model's robustness; next, a shadow model is deployed for A / B testing in a production environment; finally, hyperparameters are adjusted using a Bayesian optimization framework, with a focus on optimizing the LSTM dropout rate (0.2-0.5 range) and the number of attention heads (4-8). In addition to the usual AUC and KS, new monitoring metrics include the population stability index PSI and feature stability CSI, which trigger the model reconstruction process when the monthly fluctuation exceeds 5%. The specific model validation metrics are as follows:

[0175] To address the "black box" problem of deep learning models, this invention integrates the DeepSHAP algorithm at the model interpretation level to generate user-level risk attribution reports. The specific generation process is as follows: In user i's risk attribution report: _i=∑_{S N{i}}(|S|!(M-|S|-1)!) / M![f(S∪{i})-f(S)], this formula is the standard definition of the Shapley value, used to fairly allocate the contribution of each feature. _i is the Shapley value of the i-th feature, representing the contribution of this feature to the model prediction; N is the set of all features; S is the subset that does not include the i-th feature; M is the total number of features; f(S∪{i}) is the model prediction value when the i-th feature is included; f(S) is the model prediction value when the i-th feature is not included.

[0176] For specific business scenarios, the application implementation must meet the following configuration: Feature set N contains multi-dimensional data such as time-series behavioral features and graph relationship features; Transaction type, time interval, and association strength are used as core explanation parameters; Example of business parameter mapping: Time interval Δt → mapped to "stability of active periods".

[0177] In this embodiment, adversarial validation is introduced to detect the difference between the training set and the online data distribution. Adversarial sample generation technology is used to test the robustness of the model, solving the problems of "data drift" and "adversarial attacks" that cannot be covered by traditional cross-validation. In addition to the conventional AUC and KS, this embodiment adds the population stability index PSI and feature stability CSI. When the monthly fluctuation exceeds 5%, model reconstruction is triggered to ensure that the model adapts to data evolution. The LSTM dropout rate (0.2-0.5) and the number of attention heads (4-8) are automatically adjusted through the Bayesian optimization framework, replacing the traditional manual parameter tuning and improving optimization efficiency. By deploying shadow models for A / B testing in the production environment, the online performance of the model is verified in advance, reducing the risk of going live.

[0178] In some embodiments, risk thresholds can be set based on risk assessment results, and warnings can be issued to users who exceed the thresholds, prompting financial institutions to take appropriate measures.

[0179] Specifically, a dynamic threshold management system can be established. For example, users can be divided into five levels based on a risk matrix: core customers (green), observation customers (blue), attention customers (yellow), high-risk customers (orange), and prohibited customers (red). The threshold calculation uses a quantile regression method, combined with funding costs and regulatory requirements to set a floating range. Once the threshold is reached and an alert is triggered, the engine can simultaneously execute three actions in real time: push a pop-up reminder to the account manager, automatically reduce the available credit limit to 50% of the remaining principal, and initiate a chain scan of related accounts.

[0180] For example, the threshold range can be set as follows:

[0181] Where r represents the user's risk assessment result, and its value ranges from [0,1]. The larger the value, the higher the risk level.

[0182] For example, when r ≥ 0.8, the user is marked as a "prohibited customer (red)", triggering the judicial recovery process; when 0.4 ≤ r < 0.6, the user is listed as a "customer under surveillance (yellow)", and the system temporarily freezes some functions to control risks.

[0183] In addition, an adaptive adjustment mechanism can be introduced, for example, calibrating the threshold boundaries quarterly based on the Probability of Default (PD) model. In this way, through the aforementioned dynamic threshold management system, financial institutions can implement differentiated risk response strategies based on the r-value.

[0184] To address group-related risks, an improved ST-DBSCAN (spatial-temporal density clustering) algorithm can be applied to detect abnormal clustering events in specific areas or among merchants, thereby triggering upgrades to regional risk control strategies. The specific implementation of the improved ST-DBSCAN algorithm for detecting abnormal clustering events is as follows: Distance metric: d = αd_spatial + βd_temporal, where d_temporal = min(|t_i - t_j|, T_max) / T_max.

[0185] Where d represents the total distance (spatial + temporal) between the two events; α and β represent weighting coefficients, which control the relative importance of spatial and temporal distances, respectively; d_spatial represents spatial distance (e.g., latitude and longitude difference); d_temporal represents temporal distance; t_i and t_j represent the timestamps of the two events, respectively; and T_max represents the maximum time window length, used to normalize the time difference.

