Risk management method, device, equipment, storage medium and program product

Abstract

Embodiments of the present application provide a risk management method, device, equipment, storage medium and program product, relating to the field of financial technology or other related fields. The method comprises: in the case that a first account initiates a transaction behavior to a second account, obtaining transaction data of the first account in a historical time period and communication data between the first account and the second account, performing feature extraction on the transaction data according to a target graph neural network model to determine account risk features of the first account, and performing feature extraction on the communication data according to a target semantic understanding model to determine communication risk features between the first account and the second account, then, the target fusion evaluation model can be used to perform risk evaluation on the account risk features and the communication risk features to determine the risk probability of the transaction behavior being a fraudulent behavior. The method of the present application improves the timeliness of risk management.

Description

Technical Field

[0001] This application relates to the field of financial technology or other related fields, and in particular to a risk management method, apparatus, equipment, storage medium and program product. Background Technology

[0002] With the widespread adoption of online financial transfers and payments, cases of illegal financial fraud, such as telecommunications fraud, money laundering by gangs, and pyramid scheme-style financial fraud, are occurring frequently. Certain special groups, such as the elderly, have become high-risk victims of fraud due to their weaker risk identification abilities. Cases of large sums of money being fraudulently transferred are on the rise. Therefore, the banking industry urgently needs to build a comprehensive account transaction anti-fraud risk management system to identify abnormal transaction behavior and reduce the probability of users' property losses through technological means.

[0003] In related technologies, anti-fraud risk control solutions typically use the internal transaction records of the bank's existing accounts as the core data source for analysis. By building a customized rule engine to configure risk control verification clauses, and introducing machine learning models such as isolated forests and gradient boosting trees to model and learn the historical transaction characteristics of a single account, the identification and risk screening of account transaction behavior are completed by relying on the linkage between the model and the rules. An alarm is triggered after the fraudulent transaction behavior of the account is detected.

[0004] Therefore, the risk management solutions in related technologies suffer from insufficient early warning. Summary of the Invention

[0005] This application provides a risk management method, apparatus, equipment, storage medium, and program product to improve the timeliness of early warning in the risk management process.

[0006] Firstly, this application provides a risk management method, the method comprising:

[0007] In the case of a transaction initiated by the first account to the second account, obtain the transaction data of the first account within a historical time period, as well as the communication data between the first account and the second account;

[0008] Based on the target graph neural network model, feature extraction is performed on the transaction data to determine the account risk characteristics of the first account. The account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being defrauded.

[0009] Based on the target semantic understanding model, feature extraction is performed on the communication data to determine the communication risk characteristics between the first account and the second account. The communication risk characteristics are used to characterize whether there is a fraud risk in the transaction behavior.

[0010] By using a target fusion assessment model, risk assessment is conducted on account risk characteristics and communication risk characteristics to determine the probability that a transaction is a fraudulent activity. This risk probability is then used to manage the risk of the transaction.

[0011] In one possible embodiment, the target fusion assessment model includes a first activation layer and a second activation layer. Using the target fusion assessment model, risk assessment is performed on account risk characteristics and communication risk characteristics to determine the probability that the transaction behavior is fraudulent, including:

[0012] The data of account risk characteristics and communication risk characteristics are combined to obtain the combined characteristics;

[0013] The spliced ​​features are fused through the first activation layer to determine the fused features;

[0014] The risk probability is determined by classifying and predicting the fused features through the second activation layer.

[0015] In one possible embodiment, the method further includes:

[0016] The risk level is determined based on the probability of risk.

[0017] Control measures are determined based on the risk level. These measures include at least one of the following: no intervention, prohibition of trading activities, secondary confirmation of trading activities, confirmation by relatives of trading activities, and reporting to the local risk control agency.

[0018] Risk management of transaction activities is carried out in accordance with control and management procedures.

[0019] In one possible embodiment, the method further includes:

[0020] Obtain sample transaction data corresponding to multiple sample accounts. There is a mapping relationship between each sample account and the actual account label. The actual account label is one of normal account, fraudulent account, or fraudulent account.

[0021] Based on the sample transaction data, determine the sample transaction characteristics of each sample account itself, as well as the sample relationship characteristics between each sample account and other accounts;

[0022] The graph neural network model is trained based on the sample transaction characteristics, sample relationship characteristics, and a preset first loss function to determine the target graph neural network model.

[0023] In one possible embodiment, the graph neural network model includes a weight evaluation layer and a first graph neural network layer. The graph neural network model is trained based on sample transaction features, sample relationship features, and a preset first loss function to determine the target graph neural network model, including:

[0024] During the Nth iteration of training, the sample relationship features are evaluated based on the weight evaluation layer to obtain the sample risk weight features used to evaluate the importance of the relationship between each sample account and other accounts;

[0025] The risk weight features and transaction features of the samples are processed by the first neural network layer to obtain the risk features of the sample accounts.

[0026] The weight evaluation layer processes the risk characteristics of sample accounts based on the second graph neural network layer and the classification network layer, and predicts the probability that each sample account belongs to a different account label.

[0027] Based on the probability prediction results, actual account labels, and the first loss function, the network parameters of the weight evaluation layer, the first graph neural network layer, the second graph neural network layer, and the classification network layer are fine-tuned to determine the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer.

[0028] If the current iteration training result meets the preset convergence condition, the adjusted graph neural network model is determined as the target graph neural network model.

[0029] If the current iteration training result does not meet the preset convergence condition, perform the N+1th iteration training based on the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer.

[0030] In one possible embodiment, the method further includes:

[0031] Obtain sample communication data corresponding to the historical transaction behavior of multiple sample accounts. The sample communication data corresponds to the actual risk labels, which include normal communication and suspected fraud.

[0032] The semantic understanding model is trained based on the sample communication data, the actual risk labels corresponding to the communication data, and the preset second loss function to determine the target semantic understanding model.

[0033] In one possible embodiment, the method further includes:

[0034] Obtain sample transaction data and sample communication data corresponding to multiple sample accounts;

[0035] Based on the target graph neural network model, feature extraction is performed on the sample transaction data to determine the risk characteristics of each sample account.

[0036] Based on the target semantic understanding model, feature extraction is performed on the sample communication data to determine the sample communication risk characteristics corresponding to each sample account.

[0037] The fusion evaluation model is trained based on the risk characteristics of sample accounts, the risk characteristics of sample communication, and the preset third loss function to determine the target fusion evaluation model.

[0038] Secondly, this application provides a risk management device, comprising:

[0039] The acquisition module is used to acquire the transaction data of the first account within a historical time period, as well as the communication data between the first account and the second account, when the first account initiates a transaction to the second account.

[0040] The first extraction module is used to extract features from transaction data based on the target graph neural network model to determine the account risk characteristics of the first account. The account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being defrauded.

[0041] The second extraction module is used to extract features from the communication data based on the target semantic understanding model, and to determine the communication risk features between the first account and the second account. The communication risk features are used to characterize whether there is a risk of fraud in the transaction behavior.

[0042] The assessment module uses a target fusion assessment model to assess account risk characteristics and communication risk characteristics, determine the probability that a transaction is fraudulent, and use the risk probability to manage the risk of the transaction.

[0043] Thirdly, embodiments of this application provide an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0044] The memory stores the instructions that the computer executes;

[0045] The processor executes computer execution instructions stored in memory to implement the methods described above.

[0046] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided above.

[0047] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described above.

[0048] This application provides a risk management method, apparatus, device, storage medium, and program product. The method includes: when a first account initiates a transaction with a second account, acquiring transaction data of the first account within a historical time period and communication data between the first and second accounts; extracting features from the transaction data using a target graph neural network model to determine the account risk characteristics of the first account; and extracting features from the communication data using a target semantic understanding model to determine the communication risk characteristics between the first and second accounts. Then, a target fusion evaluation model can be used to assess the account risk characteristics and communication risk characteristics to determine the probability that the transaction is fraudulent. The account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being fraudulent, the communication risk characteristics are used to characterize whether the transaction is at risk of fraud, and the risk probability is used to manage the transaction risk. In this way, when a transaction is detected from the first account to the second account, the system first combines the first account's historical transaction data and the communication data between the first and second accounts, and extracts features using a pre-trained model. This analysis examines whether the first account poses any account risk and whether there is any fraud risk in the pre-transaction communication scenario. Based on this, the system assesses the probability that the transaction is fraudulent and implements corresponding risk control measures. This allows for risk warnings and control operations before the transaction is executed. Compared to risk control solutions in related technologies, this approach is more timely and protects users' assets. Furthermore, the analysis not only focuses on the first account's own transaction behavior but also on the communication between the first and second accounts and the relevant transaction data of the first account and other accounts over a historical period. This more comprehensive data dimension improves the accuracy of risk probability assessment. Attached Figure Description

[0049] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0050] Figure 1 Flowchart of the risk management method provided in the embodiments of this application Figure 1 ;

[0051] Figure 2 Flowchart of the risk management method provided in the embodiments of this application Figure 2 ;

[0052] Figure 3 This is a schematic diagram of the risk management device provided in the embodiments of this application;

[0053] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0054] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0055] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0056] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant countries and regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation access points for users to choose to authorize or refuse.

