Real-time compliance monitoring method for cross-border fund flow combining timing anomaly detection and rule engine

Abstract

The application discloses a cross-border fund flow real-time compliance monitoring method combining timing anomaly detection and a rule engine, relates to the technical field of computer processing, and comprises the following steps: S01, acquiring a real-time cross-border fund flow transaction data stream, and preprocessing the transaction data stream to obtain a transaction sample sequence; S02, inputting the transaction sample sequence into a dynamic compliance rule engine, performing rigid compliance screening, and outputting a first monitoring result; S03, inputting the first monitoring result into a pre-trained optimized timing Transform anomaly detection model, and generating a second monitoring result; and S04, generating a final compliance monitoring result based on a preset fusion synergy mechanism. The application realizes the acceleration of rule matching through dynamic rule subset loading, hash index caching and interval tree matching, and combines hierarchical priority resolution and artificial review bottom-up mechanisms to ensure the efficiency and logical consistency of the rule engine in real-time compliance screening.

Description

Technical Field

[0001] This invention relates to the field of computer processing technology, and in particular to a method for real-time compliance monitoring of cross-border capital flows that combines time-series anomaly detection with a rule engine. Background Technology

[0002] With the rapid development of cross-border trade, cross-border investment and financing, and digital cross-border financial business in my country, cross-border capital flows are showing a trend of explosive growth in scale, fragmented transaction scenarios, and concealed capital trajectories. At the same time, illegal and irregular activities such as money laundering by underground banks, illegal fund transfers, and fraudulent trade arbitrage are constantly evolving, giving rise to new characteristics such as "small amounts in multiple transactions, split transfers, cross-border transactions at different times, and concealed paths," posing severe challenges to cross-border financial supervision and compliance risk control.

[0003] Currently, the vast majority of domestic financial institutions and foreign exchange regulatory support systems still employ a traditional rule-engine-driven compliance monitoring model, relying on manually preset compliance rules, amount thresholds, transaction frequency, and other static conditions for screening. This model can effectively identify large, overtly illegal cross-border transactions.

[0004] However, in the few existing integrated solutions, the rule engine and the intelligent model often operate independently, lacking a two-way mutual support and iterative optimization mechanism, and are unable to form a self-evolving monitoring closed loop, making it difficult for the system to dynamically adapt to regulatory policy updates and the evolution of violation patterns.

[0005] Therefore, how to break through the static lag limitation of traditional rule engines, while overcoming the lack of compliance constraints in single intelligent models, and achieve deep integration and two-way collaboration between rigid compliance verification and flexible intelligent recognition, so as to conduct low-latency, low-missibility, and high-precision real-time compliance monitoring of dynamic, mutated, and hidden cross-border capital flow violations, is an urgent technical problem to be solved. Summary of the Invention

[0006] To address the aforementioned technical problems, the present invention employs a method for real-time compliance monitoring of cross-border capital flows that combines time-series anomaly detection with a rule engine, comprising the following steps:

[0007] S01. Obtain real-time cross-border capital flow transaction data stream and preprocess the transaction data stream to obtain a transaction sample sequence;

[0008] S02. Input the transaction sample sequence into the dynamic compliance rule engine, perform rigid compliance screening, and output the first monitoring result;

[0009] The first monitoring results include clearly compliant transactions and clearly non-compliant transactions;

[0010] S03. Input the first monitoring result into the pre-trained optimized temporal Transformer anomaly detection model, extract the implicit temporal features of the transaction data through the temporal attention mechanism, calculate and output the anomaly score, and generate the second monitoring result.

[0011] The implicit time-series characteristics include at least the transaction time interval, amount volatility, transaction frequency changes, and fund flow path deviation;

[0012] S04. Based on a preset fusion and collaboration mechanism, the first monitoring result and the second monitoring result are logically fused and hierarchically decided to generate the final compliance monitoring result;

[0013] The final compliance monitoring results include normal release, rule violation alarms, and time sequence anomalies pushed for manual review.