[0186] Adaptive parameter calculation: ε = Q3(d_matrix) + 1.5 * IQR; minPts = log2(N) .

[0187] Where ε represents the neighborhood radius, used to determine whether two points are adjacent; Q3(d_matrix) represents the third quartile of the distance matrix; IQR represents the interquartile range (Q3 - Q1); Pts represents the minimum number of points; and N represents the total amount of data in the dataset.

[0188] The formula for calculating anomaly score is: anomaly_score = cluster_density * cluster_size.

[0189] Wherein, anomaly_score represents the overall risk score of anomalous clustered events; cluster_density represents the density of points per unit area per time in the cluster; and cluster_size represents the number of events contained in the cluster.

[0190] In some embodiments, user behavior data can be updated periodically to iteratively optimize the risk assessment model, adapting to market changes and evolving user behavior. An example implementation is as follows: A data-model dual-driven iteration mechanism is constructed: The data layer deploys a unified stream and batch processing pipeline, incrementally updating user behavior profiles daily and fully reconstructing the feature repository weekly; the model layer employs a three-tiered update strategy—lightweight online learning for daily fine-tuning of weight parameters, medium-frequency sub-model replacement for weekly updates of the attention mechanism module, and full model reconstruction executed quarterly. Version management utilizes blockchain technology to store the hash value of each iteration, supporting one-click rollback of any historical version. Furthermore, a model retirement mechanism is established: when the KS value drops by more than 10% for three consecutive months or when there are significant changes in regulatory policies, the model reconstruction process is forcibly initiated, and regulatory filing is resubmitted.

[0191] In the above embodiments, an analysis framework for user behavior data is first constructed by dividing the time window, encoding the behavior pattern, extracting the pattern feature, and calculating the pattern feature weight, thereby effectively identifying and quantifying frequent patterns in user behavior.

[0192] To address the issue of insufficient feature weights for sparse patterns in traditional methods, this embodiment introduces an adjustment factor α and combines it with an improved inverse document frequency (IDF) calculation method to enhance the impact of sparse patterns, highlighting their importance in risk assessment and thus providing accurate data support for risk control.

[0193] Secondly, this invention constructs an autoencoder network architecture with an attention mechanism for deep learning of low-dimensional representations of user behavior sequences. In this network, by introducing an attention mechanism, the model can automatically focus on key parts (critical risk nodes) in the behavior sequence, rather than averaging the entire sequence, thereby extracting more discriminative features.

[0194] At the model training level, the above embodiments employ a multi-task learning strategy, combining reconstruction loss (feature extraction capability of the autoencoder) with risk assessment loss (classification task performance) to collaboratively optimize model parameters and achieve accurate assessment of user behavior risks. Through the implementation of this model optimization strategy, the accuracy and stability of risk assessment results are effectively ensured, significantly enhancing the risk control capabilities of financial institutions.

[0195] This invention first significantly improves the accuracy and timeliness of consumer finance risk identification by deeply integrating temporal behavior modeling and adaptive feature learning mechanisms. At the feature engineering level, this embodiment constructs an innovative dynamic pattern mining algorithm. This algorithm can deeply mine the complex correlations hidden in user behavior, identifying not only regular transaction patterns but also abnormal behavior chains spanning different platforms and time periods. To further optimize risk identification, this embodiment introduces a pattern sparseness weight adjustment mechanism, enabling the system to adaptively enhance its sensitivity to new risk signals and accurately identify abrupt behavioral changes in users under different scenarios. This mechanism effectively overcomes the shortcomings of traditional static feature systems in responding to hidden risks with lag, allowing financial institutions to more promptly capture potential signs of credit deterioration.

[0196] Secondly, this invention achieves a dual breakthrough in risk representation and decision optimization by constructing an attention-enhanced deep learning framework. This framework includes an autoencoder network and a hierarchical attention mechanism: the autoencoder extracts potential risk features from user behavior sequences using nonlinear dimensionality reduction techniques, effectively solving the pattern recognition challenge under high-dimensional sparse data; while the introduction of the hierarchical attention mechanism empowers the model to dynamically focus on key risk nodes, autonomously strengthening the monitoring intensity of specific sensitive behaviors (such as large-amount consumption near the repayment date). During the model training phase, a multi-objective optimization mechanism is employed to balance the joint objectives of behavior pattern reconstruction and risk assessment, enabling the model to grasp long-term behavioral trends while also keenly capturing short-term abnormal fluctuations. This significantly enhances the dual early warning capability against gradual credit deterioration and sudden risk events, enabling financial institutions to build a comprehensive risk prevention and control system.