[0057] Furthermore, the technical solution involved in this application, which involves big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.) and the use of artificial intelligence technology for automated decision-making, and makes decisions that have a significant impact on personal rights based on the results of automated decision-making, provides users with corresponding operation entry points for users to choose to agree to or reject the results of automated decision-making; if the user chooses to reject, the process will proceed to the expert decision-making process.

[0058] It should be noted that the risk management methods, devices, equipment, storage media and program products provided in this application are for use in the financial technology field, but can also be used in any field other than the financial technology field. The application fields of the risk management methods, devices, equipment, storage media and program products in this application are not limited.

[0059] With the popularization of mobile internet financial services, mobile banking has become an important channel for users to transfer money, manage accounts, and make payments. Especially in age-friendly mobile banking scenarios targeting elderly users, simplifying operation processes, enlarging interface fonts, and highlighting frequently used functions have become common development directions.

[0060] In such scenarios, users typically initiate transaction requests to target accounts via mobile devices. These requests are sent to the bank's business platform, transaction processing system, and risk control system via the mobile banking client. The back-end system processes this data, combining it with historical account transaction records, device information, login status, and recipient account information, and then provides responses such as approval, alerts, or blocking. Meanwhile, elderly users often communicate with the counterparty via phone, text message, or social media before and after the transfer. This communication data is highly relevant to transaction decisions in real business, as fraudulent activities are usually not isolated events but rather unfold gradually through multiple stages, including conversation inducement, identity impersonation, emotional pressure, and fund transfer. Therefore, the typical application scenario for mobile banking anti-fraud technology is not merely verifying a payment instruction itself, but rather requires a joint analysis of historical transaction behaviors and communication content before and after the transaction, centered around the business event of a transaction initiated from one account to another. This analysis should be integrated into the bank's existing transaction processing architecture, risk identification architecture, and user interaction architecture to form a pre-transaction risk control identification mechanism, providing a more accurate assessment of the actual risk situation before the funds are actually transferred.

[0061] Existing mobile banking anti-fraud solutions typically rely on account transaction behavior analysis to identify risks through rule engines, traditional machine learning methods, or transaction network analysis models.

[0062] A common approach is to first extract structured features such as transaction amount, transaction frequency, time distribution, geographical distribution, changes in payees, and changes in terminals from the account's historical transaction records over a given period. Then, based on preset rules, it is determined whether there are any anomalies, such as large-amount transfers, cross-regional transfers, short-term high-frequency transfers, or first-time transfers to unfamiliar accounts. Alternatively, the above features can be input into a classification model to assign a risk score to the transaction.

[0063] In recent years, some solutions have also introduced graph models or graph neural networks to construct a transaction network by connecting the transfer relationships between different accounts. By identifying abnormal fund flow paths through account nodes and their relationships, the ability to detect risks associated with multiple accounts can be improved.

[0064] Understandably, such solutions are effective in identifying abnormal transaction patterns, uncovering risky accounts and suspicious fund flows that are difficult to cover with traditional rules. However, these solutions still primarily rely on structured transaction data for analysis, with core judgments focused on fund flows, and insufficiently utilizing earlier communication and inducement signals in the formation of fraudulent activities. In reality, fraudulent transactions often involve extensive persuasive tactics before the transfer is initiated, such as impersonating law enforcement, customer service, fabricating account anomalies, fabricating urgent situations involving relatives or friends, and inducing investment returns. Through continuous communication, the perpetrator changes the user's perception, making a seemingly normal transfer appear fraudulent in terms of intent. If identification is only based on amount, frequency, and account association after the transaction enters the payment stage, it is prone to delayed warnings and incomplete risk identification. Especially when the fraudsters deliberately control the transaction amount, split the transfer path, or disguise themselves as normal recipients, the analysis method that relies solely on transaction records is insufficient to reveal the crucial fact that the victim has been induced in a timely manner. This leads to an insufficient assessment of the risk of being defrauded, making it difficult to meet the business needs of proactive prevention before transactions and resulting in a significant problem of delayed early warning.

[0065] In view of this, embodiments of this application provide a risk management method, apparatus, device, storage medium, and program product. The method includes: when a first account initiates a transaction with a second account, acquiring transaction data of the first account within a historical time period and communication data between the first and second accounts; extracting features from the transaction data according to a target graph neural network model to determine the account risk characteristics of the first account; and extracting features from the communication data according to a target semantic understanding model to determine the communication risk characteristics between the first and second accounts. Then, a target fusion evaluation model can be used to assess the account risk characteristics and communication risk characteristics to determine the probability that the transaction is a fraudulent activity. The account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being fraudulent, the communication risk characteristics are used to characterize whether the transaction is at risk of fraud, and the risk probability is used to manage the transaction risk. In this way, when a transaction is detected from the first account to the second account, the system first combines the first account's historical transaction data and the communication data between the first and second accounts, and extracts features using a pre-trained model. This analysis examines whether the first account poses any account risk and whether there is any fraud risk in the pre-transaction communication scenario. Based on this, the system assesses the probability that the transaction is fraudulent and implements corresponding risk control measures. This allows for risk warnings and control operations before the transaction is executed. Compared to risk control solutions in related technologies, this approach is more timely and protects users' assets. Furthermore, the analysis not only focuses on the first account's own transaction behavior but also on the communication between the first and second accounts and the relevant transaction data of the first account and other accounts over a historical period. This more comprehensive data dimension improves the accuracy of risk probability assessment.

[0066] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0067] Figure 1 Flowchart of the risk management method provided in the embodiments of this application Figure 1 In the embodiments of this application, reference is made to... Figure 1 The process may include:

[0068] S101, when the first account initiates a transaction to the second account, obtain the transaction data of the first account within the historical time period, as well as the communication data between the first account and the second account.

[0069] In this embodiment of the application, this step corresponds to the data preparation stage of anti-fraud identification before the transaction. It can be understood that the execution subject of the method provided in this application is an electronic device, which can be any one of a mobile banking client, a banking business middle platform, a transaction processing server, a risk control server, or a device composed of them in combination.

[0070] Here, the first account is the transferor of funds in the transaction, and the second account is the recipient of funds in the transaction. When a transaction is detected that the first account has initiated a transaction with the second account, the transaction needs to be evaluated accordingly.

[0071] Regarding the process of detecting a transaction initiated by the first account to the second account, in this embodiment of the application, when the login of the first account is detected, it is detected whether the terminal bound to the first account has initiated a transaction in the relevant fund transfer interface. The transaction initiation operation may include inputting the receiving information of the second account, the transaction amount, and the relevant controls corresponding to triggering the transfer submission action. If detected, it can be determined that the first account is initiating a transaction to the second account.

[0072] In this embodiment of the application, when a transaction is detected that the first account initiates a transaction to the second account, the transaction requested by the user will not be executed immediately. At this time, the transaction data and communication data of the first account can be obtained for subsequent evaluation and analysis.

[0073] In this embodiment of the application, transaction data can refer to all relevant data of the user’s behavior that has generated changes in fund value within a historical period. Transaction data may include, but is not limited to, historical transfer records, transaction frequency, transaction amount, transaction time, transaction channel, direction of payment and receipt, distribution of counterparty accounts, regional information, terminal changes, login behavior information, and abnormal failed transaction records. It can be understood that the transaction data can be used to understand the fund flow status and behavior pattern of the first account within a historical period.

[0074] Here, the historical time period refers to the period before the first account initiates a transaction to the second account.

[0075] Regarding the process of acquiring transaction data, in some implementations, when a transaction is detected, a transaction request message can be generated first. The message carries at least the first account identifier, the second account identifier, the transaction amount, the transaction timestamp, the device identifier, the session identifier, and the transaction channel identifier, and is sent to the service backend of the corresponding financial institution through an encrypted communication link. When the service backend recognizes that the transaction request message is in a pending release state, it can use this transaction as the central event to initiate a query to the transaction database, the account relationship database, the customer behavior database, and the terminal data storage unit to obtain the transaction data of the first account within a preset historical time period.