[0014] Preferably, the step S01 of obtaining real-time cross-border capital flow transaction data stream includes:

[0015] S11. Access the linked website in real time through a distributed message queue to obtain real-time cross-border payment messages, foreign exchange settlement and sales records, and cross-border investment and financing ledger data;

[0016] S12. Perform multi-level caching processing on the cross-border payment messages, foreign exchange settlement and sales records and cross-border investment and financing ledger data, establish partition indexes according to transaction entity ID and timestamp, and form an ordered raw data stream buffer queue.

[0017] Preferably, the preprocessing of the transaction data stream in step S01 to obtain a transaction sample sequence includes:

[0018] S13. Extract the transaction dataset from the ordered raw data stream buffer queue and perform time-series slicing according to the preset sliding window step size and window width.

[0019] S14. Generate a fixed-length time-series feature vector for each slice, wherein each time step in the time-series feature vector corresponds to a transaction record or a time aggregation unit;

[0020] S15. Missing time steps are filled in using forward padding or linear interpolation to obtain a sequence of transaction samples with equal intervals and lengths.

[0021] Preferably, the rigid compliance screening performed in step S02 includes:

[0022] S21. Extract the transaction amount, transaction time, transaction frequency, information on the main entities of the payer and payee, and business background fields from the transaction dataset;

[0023] S22. Input the extracted fields into the hierarchical rule base of the dynamic compliance rule engine for layer-by-layer matching.

[0024] The hierarchical rule base includes at least a regulatory bottom line rule layer, an institutional internal control rule layer, and a dynamic adaptation rule layer. The regulatory bottom line rule layer stores mandatory foreign exchange regulatory rules that cannot be violated, the institutional internal control rule layer stores the internal risk control rules of financial institutions, and the dynamic adaptation rule layer stores new temporary screening rules generated based on historical violation data.

[0025] S23. If the transaction data hits any prohibitive rule in any rule layer or exceeds the preset threshold condition, it will be immediately determined as a clear violation, the rule identifier, violation type and corresponding compliance basis will be recorded, and subsequent rule matching will be terminated.

[0026] S24. If the transaction data does not hit any prohibitive rules and meets all necessary condition rules, it is determined to be clearly compliant, and the transaction data is marked as data to be input into the timing anomaly detection engine.

[0027] Preferably, step S02, which involves performing rigid compliance screening, further includes a rule matching acceleration and conflict resolution process, including:

[0028] S25. Before rule matching, dynamically load the corresponding rule subset according to the business scenario type and credit rating of the main entity of the transaction data, and establish a hash index cache for high-frequency hit rules to accelerate the matching process.

[0029] S26. For rules with threshold amounts and frequency, an interval tree data structure is used for range matching, reducing the linear scan complexity of O(n) to O(logn).

[0030] S27. When a single transaction data point hits multiple rules with different judgment results, the rule conflict verification module is called to resolve the conflict according to the preset rule priority weight table.

[0031] Among them, the regulatory bottom line rule layer has a higher priority than the institutional internal control rule layer, the institutional internal control rule layer has a higher priority than the dynamic adaptation rule layer, and the judgment results of high-priority rules cover the judgment results of low-priority rules.

[0032] S28. For rule combinations that still have logical contradictions after resolution, mark the transaction data as pending manual review and skip automatic judgment. At the same time, trigger the rule engine's abnormal alarm to prompt maintenance personnel to check the consistency of the rule base.

[0033] Preferably, step S03 involves extracting latent temporal features and outputting anomaly scores using a pre-trained optimized temporal Transformer anomaly detection model, including:

[0034] S31. Construct a continuous time-series input matrix X=[X1,X2,...,X for the transaction data determined as clearly compliant by the rule engine according to a preset sliding window length t , where each time step X t at least comprises a feature vector of four dimensions: transaction amount, transaction frequency, time interval and capital path code;

[0035] S32. Input the time-series input matrix X into a Transformer encoder, calculate the global dependency relationship between different time steps through a multi-head self-attention mechanism, and output a high-dimensional time-series feature matrix H;

[0036] S33. Input the high-dimensional time-series feature matrix H into a time-series attention enhancement layer, perform weighted calculation on the features of each time step, enhance the feature expression of the time step with abnormal fluctuation, and obtain a weighted feature vector H';

[0037] S34. Input the weighted feature vector H' into a fully connected regression network, calculate the Mahalanobis distance D of the current transaction sequence relative to a pre-constructed normal behavior reference model, and generate an abnormality score S ranging from 0 to 1.