[0197] Based on the above technical means, this invention has built a three-dimensional risk prevention and control system for financial institutions, bringing the following four significant advantages: (1) Upgraded risk control capabilities: Through real-time dynamic user behavior sequence analysis, potential high-risk customers can be accurately identified, effectively reducing the bad debt rate and improving the credit approval rate of high-quality customers; (2) Differentiated pricing advantages: Based on the results of fine-grained risk assessment, flexible interest rate and credit limit strategies are implemented to enhance product competitiveness and increase profit margin; (3) Market expansion potential: High-frequency behavioral data analysis is used to solve the problem of insufficient traditional credit data, effectively expanding the incremental user group of young customers and the sinking market; (4) Customer life cycle management: By tracking the evolution of user behavior over a long period of time, risk warnings are provided for the entire process of pre-loan, mid-loan, and post-loan, significantly improving user retention and repeat loan conversion.

[0198] The risk analysis method described in this application, through deep integration of temporal behavior modeling and adaptive feature learning mechanisms, overcomes the technical bottleneck of the traditional static feature system's lagging response to hidden risks. It can keenly capture abrupt changes in user behavior, enabling timely identification of potential signs of credit deterioration. This not only significantly improves the accuracy and timeliness of risk warnings but also effectively reduces the bad debt rate, providing financial institutions with a more flexible and proactive risk control system to ensure asset security and sound operation.

[0199] like Figure 2 As shown, one embodiment of this application also provides a risk analysis device, the device comprising: The first acquisition module 210 is used to acquire user behavior sequence data of the target user within at least one first time window; The first processing module 220 is used to extract at least one behavioral feature information of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm. The behavioral feature information is used to reflect the statistical regularity of historical user behavior. The second processing module 230 is used to input at least one of the behavioral feature information into the target model to obtain the temporal feature information of the target user output by the target model. The target model is a model constructed based on a stacked bidirectional long short-term memory network (LSTM) combined with a time-aware attention mechanism. The temporal feature information is used to reflect the time dependence and dynamic change trend of user behavior. The risk assessment module 240 is used to perform risk probability assessment based on at least one of the behavioral feature information and the temporal feature information, and obtain a risk assessment result for the target user.

[0200] In this embodiment, by introducing a stacked bidirectional LSTM model, it is possible to deeply mine user behavior sequences, learn historical user behavior patterns, and capture the dynamic changing trends of current user behavior. This effectively enhances the target model's ability to identify the evolution of user behavior patterns and improves the timeliness and accuracy of risk warnings. Moreover, by combining a time-aware attention mechanism, more weight can be assigned to key time steps, enabling the target model to focus on high-risk behavior moments, avoiding interference from redundant information, and improving the accuracy of risk identification.

[0201] Optionally, the behavioral feature information includes user behavior sequence pattern feature information; The first processing module 220 includes: The first processing unit is configured to extract at least one frequent pattern of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm. The frequent pattern is a user behavior pattern with a support greater than or equal to a threshold. The user behavior pattern includes at least two consecutive user behaviors of the target user on the time axis. A matrix generation unit is configured to generate a pattern transition matrix based on the at least one frequent pattern, wherein the elements in the pattern transition matrix represent the transition probabilities between different frequent patterns. The second processing unit is used to calculate the pattern entropy value of the target user based on the pattern transition matrix, wherein the pattern entropy value is used to reflect the stability of the user behavior pattern of the target user. The third processing unit is used to determine the pattern weight of each user behavior pattern of the target user based on the at least one frequent pattern. The feature generation unit is used to generate user behavior sequence pattern feature information of the target user based on the pattern entropy value and the pattern weight. The user behavior sequence pattern feature information is used to reflect the statistical regularity and risk characteristics of the target user's user behavior pattern.

[0202] Optionally, the first processing unit includes: The data partitioning subunit is used to divide the user behavior sequence data into at least one subsequence data according to a second time window of preset length; A data encoding subunit is used to encode the at least one subsequence data to obtain the behavior sequence vector of the target user; The first processing subunit is used to determine at least one frequent pattern of the target user based on the behavior sequence vector using a target sequence pattern mining algorithm.

[0203] Optionally, the risk assessment module 240 includes: The fourth processing unit is used to determine the basic credit score of the target user based on at least one of the behavioral feature information. The fifth processing unit is used to determine the delinquency probability of the target user based on at least one of the behavioral feature information and the temporal feature information; The fraud assessment unit is used to assess the group fraud risk of the target users based on a graph neural network and obtain a group fraud risk value. The sixth processing unit is used to determine the risk assessment result of the target user based on the basic credit score, expected probability, and group fraud risk value; The behavioral characteristic information includes at least one of the following: transaction frequency characteristic information, transaction amount characteristic information, repayment on-time rate characteristic information, consumption type diversity characteristic information, and user behavior sequence pattern characteristic information.