[0076] Here, the historical time period can be set to the last 7 days, the last 30 days, the last 90 days, or other statistical windows required for account risk analysis, so as to ensure that short-term abnormal changes are reflected while the account's stable trading habits are preserved.

[0077] In this embodiment, communication data refers to the collection of interaction content between the first account and the second account prior to the transaction, used to characterize the interaction content formed between the first account and the second account. Its form can be text, speech-to-text results, structured tag sequences, or multimodal coding results. In this embodiment, communication data may include, but is not limited to, local call records, SMS records, social media message summaries, or transcribed call recordings between the first account and the second account.

[0078] Regarding the method of obtaining communication data, in this embodiment of the application, it can be obtained through the authorized collection module on the mobile terminal side corresponding to the first account, the controlled data interface provided by the operating system, the customer-initiated upload module, or the external collaborative interface on the bank side.

[0079] For example, if the user corresponding to the first account has completed privacy authorization on their corresponding mobile terminal, the mobile terminal can retrieve the communication identifier associated with the second account after the transaction is triggered, and then filter the call records, SMS records, social software message summaries or call recording transcripts locally to extract the communication content corresponding to the second account identifier or its mapped identity information; if the user's mobile terminal cannot directly provide the original content, it can also extract intermediate results such as timestamps, contact identifiers, keyword summaries, semantic vectors or risk tags and upload them to the backend.

[0080] Understandably, to ensure data availability, after receiving communication data, further data cleaning, deduplication, time alignment, identity mapping, and noise filtering can be performed. For example, irrelevant contact content can be removed, time format can be standardized, text recognition errors can be corrected, a session merging relationship can be established according to the contact frequency of the first and second accounts, and a data packet associated with this transaction can be generated for subsequent steps.

[0081] S102, Based on the target graph neural network model, feature extraction is performed on the transaction data to determine the account risk characteristics of the first account.

[0082] Among them, the account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being defrauded.

[0083] Here, the target graph neural network model is a risk analysis model used to extract features from the transaction data of the first account and output the account risk representation. After training, it can be deployed in the risk control platform or the service backend of financial institutions, and can perform graph structure modeling of account relationships and fund flow patterns.

[0084] It is understandable that transaction data does not only include isolated fund transfer data of the first account. Based on transaction data, transaction behavior between the first account and other accounts can be detected, thereby constructing a local transaction relationship diagram or an extended transaction network diagram centered on the first account.

[0085] Therefore, before inputting transaction data into the target graph neural network model for feature extraction, the transaction data needs to be processed first. This involves constructing a feature map based on the transaction information of the first account to be used as input to the target graph neural network model. Understandably, the feature map includes node feature vectors representing the account state of the first account itself, and edge feature vectors representing the transaction relationships between the first account and other accounts.

[0086] Regarding the construction process of the feature vector of the node in the feature graph corresponding to the first account, for example, the node corresponding to the first account can be defined as a node in the feature graph. The feature vector of each node includes the vectorized transaction data of the first account. It can be understood that the dimension of the feature vector included in the node is related to the dimension of the transaction data. For example, it can include dimensions such as transaction frequency, amount, time pattern, channel preference, counterparty concentration, volatility, fund flow, cross-regional transactions and transaction type. It can be understood that these feature vectors are obtained by organizing and characterizing the various types of data in the transaction data. The vectorized representation of transaction data of different dimensions can be referred to the following example.

[0087] Regarding the transaction frequency dimension of the first account, it can be understood that the vector of this dimension can reflect whether the transaction activity of the first account is normal or abnormally high / low frequency, and can measure the density of transactions initiated by the first account within a unit of time. This dimension can include two aspects of data: the average number of transactions per day. In this embodiment of the application, the number of transactions in the historical time period can be counted divided by the number of days, for example, the total number of transactions in the past 6 months / 183. Correspondingly, the vectorized representation of this data can be x1, with the specific value being the total number of transactions / 183; the activation frequency after dormancy. It can be understood that some accounts may suddenly initiate multiple transactions after a long period of dormancy, which can also reflect whether the account is abnormal. Therefore, for the first account with a long dormancy period (such as dormancy for 6 months or more), the number of transactions initiated in the first month can be counted, with the corresponding vectorized representation being x2, with the specific value x2∈[0,N].

[0088] Regarding the transaction amount of the first account, it can be understood that the data in this dimension can reflect the size of the funds in the first account and characterize its financial strength. The specific data included and the corresponding vectorized representations of each data point can be found in Table 1 below:

[0089] Table 1

[0090]

[0091] Regarding the transaction time pattern dimension of the first account, it can be understood that the data in this dimension can reflect the inertia of the first account's transaction behavior, capture the time preference of the first account's transactions, and thus identify abnormal transactions that "deviate from the regular schedule." The specific data included in this dimension and the corresponding vectorized representation of each data point can be referred to in Table 2 below:

[0092] Table 2

[0093]

[0094] Regarding the transaction channel preference dimension for the first account, it is understood that the data in this dimension can reflect the operating habits of the first account, distinguish the account's frequently used transaction channels, and identify whether the transaction behavior initiated by the first account has a risk signal of "suddenly switching to unfamiliar channels," such as suddenly making a large cash withdrawal through a financial institution's offline ATM that has never been used before. The specific data included in this dimension and the corresponding vectorized representation of each data point can be found in Table 3 below:

[0095] Table 3

[0096]

[0097] Regarding the counterparty concentration dimension of the first account, it is understood that the data in this dimension can reflect the degree of fund correlation of the first account, measure the "concentration" of fund transactions in the account, and avoid compliance risks (such as money laundering and cash-out) of "multiple counterparty dispersed transfers" or "single counterparty high-frequency trading". The specific data included in this dimension and the corresponding vectorized representation of each data can be referred to in Table 4 below:

[0098] Table 4

[0099]

[0100] Regarding the transaction volatility dimension of the first account, it is understandable that the data in this dimension can reflect the transaction stability of the first account. The "regularity" of transactions can be judged by the degree of fluctuation in the amount. Excessive fluctuation may indicate anomalies, such as small consumption followed by a sudden large transfer. Therefore, the specific data included in this dimension and the corresponding vectorized representation of each data point can be referred to in Table 5 below:

[0101] Table 5

[0102]

[0103] Regarding the fund flow dimension of the first account, it is understandable that the data in this dimension can reflect the income and expenditure logic of the first account. By distinguishing the structure of the account's "income" and "expenditure," anomalies such as "rapid inflow and outflow" and "immediate transfer out after a large net inflow" can be identified. The specific data included in this dimension and the corresponding vectorized representation of each data point can be found in Table 6 below:

[0104] Table 6

[0105]

[0106] Regarding the cross-regional transaction dimension of the first account, it is understood that the data in this dimension can reflect the geographical range of the transactions initiated by the first account. In this dimension, combined with the account's location (such as the city where the account was opened), the rationality of "transactions in different locations" can be identified, such as frequent cross-regional transfers from a local account. The specific data included in this dimension and the corresponding vectorized representations of each data point can be found in Table 7 below:

[0107] Table 7

[0108]

[0109] Regarding the transaction type dimension of the first account, it can be understood that the data in this dimension reflects the purpose of funds after the first account initiates a transaction. In essence, by judging the core purpose of the account through the "business type" of the transaction (such as consumption, transfer, investment, withdrawal), anomalies can be detected that the current transaction behavior is inconsistent with its usual purpose. The specific data included in this dimension and the corresponding vectorized representations of each data point can be found in Table 8 below:

[0110] Table 8

[0111]

[0112] To further analyze the position of the first account in the transaction relationship network, the transaction relationship between the first account and other accounts can be determined based on the recipients of different transaction behaviors in the transaction data, and the edge features corresponding to this transaction relationship can be added to the graph. Regarding the construction process of the edge feature vector in the feature graph corresponding to the first account, for example, the transaction relationship between the first account and other accounts can be defined as the edge feature vector in the graph, and edge features such as transaction amount, number of transactions, transaction time distribution, transaction direction, transaction channel, geographical span, and the newness of the receiving account can be added to each edge. In some implementations, at least one Boolean identifier can also be added, such as whether it is a large transaction, whether it is a nighttime transaction, whether it is a cross-regional transaction, or whether it is the first transaction with this account. It is understood that for the account nodes of other accounts, node features such as account type, account opening duration, historical risk labels, device stability, and distribution of common transaction times can be added to each account node.