[0038] Preferably, the generating the abnormality score S in step S34 comprises:

[0039] S341. Pre-extract the normal time-series feature distribution through the time-series Transformer anomaly detection model based on historical normal cross-border capital flow transaction data, and construct the normal behavior reference model, where the reference model comprises a feature mean vector μ and a covariance matrix Σ of each time step;

[0040] S342. For the weighted feature vector H' of the real-time transaction sequence, calculate the Mahalanobis distance D between the weighted feature vector H' and the normal behavior reference model;

[0041] S343. Map the Mahalanobis distance D to the 0-1 interval through a Sigmoid function to obtain the abnormality score S;

[0042] S344. Output a corresponding abnormality level according to the threshold interval where the abnormality score S is located:

[0043] If S≤0.3, it is determined as a normal transaction; if 0.3<S<0.7, it is determined as a suspected abnormal transaction; if S≥0.7, it is determined as a highly abnormal transaction.

[0044] Preferably, in step S04, the performing logical fusion and hierarchical decision-making on the first monitoring result and the second monitoring result based on a preset fusion coordination mechanism to generate a final compliance monitoring result comprises:

[0045] S41. Directly mark the clearly non-compliant transactions in the first monitoring result as non-compliant alerts and output the result;

[0046] S42. For the clearly compliant transactions in the first monitoring result, obtain the corresponding anomaly score, and perform classification according to the following threshold rules:

[0047] If the anomaly score is less than T1, it is determined as normal release;

[0048] If T1 ≤ anomaly score < T2, it is determined as suspected anomaly, and pushed to the first-level manual review queue;

[0049] If the anomaly score is greater than or equal to T2, it is determined as highly anomalous, pushed to the second-level emergency review queue, and a time-series anomaly alert is triggered;

[0050] S43. Receive the judgment label returned by manual review, where the label includes: normal, non-compliant, or expert judgment;

[0051] S44. Use the transaction data confirmed to be non-compliant as negative samples to perform incremental training on the time-series Transformer anomaly detection model;

[0052] For transaction behaviors that are confirmed to be non-compliant and not hit by the rule engine, automatically extract their time-series feature patterns to generate new rules, and dynamically write the new rules into the layered rule base of the rule engine after conflict verification.

[0053] The present invention at least has the following beneficial effects:

[0054] 1. Realize the deep coupling of rigid compliance verification and flexible intelligent anomaly identification in the field of cross-border capital compliance monitoring. The rule engine strictly follows foreign exchange regulatory policies to ensure the interpretability and compliance basis of monitoring results; the time-series Transformer anomaly detection model uses a multi-scale sliding window to perform segmented sampling on cross-border capital time-series data, and assigns differentiated weights to different time nodes and transaction features through the time-series attention enhancement layer, so as to accurately capture hidden time-series non-compliant behaviors such as split transfer, time-sharing cross-border transactions, and abnormal night transactions.

[0055] 2. By combining the rule engine and the time-series Transformer model for identification, data can be analyzed and judged quickly, so that the monitoring system can dynamically adapt to the update of regulatory policies and the evolution of non-compliant patterns, and has extremely strong business scalability and long-term technical vitality.

[0056] 3. The unity and preciseness of the rule base are guaranteed through the rule conflict verification module, and all monitoring results are provided with a clear compliance basis through the regulatory bottom line rule layer, which overcomes the defects of a single intelligent model, such as poor interpretability and inability to be directly used as an law enforcement basis. Brief Description of the Drawings

[0057] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart of a method for real-time compliance monitoring of cross-border capital flows that combines time-series anomaly detection and a rule engine, provided in Embodiment 1 of the present invention.