[0204] Optionally, the stacked bidirectional LSTM model includes multiple hidden layers stacked sequentially, wherein the hidden layers employ a peephole connection mechanism, and a time decay factor is embedded in the calculation of the hidden states of the hidden layers.

[0205] Optionally, the device further includes: A dataset construction module is used to construct a user behavior dataset, which includes user behavior sequence data of at least one user. The dataset construction module includes: The data acquisition unit is used to collect multidimensional behavioral data of the at least one user; A desensitization processing unit is used to desensitize the multidimensional behavioral data to obtain the first behavioral data; The seventh processing unit is used to perform data cleaning and standardization on the first behavior data to obtain the user behavior dataset; The data cleaning process includes at least one of the following operations: Based on business logic, remove abnormal data; Identify data items that deviate from the normal distribution; Fill in missing values; Data deduplication.

[0206] The apparatus provided in this application embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, so it will not be described again here.

[0207] It should be noted that the division of units in the embodiments of this application is illustrative and only represents one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated units described above can be implemented in hardware or as software functional units.

[0208] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a processor-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0209] One embodiment of this application also provides a processing device, which includes a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the risk analysis method as described in any of the preceding claims.

[0210] The specific implementation of the risk analysis method, which is executed by the program running on the processor of the processing device, can be found in the detailed description of the risk analysis method, and will not be repeated here.

[0211] In addition, specific embodiments of this application also provide a readable storage medium storing a program. When executed by a processor, this program implements the various processes of the risk analysis method embodiments described above and achieves the same technical effect. To avoid repetition, it will not be described again here. The readable storage medium can be any available medium or data storage device that the processor can access, including but not limited to magnetic storage (e.g., floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical storage (e.g., CDs, DVDs, BDs, HVDs, etc.), and semiconductor storage (e.g., ROMs, EPROMs, EEPROMs, non-volatile memory (NAND flash), solid-state drives (SSDs), etc.).

[0212] This application also provides a computer program product, including computer instructions. When executed by a processor, the computer instructions implement the various processes of the above-described risk analysis method embodiments and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0213] Optionally, embodiments of this application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0214] The computer program product described in this application includes computer instructions that, when executed by a processor, implement the various processes of the method embodiments shown above and achieve the same technical effects. To avoid repetition, these will not be repeated here.

[0215] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0216] It should be noted that many of the functional components described in this specification are referred to as modules / submodules in order to more specifically emphasize the independence of their implementation.

[0217] In this application embodiment, the module / submodule can be implemented in software so that it can be executed by various types of processors. For example, an identified executable code module may include one or more physical or logical blocks of computer instructions, which may be constructed as objects, procedures, or functions. Nevertheless, the executable code of the identified module does not need to be physically located together, but may include different instructions stored in different bits, which, when logically combined, constitute the module and achieve the module's intended purpose.

[0218] In practice, an executable code module can be a single instruction or many instructions, and can even be distributed across multiple different code segments, different programs, and across multiple memory devices. Similarly, operational data can be identified within the module and can be implemented in any suitable form and organized within any suitable data structure. This operational data can be collected as a single dataset or distributed across different locations (including different storage devices), and can exist, at least in part, solely as electronic signals within the system or network.

[0219] When a module can be implemented using software, considering the current level of hardware technology, modules that can be implemented in software can be implemented using hardware circuits by those skilled in the art to achieve the corresponding functions, without considering cost. These hardware circuits include conventional very-large-scale integrated circuits (VLSI) or gate arrays, as well as existing semiconductors such as logic chips and transistors, or other discrete components. Modules can also be implemented using programmable hardware devices, such as field-programmable gate arrays, programmable array logic, and programmable logic devices.

[0220] The above describes the preferred embodiments of this application. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principles described in this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A risk analysis method, characterized in that, include: Acquire user behavior sequence data of the target user within at least one first time window; Based on the user behavior sequence data, at least one behavioral feature information of the target user is extracted by a target sequence pattern mining algorithm. The target sequence pattern mining algorithm enhances the feature weight of sparse patterns by introducing an adjustment factor. The behavioral feature information is used to reflect the statistical regularity of historical user behavior. At least one of the behavioral feature information is input into the target model to obtain the temporal feature information of the target user output by the target model. The target model is a model constructed based on a stacked bidirectional long short-term memory network (LSTM) combined with a time-aware attention mechanism. The temporal feature information is used to reflect the time dependence and dynamic change trend of user behavior. Based on at least one of the behavioral feature information and the temporal feature information, a risk probability assessment is performed to obtain a risk assessment result for the target user.