[0113] It is understandable that different transaction data have different dimensions and ranges. Therefore, in the embodiments of this application, normalization processing can be performed on the different feature vectors constructed.

[0114] Regarding the normalization process, global minimum and maximum value normalization can be performed. The specific process can be referred to Formula 1 below:

[0115] Formula 1

[0116] Where i is the identifier of the feature vector, These are the normalized eigenvectors. These are the numerical values ​​of the eigenvectors, where max is the maximum value among all eigenvectors and min is the minimum value among all eigenvectors.

[0117] In this way, the transaction data corresponding to the first account can be vectorized into features to obtain the corresponding transaction relationship graph. At this time, the transaction relationship graph can be processed by the target graph neural network model to determine the account risk characteristics of the first account. In this embodiment of the application, the account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being defrauded.

[0118] S103, Based on the target semantic understanding model, feature extraction is performed on the communication data to determine the communication risk characteristics between the first account and the second account.

[0119] Among them, communication risk characteristics are used to characterize whether there is a risk of fraud in the transaction.

[0120] Here, the target semantic understanding model is a model used to perform contextual semantic analysis on communication data between the first account and the second account and extract risk-related features.

[0121] In the embodiments of this application, the communication data may be preprocessed before entering the target semantic understanding model.

[0122] It is understandable that communication data may be call recordings or text data. For text-based communication data, text preprocessing can be performed. For example, text preprocessing may include sentence segmentation, removal of noisy characters, replacement of sensitive identifiers, speaker differentiation, session time sorting, and unified encoding of content from different communication channels.

[0123] For voice communication data, such as call recordings, audio recognition can be performed first to transcribe the audio content into text, and paralinguistic features such as speech rate, pauses, and emotional intensity can be preserved when necessary.

[0124] For some text data with structured formats, such as text messages, instant messages, or social media chat logs, they can be concatenated into a context sequence according to the conversation rounds.

[0125] In this embodiment of the application, in order to enable the attention mechanism of the target semantic understanding model to focus on the inducement content related to the current transaction behavior, the global communication data collected in the historical time period can be filtered according to the time window and contact mapping rules, and only communication segments that are directly related to the second account or highly associated with its identity identifier can be retained. The communication content can also be sorted according to the transaction initiation time to facilitate semantic understanding.

[0126] In this embodiment, the target semantic understanding model can employ a deep semantic model based on a self-attention mechanism, such as a bidirectional encoder structure, a dialogue understanding model, or a pre-trained language model with a classification head. This model can model the contextual dependencies in communication data and generate fixed-dimensional semantic embedding vectors as the basic representation of communication risk features. Specifically, when semantic patterns related to fraudulent rhetoric appear in the communication content, such as "safe account," "cooperate with investigation," "account abnormality," "transfer immediately," "do not tell others," "refund verification," "investment return," and "pay deposit," the model can increase the weight of corresponding words and contextual fragments during the attention calculation process, thus strengthening risk signals such as inducement, threat, confidentiality, time-pressure, and identity spoofing in the final vector. In addition to semantic embedding, the model can also output conversation-level risk labels, sentence-level risk scores, or intent classification results. For example, it can classify communication content into categories such as normal communication, transfer guidance, identity impersonation, customer service inducement, investment persuasion, and emergency assistance spoofing, and map these classification results to structured risk features.

[0127] In one possible implementation, when processing multi-turn dialogues, the target semantic understanding model not only focuses on keywords in individual sentences but also identifies the phased characteristics of fraud development by combining contextual relationships. For example, the early stage involves identity establishment and trust acquisition, the middle stage involves creating anomalies and applying emotional pressure, and the later stage involves explicit instructions to transfer funds. Based on this, the model can generate communication risk features with phased evolution meaning. If the communication data comes from multiple channels, the semantic features of different channels can also be aligned and fused. For example, telephone transcripts and chat logs can be merged chronologically to identify cross-channel continuous inducement.

[0128] Based on the above analysis, this step expands the scope of risk identification from the transaction itself to the pre-transaction inducement and communication process. It addresses the shortcomings of traditional transaction analysis solutions in perceiving the formation of fraud and transforms the key fact that "the user has already been influenced by fraudulent rhetoric" into a calculable communication risk characteristic, thereby significantly improving the timeliness and accuracy of pre-transaction warnings. It should be understood that the above example is merely illustrative and not limiting.

[0129] S104 utilizes a target fusion assessment model to assess account risk characteristics and communication risk characteristics, determining the probability that a transaction is a fraudulent activity.

[0130] Among them, risk probability is used to manage the risks of trading activities.

[0131] In this embodiment of the application, the target fusion assessment model is used to jointly analyze account risk characteristics and communication risk characteristics, and output the probability that the transaction behavior is a fraudulent behavior.

[0132] Here, the input data for the target fusion assessment model are the account risk feature vector and the communication risk feature vector. It can be understood that before inputting the two into the model, the account risk feature vector and the communication risk feature vector can be dimensionally aligned and standardized to eliminate the difference in the scale of different feature spaces, and then input into the target fusion assessment model.

[0133] In the embodiments of this application, the target fusion evaluation model can adopt a weighted fusion structure, a multilayer perceptron structure, or a fusion network structure that incorporates a cross-modal attention mechanism. When using a weighted fusion approach, the two types of features can be linearly or non-linearly combined according to the parameters obtained from pre-training to form a multimodal risk feature vector. When using a cross-modal attention mechanism, the model can adaptively adjust the contribution of account risk signals and communication risk signals in the final evaluation based on their strength in the current transaction scenario. For example, when the transaction network anomaly is not obvious but there is strong fraud-inducing semantics in the communication, the model can increase the weight of the communication risk feature; conversely, when the communication content is relatively small but the account's historical transaction relationship shows obvious abnormal diffusion characteristics, the model can increase the weight of the account risk feature.

[0134] For the model output stage, the target fusion evaluation model can generate a risk probability in the range of 0 to 1 through a fully connected layer and an activation function. Here, the risk probability represents the likelihood that the current transaction behavior is judged as fraudulent behavior.

[0135] Regarding the process of determining the risk probability, in one possible implementation, the target fusion assessment model includes a first activation layer and a second activation layer. Based on this, the process of step S104, "using the target fusion assessment model to assess the risk of account risk characteristics and communication risk characteristics, and determine the risk probability that the transaction behavior is fraudulent behavior," may include: concatenating the account risk characteristics and communication risk characteristics to obtain concatenated features; performing fusion processing on the concatenated features through the first activation layer to determine the fusion features; and performing classification prediction on the fusion features through the second activation layer to determine the risk probability.

[0136] Here, the first activation layer can be used to perform nonlinear mapping on the concatenated feature vector to enhance the coupling expression between account risk features and communication risk features. Its activation function can be a function used to perform nonlinear mapping on the data, such as any one or more combinations of ReLU (Rectified Linear Unit), GELU (Gaussian Error Linear Unit), or Sigmoid. Through the first activation layer, the concatenated account risk features and communication risk features can be nonlinearly coupled to extract feature data containing both features, i.e., fused features.

[0137] Here, the second activation layer can be used to perform binary classification on the fused features to output the probability, so as to form a risk judgment result of whether the transaction behavior belongs to fraudulent behavior, and output the probability distribution of belonging or not belonging.

[0138] It is understandable that before inputting account risk features and communication risk features into the first activation layer, the two need to be spliced ​​together in the same dimensional space. In this embodiment, the splicing method can be to connect them in the order of feature dimensions, so that the subsequent network layer can simultaneously perceive the joint distribution of the two types of risk information.

[0139] Regarding the splicing process, you can refer to the following formula 2 as an example:

[0140] Formula 2

[0141] here, For splicing features, As a feature of account risk, In order to communicate risk characteristics, This represents vector concatenation, which can be understood as resulting in a feature dimension of 1. ,in It is a dimension of account risk characteristics. It is a dimension of communication risk characteristics.

[0142] After determining the splicing features, the splicing features can be input into the first activation layer for feature fusion.

[0143] In the embodiments of this application, the first activation layer can be implemented by combining a fully connected network with an activation function, such as using any one of ReLU, GELU or Sigmoid to complete feature compression and reconstruction, so that the spliced ​​features are transformed into a unified fusion representation.

[0144] Regarding the mapping process, an example can be found in Formula 3 below:

[0145] Formula 3

[0146] here, As a feature of fusion, and These are the network layer parameters that can be adjusted through training.