[0059] Figure 2 This is a flowchart of S01 provided in Embodiment 1 of the present invention;

[0060] Figure 3 This is a flowchart of S02 provided in Embodiment 1 of the present invention;

[0061] Figure 4 A flowchart of S03 provided in Embodiment 1 of the present invention;

[0062] Figure 5 A flowchart of S04 provided in Embodiment 1 of the present invention;

[0063] Figure 6 The flowchart of S34 provided in Embodiment 2 of the present invention. Detailed Implementation

[0064] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0065] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0066] Example 1

[0067] This embodiment provides a method for real-time compliance monitoring of cross-border capital flows that combines time-series anomaly detection with a rule engine. The method includes the following steps: Figure 1 As shown:

[0068] S01. Obtain real-time cross-border capital flow transaction data stream and preprocess the transaction data stream to obtain transaction sample sequences;

[0069] Furthermore, the acquisition of real-time cross-border capital flow transaction data streams in the above embodiments includes:

[0070] S11. Access the linked website in real time through a distributed message queue to obtain real-time cross-border payment messages, foreign exchange settlement and sales records, and cross-border investment and financing ledger data;

[0071] S12. Perform multi-level caching processing on cross-border payment messages, foreign exchange settlement and sales records, and cross-border investment and financing ledger data. Establish partition indexes according to transaction entity ID and timestamp to form an orderly raw data stream buffer queue.

[0072] Furthermore, in the above embodiments, the transaction data stream is preprocessed to obtain a transaction sample sequence, including:

[0073] S13. Extract the transaction dataset from the ordered raw data stream buffer queue and perform time-series slicing according to the preset sliding window step size and window width.

[0074] S14. Generate a fixed-length time-series feature vector for each slice, where each time step in the time-series feature vector corresponds to a transaction record or a time aggregation unit.

[0075] S15. Missing time steps are filled in using forward padding or linear interpolation to obtain a sequence of transaction samples with equal intervals and lengths.

[0076] Specifically, through pre-configured data access links, the system employs a multi-level caching mechanism to initially process the incoming raw data. The first-level cache is an in-memory queue used to temporarily store raw messages arriving at the millisecond level; the second-level cache is an ordered disk log used for persistent storage and flushing according to time windows. Subsequently, the system establishes a partition index based on the transaction entity ID and transaction timestamp, mapping transaction records of the same entity to the same processing partition.

[0077] The system extracts historical transaction records for each trading entity from an ordered raw data stream buffer queue, forming a continuous transaction dataset. Then, it performs time-series slicing on this dataset according to a preset sliding window step size and window width. The window width defines the time range of each input to the time-series model, while the step size determines the degree of overlap between adjacent windows. By setting multi-scale windows, the system can capture both short-term sudden anomalies and perceive long-term capital flow patterns.

[0078] Within each time window, the system divides the window into several equally spaced time steps. Each time step can correspond to a specific transaction record or a time aggregation unit. The features of each time step include at least: transaction amount, transaction frequency, time interval, and fund path encoding. Ultimately, a time window is represented as a fixed-length time-series feature vector matrix.

[0079] In real-world data, some time steps may lack transaction records. To maintain the integrity of the tensor structure, the system employs forward padding or linear interpolation for completion. Both methods preserve the smoothness of the time series trend and avoid introducing artificial abrupt changes.

[0080] S02. Input the transaction sample sequence into the dynamic compliance rule engine to perform rigid compliance screening and output the first monitoring result; the first monitoring result includes clearly compliant transactions and clearly non-compliant transactions.

[0081] Furthermore, the execution of rigid compliance screening in the above embodiments includes:

[0082] S21. Extract the transaction amount, transaction time, transaction frequency, information on the main parties involved in the payment and receipt, and business background fields from the transaction dataset;

[0083] S22. Input the extracted fields into the hierarchical rule base of the dynamic compliance rule engine for layer-by-layer matching. The hierarchical rule base includes at least the regulatory bottom line rule layer, the institutional internal control rule layer and the dynamic adaptation rule layer. The regulatory bottom line rule layer stores the mandatory foreign exchange regulatory rules that cannot be violated, the institutional internal control rule layer stores the internal risk control rules of financial institutions, and the dynamic adaptation rule layer stores new temporary screening rules generated based on historical violation data.