2. The risk analysis method according to claim 1, characterized in that, The behavioral feature information includes user behavior sequence pattern feature information; The step of extracting at least one behavioral feature information of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm includes: Based on the user behavior sequence data, at least one frequent pattern of the target user is extracted using a target sequence pattern mining algorithm. The frequent pattern is a user behavior pattern with a support greater than or equal to a threshold. The user behavior pattern includes at least two consecutive user behaviors of the target user on the time axis. Based on the at least one frequent pattern, a pattern transition matrix is ​​generated, wherein the elements in the pattern transition matrix are used to represent the transition probabilities between different frequent patterns; Based on the pattern transition matrix, the pattern entropy value of the target user is calculated, and the pattern entropy value is used to reflect the stability of the user behavior pattern of the target user; Based on the at least one frequent pattern, determine the pattern weight of each user behavior pattern of the target user; Based on the pattern entropy value and the pattern weight, user behavior sequence pattern feature information of the target user is generated. The user behavior sequence pattern feature information is used to reflect the statistical regularity and risk characteristics of the target user's user behavior pattern.

3. The risk analysis method according to claim 2, characterized in that, The step of extracting at least one frequent pattern of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm includes: The user behavior sequence data is divided into at least one sub-sequence data according to a second time window of a preset length; Encode the at least one subsequence data to obtain the behavior sequence vector of the target user; Based on the behavioral sequence vector, at least one frequent pattern of the target user is determined by a target sequence pattern mining algorithm.

4. The risk analysis method according to claim 1, characterized in that, The step of performing a risk probability assessment based on at least one of the behavioral feature information and the temporal feature information to obtain a risk assessment result for the target user includes: The basic credit score of the target user is determined based on at least one of the behavioral feature information; The delinquency probability of the target user is determined based on at least one of the behavioral feature information and the temporal feature information; Based on graph neural networks, the group fraud risk of the target users is assessed to obtain a group fraud risk value; The risk assessment result for the target user is determined based on the basic credit score, expected probability, and group fraud risk value. The behavioral characteristic information includes at least one of the following: transaction frequency characteristic information, transaction amount characteristic information, repayment on-time rate characteristic information, consumption type diversity characteristic information, and user behavior sequence pattern characteristic information.

5. The risk analysis method according to claim 1, characterized in that, The stacked bidirectional LSTM model consists of multiple hidden layers stacked sequentially. The hidden layers employ a peephole connection mechanism, and a time decay factor is embedded in the calculation of the hidden states of the hidden layers.

6. The risk analysis method according to claim 1, characterized in that, Before acquiring user behavior sequence data of the target user within at least one first time window, the method further includes: Construct a user behavior dataset, which includes user behavior sequence data of at least one user; The construction of the user behavior dataset includes: Collect multidimensional behavioral data of at least one user; The multidimensional behavioral data is anonymized to obtain the first behavioral data; The first behavioral data is cleaned and standardized to obtain the user behavior dataset.

7. A risk analysis device, characterized in that, The device includes: The first acquisition module is used to acquire user behavior sequence data of the target user within at least one first time window; The first processing module is used to extract at least one behavioral feature information of the target user based on the user behavior sequence data using a target sequence pattern mining algorithm. The behavioral feature information is used to reflect the statistical regularity of historical user behavior. The second processing module is used to input at least one of the behavioral feature information into the target model to obtain the temporal feature information of the target user output by the target model. The target model is a model constructed based on a stacked bidirectional long short-term memory network (LSTM) combined with a time-aware attention mechanism. The temporal feature information is used to reflect the time dependence and dynamic change trend of user behavior. The risk assessment module is used to perform risk probability assessment based on at least one of the behavioral feature information and the temporal feature information, and obtain risk assessment results for the target user.

8. A processing apparatus, characterized in that, It includes a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the risk analysis method as described in any one of claims 1 to 6.

9. A computer program product, characterized in that, It includes computer instructions that, when executed by a processor, implement the steps of the risk analysis method as described in any one of claims 1 to 6.

10. A readable storage medium, characterized in that, The readable storage medium stores a program that, when executed by a processor, implements the steps of the risk analysis method as described in any one of claims 1 to 6.

Images