[0147] After obtaining the fusion features, the fusion features can be input into the second activation layer for risk assessment.

[0148] In this embodiment, the second activation layer can be implemented using a classification unit with output weights, and the fused features are mapped to probability values ​​between 0 and 1 to characterize the possibility that the transaction behavior is at risk of being defrauded.

[0149] Regarding the processing of fused features by the second activation layer, the following formula 4 can be used as an example:

[0150] Formula 4

[0151] in, For risk probability, and These are the network layer parameters that can be adjusted through training.

[0152] In this way, a comprehensive assessment of account risk characteristics and communication risk characteristics can be achieved through the above method. The two are then concatenated and input into the target fusion assessment model. The first activation layer completes cross-modal feature fusion, and the second activation layer outputs the risk probability. This allows the model to make a joint judgment using both fund flow risk and communication semantic risk. This method can improve the completeness of identifying fraudulent transactions, reduce misjudgments or omissions caused by relying solely on the transaction behavior itself, and enable the risk result that is more consistent with the true fraud status of the transaction behavior to be assessed at the transaction initiation stage, thereby improving the timeliness and accuracy of risk management.

[0153] Understandably, risk probability can be used to manage the trading behavior of the first account.

[0154] Regarding the process of risk management based on risk probability, in one possible implementation, it may include: determining the risk level based on the risk probability; determining the management operation based on the risk level, the management operation including at least one of non-intervention, prohibition of the transaction, secondary confirmation of the transaction, confirmation by relatives of the transaction, and reporting to the local risk management agency; and conducting risk management on the transaction based on the management operation.

[0155] Here, risk levels are used to map risk probabilities to different control levels. Therefore, different risk levels can correspond to different control operations, thereby achieving refined risk management.

[0156] Here, control operations are used to impose corresponding restrictions, verifications, or reporting on transaction activities. The higher the risk level, the stricter the control operations triggered are usually.

[0157] In the embodiments of this application, the control operations include, but are not limited to, at least one of the following: not intervening, prohibiting the transaction, secondary confirmation of the transaction, confirmation by relatives of the transaction, and reporting to the local risk control agency.

[0158] Here, "no intervention" means that when the risk probability is low, the possibility of fraud in the transaction is low, and no risk control is needed; users can directly conduct normal transactions. "Prohibition of transactions" means that when the risk probability reaches a certain level, there is a possibility of fraud in the transaction. To avoid financial loss to users, the transaction can be prohibited. It is understood that this control operation is often accompanied by other subsequent control measures, such as secondary confirmation of the transaction, confirmation by relatives of the transaction, and reporting to the local risk control agency. Secondary confirmation of the transaction can be achieved by verifying the information of the transaction (such as confirming whether the second account name is correct, confirming whether the current action is voluntary, etc.) to the account corresponding to the first account. The user reconfirms whether their transaction was initiated voluntarily; familial verification of the transaction refers to using pre-associated family accounts, contact numbers, or identity relationship information linked to the first account to assist in verifying suspicious transactions, thereby reducing the probability that the user corresponding to the first account will directly transfer funds under inducement; the local risk control agency can be a local risk control platform linked with public security, anti-fraud centers, or banks, used to receive high-risk transaction information and conduct manual analysis or joint handling. In this embodiment, if the risk level corresponding to the risk probability is very high, the local risk control agency needs to intervene. At this time, the relevant information of the transaction behavior of the first account can be reported to the local risk control agency. The relevant information may include the transaction data and communication data collected above.

[0159] Regarding the specific process of determining risk levels based on risk probability and then determining control operations, in one possible implementation, different risk levels correspond to different risk probability value ranges. The corresponding risk level can be determined based on the value range of the risk probability, and then the corresponding control operation can be determined based on the risk level. For example, the risk probability can be matched with the preset threshold range corresponding to each risk level. If the risk probability is lower than the first threshold, it is determined to be a low-risk level and no intervention is performed; if the risk probability falls between the first and second thresholds, it is determined to be a medium-risk level and a secondary confirmation of the transaction behavior is triggered, verifying the user's true intention through SMS verification code, dynamic password, voice prompts, or page pop-ups; if the risk probability is higher than the second threshold, it is determined to be a high-risk level, and the risk strategy can be adjusted to prohibit the transaction behavior, require confirmation from relatives, or report to the local risk control agency.

[0160] In this application embodiment, the threshold can also be dynamically adjusted by combining account age attributes, historical association of the payee, nighttime transaction characteristics and communication risk characteristics, so as to improve the adaptability under different risk scenarios.

[0161] In this way, differentiated handling based on risk level can be implemented at the transaction initiation stage, thereby curbing the transfer of fraudulent funds and improving transaction security in scenarios involving elderly users, as well as enhancing the accuracy of risk management.

[0162] In the above embodiments, when a transaction is detected from the first account to the second account, the system first combines the first account's transaction data over a historical period with the communication data between the first and second accounts, and extracts features using a pre-trained model. This allows the system to analyze whether the first account has account risks and whether there is fraud risk in the pre-transaction communication scenario. Based on this, the system then assesses the probability that the current transaction is fraudulent and implements corresponding risk control measures. This achieves risk warning and control before the transaction is executed. Compared with risk control solutions in related technologies, this approach is more timely and protects users' property security. Furthermore, the analysis process not only focuses on the first account's own transaction behavior but also on the communication between the first and second accounts and the relevant transaction data of the first account and other accounts over a historical period. This provides a more comprehensive data dimension and improves the accuracy of risk probability assessment.

[0163] Figure 2 Flowchart of the risk management method provided in the embodiments of this application Figure 2 In the embodiments of this application, reference is made to... Figure 2 The training process for the target graph neural network model can specifically include:

[0164] S201, Obtain sample transaction data corresponding to multiple sample accounts.

[0165] There is a mapping relationship between each sample account and the actual account label, which can be a normal account, a defrauded account, or a fraudulent account.

[0166] S202, determine the sample transaction characteristics of each sample account itself, as well as the sample relationship characteristics between each sample account and other accounts, based on the sample transaction data.

[0167] S203, Train the graph neural network model based on the sample transaction characteristics, sample relationship characteristics and the preset first loss function to determine the target graph neural network model.

[0168] Here, sample accounts are account entities used to construct training data, and mapping relationships are used to associate sample accounts with their corresponding actual account labels to form the labeled data required for supervised learning.

[0169] Here, sample transaction data may include the sample account's transfer records, payment and receipt information, transaction time, transaction amount, transaction frequency, and fund destination information within a historical time period; sample transaction features are used to characterize the transaction behavior pattern of the sample account itself, and sample relationship features are used to characterize the fund flow relationship and network connection structure between the sample account and other sample accounts.

[0170] In the specific implementation, the transaction data of multiple sample accounts can be cleaned, deduplicated, and time-aligned first. Then, node feature vectors are formed by summarizing them according to the account dimension, and an account relationship graph is constructed according to the transaction relationship. The node feature vector is used to represent the sample transaction features, and the edge features or adjacency relationship is used to represent the sample relationship features.

[0171] Regarding the construction method of sample transaction features, we can refer to the aforementioned process of constructing feature vectors based on transaction data. That is, we can construct feature graphs corresponding to each sample account based on sample transaction data. The feature graphs include node feature vectors corresponding to nodes and edge feature vectors between nodes.

[0172] After obtaining the feature map constructed based on the sample transaction data corresponding to each sample account, the graph neural network model can be trained and fine-tuned based on the feature map.

[0173] In this embodiment, the graph neural network model can adopt the structure of graph convolutional network, graph attention network, or message passing network. During training, sample transaction features and sample relationship features are used as inputs. After propagation through the network layers, the risk features of each sample account are output. Then, based on the risk features of the sample accounts, account category prediction is performed to obtain the account category prediction results for each sample account. The prediction results are compared with the actual account labels corresponding to each sample account, and the classification bias is calculated using the first loss function. The model parameters are then updated in reverse to obtain the target graph neural network model.