[0084] S23. If the transaction data hits any prohibitive rule in any rule layer or exceeds the preset threshold condition, it will be immediately determined as a clear violation, the rule identifier, violation type and corresponding compliance basis will be recorded, and subsequent rule matching will be terminated.

[0085] S24. If the transaction data does not hit any prohibitive rules and meets all necessary condition rules, it is determined to be clearly compliant, and the transaction data is marked as data to be input into the timing anomaly detection engine.

[0086] Specifically, the system inputs the preprocessed transaction sample sequence into the dynamic compliance rule engine to perform rigid compliance screening. Rigid compliance screening refers to a hard compliance determination of each cross-border transaction based on the current regulatory policies of the State Administration of Foreign Exchange, the internal risk control requirements of financial institutions, and dynamically updated temporary screening rules, ensuring that all violations have clear compliance grounds. This screening process includes the following sub-steps:

[0087] First, core fields related to compliance determination are extracted from the transaction sample sequence, including but not limited to: transaction amount, transaction time, transaction frequency, information of the payer and payee, and business background fields. These fields are the basic data source for subsequent rule matching.

[0088] If transaction data matches any prohibited rule in any rule layer, or exceeds a preset threshold, the system immediately determines the transaction as a clear violation. At this point, the system records the matched rule identifier, violation type, and corresponding compliance basis, and terminates subsequent rule matching to avoid unnecessary computational overhead.

[0089] If the transaction data does not match any prohibitive rules and meets all necessary condition rules, the system determines that the transaction is explicitly compliant. At this time, the transaction data is marked as "data to be input into the time series anomaly detection engine" so that subsequent step S03 can perform in-depth mining of implicit time series features.

[0090] S03. Input the first monitoring result into the pre-trained optimized temporal Transformer anomaly detection model, extract the implicit temporal features of the transaction data through the temporal attention mechanism, calculate and output the anomaly score, and generate the second monitoring result.

[0091] Implicit time-series characteristics include at least the transaction time interval, amount volatility, changes in transaction frequency, and deviations in fund flow paths;

[0092] Furthermore, in the above embodiments, the latent temporal features are extracted and anomaly scores are output using a pre-trained optimized temporal Transformer anomaly detection model, including:

[0093] S31. For transaction data that has been determined by the rule engine to be clearly compliant, construct a continuous time-series input matrix X=[X1,X2,...,X] according to a preset sliding window length. t ], where each time step X t It should contain feature vectors with at least four dimensions: transaction amount, transaction frequency, time interval, and fund path encoding.

[0094] S32. Input the time-series input matrix X into the Transformer encoder, calculate the global dependency relationship between different time steps through the multi-head self-attention mechanism, and output a high-dimensional time-series feature matrix H;

[0095] S33. Input the high-dimensional time-series feature matrix H into the time-series attention enhancement layer, perform weighted calculation on the features of each time step, enhance the feature expression of time steps with abnormal fluctuations, and obtain a weighted feature vector H';

[0096] S34. Input the weighted feature vector H' into the fully connected regression network, calculate the Mahalanobis distance of the current transaction sequence relative to the pre-constructed normal behavior reference model, and generate an anomaly score S between 0 and 1.

[0097] Further, generating the anomaly score S in the above embodiment includes:

[0098] S341. Based on historical normal cross-border capital flow transaction data in advance, extract the normal time-series feature distribution through the time-series Transformer anomaly detection model, and construct a normal behavior reference model, where the reference model includes the feature mean vector μ and covariance matrix Σ of each time step;

[0099] S342. For the weighted feature vector H' of the real-time transaction sequence, calculate the Mahalanobis distance between it and the normal behavior reference model ;

[0100] S343. Map the Mahalanobis distance D to the 0-1 interval through the Sigmoid function to obtain the anomaly score , where k is a scale parameter, and θ is a preset offset threshold;

[0101] S344. Output the corresponding anomaly level according to the threshold interval where the anomaly score S is located: if S≤0.3, it is determined as a normal transaction; if 0.3<S<0.7, it is determined as a suspected abnormal transaction; if S≥0.7, it is determined as a highly abnormal transaction.

[0102] Specifically, the system sorts the cross-border transaction data determined as clearly compliant by the rule engine according to the transaction subject ID and timestamp to form a continuous time series. Then, a sliding window mechanism is used to segment the sequence to obtain an input matrix X=[X1,X2,...,X of fixed length t . Wherein, each time step X t is a four-dimensional feature vector, which at least includes: transaction amount, transaction frequency, time interval, and capital path code.

[0103] Calculate statistics such as the variance and mutation degree of the feature vector at each time step, and then weight each time step through a learnable attention weight vector. Time steps that differ significantly from historical behavior patterns are assigned higher weights, while the weights of stable normal transaction steps are reduced. Finally, the weighted feature vector H' is obtained, which enables the model to concentrate its limited expressive power on potential abnormal areas and avoid being diluted by massive normal data.

[0104] Feed the weighted feature vector H' into a fully connected regression network. This network does not directly output a classification result, but calculates the degree of deviation between the current transaction sequence and the "normal behavior reference model". The reference model is pre-trained using massive historical normal cross-border transaction data, and it stores the parameters of the normal time-series feature distribution, including the feature mean vector μ and the covariance matrix Σ of each time step. The Mahalanobis distance is used here as the deviation measure. The calculation formula of the Mahalanobis distance is , which can eliminate the dimensional difference and correlation influence between features, and is a more scientific anomaly detection indicator than the Euclidean distance. After obtaining the Mahalanobis distance D, it is mapped to the range of 0 to 1 through the Sigmoid function to obtain the final anomaly score , where k controls the steepness of the mapping curve, and θ is the offset threshold.

[0105] To facilitate subsequent hierarchical decision-making, the system sets three threshold intervals according to the anomaly score S:

[0106] If S≤0.3, the transaction is determined to be normal, indicating that the current time-series behavior of capital flow is highly consistent with the normal reference, and there is no suspicion of violation;

[0107] If 0.3<S<0.7, the transaction is determined to be a suspected abnormal transaction. Although no hard rules are triggered, the time-series behavior deviates from the normal trajectory, and it needs to be pushed to the first-level manual review queue for confirmation;

[0108] If S≥0.7, the transaction is determined to be a highly abnormal transaction. At this time, the time-series deviation is extremely significant, the model has a high confidence that it is a hidden violation, triggers the emergency review queue and generates a time-series anomaly warning at the same time.

[0109] S04. Perform logical fusion and hierarchical decision-making on the first monitoring result and the second monitoring result based on a preset fusion collaboration mechanism to generate a final compliance monitoring result, which specifically includes:

[0110] S41. Directly mark the explicitly violating transactions in the first monitoring result as violation alarms and output the results;

[0111] S42. For the explicitly compliant transactions in the first monitoring result, obtain the corresponding anomaly scores and perform classification according to the following threshold rules:

[0112] If the anomaly score is less than T1, it is determined as normal and released;

[0113] If T1 ≤ anomaly score < T2, it is determined as suspected anomaly, and pushed to the first-level manual review queue;

[0114] If the anomaly score is greater than or equal to T2, it is determined as highly anomalous, pushed to the second-level emergency review queue, and a time-series anomaly alert is triggered;

[0115] S43. Receive the determination label returned by manual review, where the label includes: normal, violation, or expert judgment;

[0116] S44. Perform two-way mutual feeding update according to the determination label:

[0117] The transaction data confirmed to be in violation is used as a negative sample to perform incremental training on the time-series Transformer anomaly detection model;

[0118] For the transaction behaviors that are confirmed to be in violation and not hit by the rule engine, their time-series feature patterns are automatically extracted to generate new rules, which are dynamically written into the layered rule base of the rule engine after conflict verification.