[0174] In this embodiment, the graph neural network model may include a weight evaluation layer and a first graph neural network layer. Regarding step S203, "training the graph neural network model based on sample transaction features, sample relationship features, and a preset first loss function to determine the target graph neural network model," the process may include: during the Nth iteration of training, the weight evaluation layer performs weight evaluation on the sample relationship features to obtain sample risk weight features used to evaluate the importance of the relationship between each sample account and other accounts; the first graph neural network layer processes the sample risk weight features and sample transaction features to obtain sample account risk features; and the second graph neural network layer and classification network layer are used to evaluate the sample account risk features. Risk characteristics are processed to predict the probability that each sample account belongs to a different account label. Based on the probability prediction results, the actual account labels, and the first loss function, the network parameters of the weight evaluation layer, the first graph neural network layer, the second graph neural network layer, and the classification network layer are fine-tuned to determine the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer. If the current iteration training result meets the preset convergence condition, the adjusted graph neural network model is determined as the target graph neural network model. If the current iteration training result does not meet the preset convergence condition, the N+1th iteration training is performed based on the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer.

[0175] In this embodiment of the application, the base network used to train and generate the target graph neural network model—the graph neural network model—may include a weight evaluation layer and a first graph neural network layer. The graph neural network model is jointly trained with two other network layers—a second graph neural network layer and a classification network layer—to gradually improve the graph neural network model's ability to extract account risk features.

[0176] Here, the weight evaluation layer is used to perform weight mapping on the sample relationship features, thereby obtaining sample risk weight features that can assess the importance of the relationship between each sample account and other accounts.

[0177] For example, the weight mapping process can be referred to in Formula 5 below:

[0178] Formula 5

[0179] in, Let i and j represent the sample relationship features, respectively, and let i and j represent different sample accounts. This refers to the feature data after performing a non-linear mapping on the sample relationship features. For sample risk weight features, , , , Both are learnable parameters, σ is the Sigmoid function, ensuring .

[0180] After obtaining the sample risk weight features, the first graph neural network layer can be used to perform neighborhood information aggregation on the graph structure, and the hidden features can be extracted based on the sample risk weight features and sample transaction features, thereby obtaining the sample account risk features.

[0181] Understandably, the first layer of the neural network is a graph convolution. In order for it to aggregate smoothly, a weighted adjacency matrix needs to be constructed based on the risk weight features of the samples. and weighted degree matrix The construction process can be referenced in Formula 6 below:

[0182] Formula 6

[0183] in, Let A be the matrix corresponding to the risk weight features of the samples, and let A be the original adjacency matrix. It represents the Hadamardi (or Hadama) stack.

[0184] After obtaining the weighted adjacency matrix and the weighted degree matrix, the first graph neural network layer can be used to process the sample transaction features, the weighted adjacency matrix, and the weighted degree matrix. The specific processing procedure can be referred to in Formula 7 below:

[0185] Formula 7

[0186] here, That is, the risk characteristics of the sample accounts, and X represents the sample transaction characteristics. This is a parameter matrix that can be adjusted through training.

[0187] The second neural network layer, as the successor to the first neural network layer, is used to classify the risk features of the samples, thereby obtaining the original classification scores of each node—that is, each sample account. The original classification scores have no data range restrictions and are not necessarily between 0 and 1. They can be used to characterize the original scores of each sample account belonging to each label.

[0188] Regarding the processing of sample risk features by the second neural network layer, the following formula 8 can be used as an example:

[0189] Formula 8

[0190] in, That is, the matrix corresponding to the original classification scores.

[0191] The classification network layer is used to normalize the original classification scores to obtain the probability prediction results of different account labels for each sample account. The normalization process can be referred to the following formula 9:

[0192] Formula 9

[0193] in, That is, the probability prediction result.

[0194] In the embodiments of this application This represents the probability distribution of each sample account belonging to different account tags. The dimension is related to the number of tags. In the application embodiment, account tags include one of the following: normal account, defrauded account, or fraudulent account. .

[0195] Understandably, for a single training iteration, after obtaining the probability prediction results for each sample account, the deviation between the probability prediction results and the actual account labels can be measured based on the first loss function, thereby inversely constraining the parameter updates of each network layer. For example, the first loss function can be found in the following formula 10:

[0196] Formula 10

[0197] here, It is the loss value, V L It is a collection of labeled nodes, y v λ is the one-hot vector of the true label of node v, and λ is the regularization coefficient.

[0198] As can be seen from the first loss function, the network layers involved in parameter updates here include not only the weight evaluation layer and the first graph neural network layer in the graph neural network model, but also the parameters in the second graph neural network layer and the classification network layer.

[0199] In practice, sample transaction features such as transaction amount, transaction frequency, changes in payee, and transaction time distribution can be extracted from the historical transaction records of multiple sample accounts. Sample relationship features can then be constructed based on the transfers between accounts, shared devices, or common payee relationships.

[0200] After inputting the sample relationship features into the weight evaluation layer, sample risk weight features can be generated through nonlinear mapping. The sample weight features and sample transaction features are then input into the first graph neural network layer for adjacency propagation and feature aggregation to obtain account risk features.

[0201] The risk characteristics of the sample accounts are then fed into the second neural network layer and classification network layer, which output the probability prediction results of each sample account corresponding to account labels such as normal account, defrauded account or fraudulent account.

[0202] During model training, the error between the predicted result and the actual account label is calculated based on the first loss function, and the parameters of the weight evaluation layer, the first graph neural network layer, the second graph neural network layer and the classification network layer are fine-tuned using the backpropagation algorithm, thereby obtaining the adjusted graph neural network model, the adjusted second graph neural network layer and the adjusted classification network layer.

[0203] Regarding the process of detecting whether the iteration has stopped and whether the model has converged, in one possible implementation, it can be detected that the current iteration training result meets a preset convergence condition. The content of the preset convergence condition can be preset. For example, the number of iterations can be accumulated to detect whether the current number of iterations has reached the preset number, thereby determining whether the model has converged; for example, it can be detected whether the error between the probability prediction result and the actual account label is less than a preset value, thereby determining whether the model has converged; for example, it can be detected whether the decrease in the loss value is less than a preset threshold, thereby determining whether the model has converged.

[0204] In this way, the risk weight mapping network combined with the first graph neural network layer is used as the backbone of feature extraction, namely the target graph neural network model. It is trained with the second graph neural network layer and the classification network layer. After training, the subsequent classification branches are discarded, and only the first half of the network structure used to extract hidden features is retained. The feature is extracted through the final determined target graph neural network model, which has stronger robustness and generalization ability, and can also be flexibly adapted to subsequent risk assessment tasks.

[0205] In the above embodiments, the graph neural network model can not only learn the local transaction features of accounts using sample transaction data, but also capture the global correlation patterns between accounts by combining sample relationship features, thereby improving the model's ability to distinguish abnormal accounts. Furthermore, by using the first loss function to constrain the prediction error, the target graph neural network model can continuously converge to a parameter state that better meets the actual risk control needs during the training process, thereby improving the accuracy and stability of subsequent risk identification.

[0206] Based on the aforementioned embodiments, the training process of the target semantic understanding model further includes: acquiring sample communication data corresponding to the historical transaction behavior of multiple sample accounts, wherein the sample communication data corresponds to actual risk labels, and the risk labels include normal communication and suspected fraud; training the semantic understanding model based on the sample communication data, the actual risk labels corresponding to the communication data, and a preset second loss function to determine the target semantic understanding model.

[0207] Here, sample communication data is used to characterize the text, voice-to-text, or instant message records formed between multiple sample accounts and counterparties before and after historical transaction behaviors. The actual risk label can be determined by the results of manual review, the results of the determined anti-fraud handling, or the conclusions of historical cases, and is used to identify the real risk status corresponding to the sample communication data.

[0208] In this embodiment of the application, the semantic understanding model is used to extract semantic representations of the communication content in order to identify fraudulent rhetoric features such as inducing transfers, impersonating identities, fabricating facts, and pressuring and urging, and output communication risk features that can be used for subsequent fusion evaluation.

[0209] Here, the second loss function is used to measure the deviation between the model output and the actual risk label, and drives the model parameter update based on the classification error, so that the model gradually enhances its ability to distinguish between normal communication and suspected fraud during the training process.

[0210] In practice, sample communication data can be collected from mobile banking clients, SMS gateways, call recording and transcription modules, or social media messaging interfaces, and then anonymized to form training corpus. Actual risk labels can be generated by mapping the transaction results of sample accounts, manual review conclusions, and a historical fraud case database. Normal communication indicates no obvious intent to induce transfers, while suspected fraud indicates high-risk rhetoric, identity fraud, or guidance to transfer funds.

[0211] After obtaining the sample communication data, it can be input into a semantic understanding model. In this embodiment, the semantic understanding model may include a network layer for encoding the sample communication data. For example, this network layer may be a Transformer layer. The sample communication data is input into the Transformer, and the hidden features corresponding to the classification token (CLS) are taken as the semantic representation vector of the sample communication data. This refers to the risk characteristics of sample communication.