[0119] Next, the final compliance monitoring results in the above embodiments include normal release, rule violation alert, and time-series anomaly pushed for manual review.

[0120] Specifically, first, the system performs shunting processing on the first monitoring result: any transaction that hits any regulatory bottom line rule, institutional internal control rule or dynamic adaptation rule and is marked as "clear violation" directly enters the S41 branch, that is, a violation alert is immediately generated and output, and such transactions will not enter the subsequent anomaly scoring and manual review links, so as to hold the compliance bottom line. For example, if a single cross-border transfer amount exceeds the annual foreign exchange purchase limit, the rule engine directly determines it as a violation, the system automatically records the violation type and pushes an alert to the risk control personnel.

[0121] Next, for the "clearly compliant" transactions in the first monitoring result, the system enters the S42 hierarchical decision-making stage. The system will obtain the anomaly score output by the time-series Transformer anomaly detection model, and perform three-level classification according to the two preset thresholds T1 and T2.

[0122] In the S43 stage, the manual review personnel review the transactions pushed to the queue and return the determination label. For example, for the above personal foreign exchange purchase behavior with an anomaly score of 0.55, after manual verification it is found that it is to evade supervision by splitting a large foreign exchange purchase into multiple small transactions, then the reviewer marks it as "violation"; if it is only a normal consumption fluctuation, it is marked as "normal".

[0123] Most importantly, the S44-based bidirectional mutual update mechanism is the core of this solution's self-evolution. On one hand, the system uses transaction data that has been manually confirmed as "violations" as negative samples, feeding them into the time-series Transformer anomaly detection model for incremental training. This allows the model to learn new violation pattern features, thereby more accurately identifying similar behaviors in subsequent monitoring.

[0124] Example 2

[0125] Based on the above embodiment one, this example also includes a rule matching acceleration and conflict resolution process in performing rigid compliance screening, including:

[0126] S25. Before rule matching, dynamically load the corresponding rule subset according to the business scenario type and credit rating of the main entity of the transaction data, and establish a hash index cache for high-frequency hit rules to accelerate the matching process.

[0127] S26. For rules with threshold amounts and frequency, an interval tree data structure is used for range matching, reducing the linear scan complexity of O(n) to O(logn).

[0128] S27. When a single transaction data point hits multiple rules with different judgment results, the rule conflict verification module is invoked to resolve the conflict according to the preset rule priority weight table. Among them, the priority of the regulatory bottom line rule layer is higher than that of the institutional internal control rule layer, the priority of the institutional internal control rule layer is higher than that of the dynamic adaptation rule layer, and the judgment result of the high priority rule covers the judgment result of the low priority rule.

[0129] S28. For rule combinations that still have logical contradictions after resolution, mark the transaction data as pending manual review and skip automatic judgment. At the same time, trigger the rule engine's abnormal alarm to prompt maintenance personnel to check the consistency of the rule base.

[0130] Specifically, the engine first loads only a subset of rules relevant to the current transaction scenario and the credit rating of the transaction entity from the hierarchical rule base, rather than traversing all rules. Simultaneously, for rules that have been frequently hit historically, the system creates a hash index cache, using the rule identifier or rule feature as the key to quickly locate the rule content and avoid duplicate parsing.

[0131] Step S26 then uses an interval tree data structure for range matching for both amount threshold rules and frequency threshold rules. An interval tree is a balanced binary search tree that can efficiently store intervals and complete queries in O(log n) time, significantly reducing matching time compared to the O(n) complexity of traditional linear scanning.

[0132] The engine first loads a subset of rules relevant to the current transaction scenario and the credit rating of the transaction entity from the hierarchical rule base, rather than traversing all rules. Simultaneously, for rules that have been frequently hit historically, the system creates a hash index cache, using the rule identifier or rule feature as the key to quickly locate the rule content and avoid duplicate parsing.