[0212] It is understandable that the training of a semantic understanding model requires cooperation with other network layers. In the embodiments of this application, during the training phase, a subsequent classification network can be added to the semantic understanding model to predict the actual risk label of the sample communication data corresponding to each sample account based on the sample communication risk. The prediction results and the second loss function are used to fine-tune the parameters of the semantic understanding model and the classification network, thereby obtaining the final target semantic understanding model.

[0213] In this embodiment, the classification network layer can use a classification activation function similar to softmax to classify the risk features of sample communication. For example, the processing can refer to the following formula 11:

[0214] Formula 11

[0215] in, and These are parameters that can be adjusted during the training process. For the label prediction results, it is understandable that The dimension is related to the number of risk labels, as described in this application embodiment. .

[0216] Regarding the second loss function, for example, refer to the following formula 12:

[0217] Formula 12

[0218] in, Here, N is the total number of sample communication data, i is the identifier of the sample communication data, and c is the category index. In this embodiment, the risk label is normal communication or suspected fraud. It's a binary classification task; therefore, when c=1, it represents normal communication, and when c=2, it represents suspected fraud. This refers to the actual risk label corresponding to the communication data of each sample.

[0219] In this way, the parameters in the semantic understanding model can be continuously adjusted by using the second loss function value to obtain the target semantic understanding model.

[0220] In the above embodiments, the training data covers real communication scenarios of multiple sample accounts. By understanding this data, the model can simultaneously learn common expressions in normal transaction communication and inducement features in suspected fraud, thereby improving the ability to capture risk signals before transactions. By adopting this specific implementation method, the identification lag problem caused by relying solely on structured transaction data can be reduced, the identification accuracy of communication inducement fraud can be improved, and the timeliness and comprehensiveness of anti-fraud control before transactions in mobile banking scenarios can be enhanced.

[0221] Based on the foregoing embodiments, the training process of the target fusion evaluation model may further include: acquiring sample transaction data and sample communication data corresponding to multiple sample accounts; extracting features from the sample transaction data according to the target graph neural network model to determine the sample account risk characteristics corresponding to each sample account; extracting features from the sample communication data according to the target semantic understanding model to determine the sample communication risk characteristics corresponding to each sample account; and training the fusion evaluation model based on the sample account risk characteristics, sample communication risk characteristics, and a preset third loss function to determine the target fusion evaluation model.

[0222] In this embodiment, the sample transaction data can first be feature-extracted using a pre-trained target graph neural network model to obtain the sample account risk characteristics. Then, the sample communication data can be feature-extracted using a pre-trained target semantic understanding model to obtain the sample communication risk characteristics.

[0223] Understandably, in order to integrate the two types of features under the same dimension, it is necessary to first stitch together the sample account risk features and sample communication risk features to obtain the sample stitched features. Regarding the data stitching process, you can refer to the aforementioned stitching process for stitching together account risk features and communication risk features.

[0224] After obtaining the sample splicing features, the sample splicing features can be processed by the fusion evaluation model to be trained, thereby obtaining the sample risk probability of the transaction behavior corresponding to each sample account. It can be understood that different transaction behaviors have pre-labeled actual classification labels, that is, fraudulent behavior or non-fraudulent behavior. The deviation between the output of the fusion evaluation model and the sample label is constrained by the actual classification label, the predicted sample risk probability and the third loss function, so as to achieve iterative optimization of the model parameters.

[0225] In this embodiment of the application, the third loss function can be exemplarily referred to as Formula 13 below:

[0226] Formula 13

[0227] in, It is the value of the loss function. These are actual category labels. It is the sample risk probability.

[0228] In practical implementation, after the sample transaction data is input into the target graph neural network model, a graph structure representation can be constructed based on account nodes, transaction edges, and inter-account relationship graphs. Structured risk representations related to fund flows are then extracted through graph convolution, graph attention, or message passing mechanisms, thereby obtaining the sample account risk features corresponding to each sample account. After the sample communication data is input into the target semantic understanding model, semantic patterns such as identity theft, induced transfers, pressure and urging, and evasion of verification can be identified through word segmentation, vectorization, context encoding, and semantic classification, and the corresponding sample communication risk features are output. Subsequently, the sample account risk features and sample communication risk features are input into a fusion evaluation model, and the model parameters are trained using a third loss function. This allows the model to learn the non-linear correlation between transaction behavior and communication behavior, gradually forming a comprehensive ability to discriminate fraud risks.

[0229] In one possible implementation, during the training of the fusion evaluation model, only the model parameters of the fusion evaluation model can be adjusted.

[0230] In another possible implementation, during the training of the fusion evaluation model, not only can the model parameters of the fusion evaluation model be adjusted, but the model parameters of the target graph neural network model and the target semantic understanding model can also be fine-tuned, thereby improving the model's processing capabilities.

[0231] In the above embodiments, during the training process of the fusion evaluation model, by simultaneously absorbing information from both the transaction and communication sides, potential fraud risks can be identified in advance using the persuasive information in the semantics of communication, even when a single abnormality in fund flow is insufficient. This allows for the formation of a more complete risk characterization before the transaction. Consequently, the accuracy of identifying fraudulent transactions and the timeliness of early warnings can be improved, reducing missed detections due to relying solely on transaction data, and enhancing adaptability to complex fraud scenarios.

[0232] Figure 3 This is a schematic diagram of the risk management device provided in an embodiment of this application. The device 300 can be applied to electronic devices. For example... Figure 3 As shown, the risk management device 300 provided in this application embodiment includes:

[0233] The acquisition module 301 is used to acquire transaction data of the first account within a historical time period, as well as communication data between the first account and the second account, when the first account initiates a transaction to the second account.

[0234] The first extraction module 302 is used to extract features from the transaction data according to the target graph neural network model to determine the account risk features of the first account. The account risk features are used to characterize whether the transaction data of the first account is at risk of being defrauded.

[0235] The second extraction module 303 is used to extract features from the communication data according to the target semantic understanding model, and determine the communication risk features between the first account and the second account. The communication risk features are used to characterize whether there is a fraud risk in the transaction behavior.

[0236] Assessment module 304 is used to conduct risk assessment on account risk characteristics and communication risk characteristics using the target fusion assessment model, and to determine the risk probability that the transaction behavior is fraudulent. The risk probability is used for risk control of the transaction behavior.

[0237] In some embodiments, the target fusion evaluation model includes a first activation layer and a second activation layer, and the evaluation module 304 includes:

[0238] The splicing unit is used to splice account risk characteristics and communication risk characteristics to obtain spliced ​​characteristics.

[0239] The fusion unit is used to fuse the spliced ​​features through the first activation layer to determine the fused features;

[0240] The prediction unit is used to classify and predict the fused features through the second activation layer to determine the risk probability.

[0241] In some embodiments, the risk management device 300 further includes:

[0242] The control module is used to determine the risk level based on the risk probability; determine the control actions based on the risk level, which include at least one of the following: no intervention, prohibition of trading, secondary confirmation of trading, confirmation by relatives of the trading activity, and reporting to the local risk control agency; and conduct risk control on trading activities based on the control actions.

[0243] In some embodiments, the risk management device 300 further includes:

[0244] The first training module is used to acquire sample transaction data corresponding to multiple sample accounts. There is a mapping relationship between each sample account and the actual account label. The actual account label is one of normal account, fraudulent account, or fraudulent account. Based on the sample transaction data, the sample transaction characteristics of each sample account and the sample relationship characteristics between each sample account and other accounts are determined. Based on the sample transaction characteristics, sample relationship characteristics, and the preset first loss function, the graph neural network model is trained to determine the target graph neural network model.

[0245] In some embodiments, the graph neural network model includes a weight evaluation layer and a first graph neural network layer, and the first training module includes:

[0246] The weight evaluation unit is used to evaluate the sample relationship features based on the weight evaluation layer during the Nth iteration of training, and obtain the sample risk weight features used to evaluate the importance of the relationship between each sample account and other accounts.

[0247] The feature extraction unit is used to process the sample risk weight features and sample transaction features through the first graph neural network layer to obtain the sample account risk features;

[0248] The prediction unit is used to process the risk characteristics of sample accounts based on the second graph neural network layer and the classification network layer, and predict the probability that each sample account belongs to a different account label.

[0249] The adjustment unit is used to fine-tune the network parameters of the weight evaluation layer, the first graph neural network layer, the second graph neural network layer, and the classification network layer based on the probability prediction results, the actual account labels, and the first loss function, and to determine the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer.

[0250] The convergence determination unit is used to determine the adjusted graph neural network model as the target graph neural network model if the current iteration training result meets the preset convergence condition; if the current iteration training result does not meet the preset convergence condition, the N+1th iteration training is performed based on the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer.

[0251] In some embodiments, the risk management device 300 further includes:

[0252] The second training module is used to obtain sample communication data corresponding to the historical transaction behavior of multiple sample accounts. The sample communication data corresponds to the actual risk labels, which include normal communication and suspected fraud.

[0253] The semantic understanding model is trained based on the sample communication data, the actual risk labels corresponding to the communication data, and the preset second loss function to determine the target semantic understanding model.

[0254] In some embodiments, the risk management device 300 further includes:

[0255] The third training module is used to obtain sample transaction data and sample communication data corresponding to multiple sample accounts;

[0256] Based on the target graph neural network model, feature extraction is performed on the sample transaction data to determine the risk characteristics of each sample account.

[0257] Based on the target semantic understanding model, feature extraction is performed on the sample communication data to determine the sample communication risk characteristics corresponding to each sample account.

[0258] The fusion evaluation model is trained based on the risk characteristics of sample accounts, the risk characteristics of sample communication, and the preset third loss function to determine the target fusion evaluation model.

[0259] The risk management device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0260] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 4 As shown, the electronic device 40 provided in this embodiment includes at least one processor 401 and a memory 402. Optionally, the device 40 further includes a communication component 403. The processor 401, memory 402, and communication component 403 are connected via a bus 404.

[0261] In a specific implementation, at least one processor 401 executes computer execution instructions stored in memory 402, causing at least one processor 401 to perform the above-described method.

[0262] The specific implementation process of processor 401 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0263] It is understood that the electronic device provided in the embodiments of this application can be a server or a terminal.

[0264] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0265] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0266] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0267] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0268] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0269] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0270] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0271] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily essential to this application.

[0272] It should be further noted that although the steps in the flowchart are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0273] It should be understood that the above-described device embodiments are merely illustrative, and the device of this application can also be implemented in other ways. For example, the division of units / modules in the above embodiments is only a logical functional division, and there may be other division methods in actual implementation. For example, multiple units, modules, or components may be combined, or integrated into another system, or some features may be ignored or not executed.

[0274] Furthermore, unless otherwise specified, the functional units / modules in the various embodiments of this application can be integrated into one unit / module, or each unit / module can exist physically separately, or two or more units / modules can be integrated together. The integrated units / modules described above can be implemented in hardware or in the form of software program modules.

[0275] When integrated units / modules are implemented in hardware, the hardware can be digital circuits, analog circuits, etc. The physical implementation of the hardware structure includes, but is not limited to, transistors, memristors, etc. Unless otherwise specified, the processor can be any suitable hardware processor, such as a CPU, GPU, FPGA, DSP, and ASIC, etc. Unless otherwise specified, the storage unit can be any suitable magnetic or magneto-optical storage medium, such as Resistive Random Access Memory (RRAM), Dynamic Random Access Memory (DRAM), Static Random Access Memory (SRAM), Enhanced Dynamic Random Access Memory (EDRAM), High-Bandwidth Memory (HBM), Hybrid Memory Cube (HMC), etc.

[0276] If the integrated unit / module is implemented as a software program module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0277] In the above embodiments, the descriptions of each embodiment have their own emphasis. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0278] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the following claims.

[0279] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A risk management method, characterized in that, The method includes: In the case of a transaction initiated by the first account to the second account, the transaction data of the first account within a historical time period, as well as the communication data between the first account and the second account, are obtained. Based on the target graph neural network model, feature extraction is performed on the transaction data to determine the account risk characteristics of the first account. The account risk characteristics are used to characterize whether the transaction data of the first account is at risk of being defrauded. Based on the target semantic understanding model, feature extraction is performed on the communication data to determine the communication risk characteristics between the first account and the second account. The communication risk characteristics are used to characterize whether the transaction behavior has a fraud risk. Using a target fusion assessment model, risk assessment is performed on the account risk characteristics and the communication risk characteristics to determine the probability that the transaction behavior is a fraudulent behavior. The risk probability is used to manage the risk of the transaction behavior.

2. The method according to claim 1, characterized in that, The target fusion assessment model includes a first activation layer and a second activation layer. The process of using the target fusion assessment model to assess the account risk characteristics and the communication risk characteristics, and determining the probability that the transaction behavior is fraudulent, includes: The account risk characteristics and the communication risk characteristics are concatenated to obtain the concatenated characteristics; The splicing features are fused using the first activation layer to determine the fused features; The risk probability is determined by classifying and predicting the fused features through a second activation layer.

3. The method according to claim 1, characterized in that, The method further includes: The risk level is determined based on the stated risk probability; The control measures are determined based on the risk level, and the control measures include at least one of the following: no intervention, prohibition of the transaction, secondary confirmation of the transaction, confirmation by relatives of the transaction, and reporting to the local risk control agency. Risk management is carried out on the transaction activities in accordance with the aforementioned control measures.

4. The method according to claim 1, characterized in that, The method further includes: Obtain sample transaction data corresponding to multiple sample accounts. There is a mapping relationship between each sample account and an actual account label. The actual account label is one of a normal account, a defrauded account, or a fraudulent account. Based on the sample transaction data, determine the sample transaction characteristics of each sample account itself, as well as the sample relationship characteristics between each sample account and other accounts; The target graph neural network model is determined by training the graph neural network model based on the sample transaction features, the sample relationship features, and the preset first loss function.

5. The method according to claim 4, characterized in that, The graph neural network model includes a weight evaluation layer and a first graph neural network layer. The step of training the graph neural network model based on the sample transaction features, the sample relationship features, and a preset first loss function to determine the target graph neural network model includes: During the Nth iteration of training, the sample relationship features are evaluated based on the weight evaluation layer to obtain sample risk weight features used to evaluate the importance of the relationship between each sample account and other accounts; The risk weight features and transaction features of the samples are processed by the first graph neural network layer to obtain the risk features of the sample accounts. The risk characteristics of the sample accounts are processed based on the second graph neural network layer and the classification network layer to predict the probability that each sample account belongs to a different account label. Based on the probability prediction results, the actual account labels, and the first loss function, the network parameters of the weight evaluation layer, the first graph neural network layer, the second graph neural network layer, and the classification network layer are fine-tuned to determine the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer. If the current iteration training result satisfies the preset convergence condition, the adjusted graph neural network model is determined to be the target graph neural network model; If the current iteration training result does not meet the preset convergence condition, the N+1th iteration training is performed based on the adjusted graph neural network model, the adjusted second graph neural network layer, and the adjusted classification network layer.

6. The method according to claim 1, characterized in that, The method further includes: Obtain sample communication data corresponding to the historical transaction behavior of multiple sample accounts. The sample communication data corresponds to actual risk labels, and the risk labels include normal communication and suspected fraud. The semantic understanding model is trained based on the sample communication data, the actual risk labels corresponding to the communication data, and the preset second loss function to determine the target semantic understanding model.

7. The method according to claim 1, characterized in that, The method further includes: Obtain sample transaction data and sample communication data corresponding to multiple sample accounts; Based on the target graph neural network model, feature extraction is performed on the sample transaction data to determine the sample account risk characteristics corresponding to each sample account; Based on the target semantic understanding model, feature extraction is performed on the sample communication data to determine the sample communication risk characteristics corresponding to each sample account; The fusion evaluation model is trained based on the sample account risk characteristics, the sample communication risk characteristics, and the preset third loss function to determine the target fusion evaluation model.

8. A risk control device, characterized in that, The device includes: The acquisition module is used to acquire transaction data of the first account within a historical time period, as well as communication data between the first account and the second account, when the first account initiates a transaction to the second account. The first extraction module is used to extract features from the transaction data according to the target graph neural network model to determine the account risk features of the first account. The account risk features are used to characterize whether the transaction data of the first account is at risk of being defrauded. The second extraction module is used to extract features from the communication data according to the target semantic understanding model, and determine the communication risk features between the first account and the second account. The communication risk features are used to characterize whether the transaction behavior has a fraud risk. The assessment module is used to perform risk assessment on the account risk characteristics and the communication risk characteristics using a target fusion assessment model, and to determine the probability that the transaction behavior is a fraudulent behavior. The risk probability is used for risk control of the transaction behavior.

9. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 7.

11. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 7.

Images