[0133] Step S26 then uses an interval tree data structure for range matching for both amount threshold rules and frequency threshold rules. An interval tree is a balanced binary search tree that can efficiently store intervals and complete queries in O(logn) time, significantly reducing matching time compared to the O(n) complexity of traditional linear scanning.

[0134] The engine first loads a subset of rules relevant to the current transaction scenario and the credit rating of the transaction entity from the hierarchical rule base, rather than traversing all rules. Simultaneously, for rules that have been frequently hit historically, the system creates a hash index cache, using the rule identifier or rule feature as the key to quickly locate the rule content and avoid duplicate parsing.

[0135] Step S26 then uses an interval tree data structure for range matching for both amount threshold rules and frequency threshold rules. An interval tree is a balanced binary search tree that can efficiently store intervals and complete queries in O(log n) time, significantly reducing matching time compared to the O(n) complexity of traditional linear scanning.

[0136] Example 3

[0137] This invention provides a non-transitory computer-readable storage medium storing at least one instruction or at least one program segment, which is loaded and executed by a processor to implement the following steps:

[0138] Acquire real-time cross-border capital flow transaction data streams and preprocess the transaction data streams to obtain transaction sample sequences;

[0139] The transaction sample sequence is input into the dynamic compliance rule engine to perform rigid compliance screening and output the first monitoring result;

[0140] The first monitoring result is input into the pre-trained optimized temporal Transformer anomaly detection model. The implicit temporal features of the transaction data are extracted through the temporal attention mechanism, and the anomaly score is calculated and output to generate the second monitoring result.

[0141] Based on a pre-defined fusion and collaboration mechanism, the first monitoring result and the second monitoring result are logically fused and hierarchically decided to generate the final compliance monitoring result.

[0142] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory, programmable ROM, electrically programmable ROM, electrically erasable programmable ROM, or flash memory. Volatile memory can include random access memory or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM, dynamic RAM, synchronous DRAM, dual data rate SDRAM, enhanced SDRAM, synchronous link DRAM, memory bus direct RAM, direct memory bus dynamic RAM, and memory bus dynamic RAM, etc.

[0143] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is used as an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0144] Example 4

[0145] This invention provides an electronic device, including a processor and a memory, wherein the memory stores at least one instruction or at least one program segment, and the at least one instruction or the at least one program segment is loaded and executed by the processor to implement the following steps:

[0146] Acquire real-time cross-border capital flow transaction data streams and preprocess the transaction data streams to obtain transaction sample sequences;

[0147] The transaction sample sequence is input into the dynamic compliance rule engine to perform rigid compliance screening and output the first monitoring result;

[0148] The first monitoring result is input into the pre-trained optimized temporal Transformer anomaly detection model. The implicit temporal features of the transaction data are extracted through the temporal attention mechanism, and the anomaly score is calculated and output to generate the second monitoring result.

[0149] Based on a pre-defined fusion and collaboration mechanism, the first monitoring result and the second monitoring result are logically fused and hierarchically decided to generate the final compliance monitoring result.

[0150] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine, characterized in that, Includes the following steps: S01. Obtain real-time cross-border capital flow transaction data stream and preprocess the transaction data stream to obtain a transaction sample sequence; S02. Input the transaction sample sequence into the dynamic compliance rule engine, perform rigid compliance screening, and output the first monitoring result; The first monitoring results include clearly compliant transactions and clearly non-compliant transactions; S03. Input the first monitoring result into the pre-trained optimized temporal Transformer anomaly detection model, extract the implicit temporal features of the transaction data through the temporal attention mechanism, calculate and output the anomaly score, and generate the second monitoring result. The implicit time-series characteristics include at least the transaction time interval, amount volatility, transaction frequency changes, and fund flow path deviation; S04. Based on a preset fusion and collaboration mechanism, the first monitoring result and the second monitoring result are logically fused and hierarchically decided to generate the final compliance monitoring result; The final compliance monitoring results include normal release, rule violation alarms, and time sequence anomalies pushed for manual review.

2. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 1, characterized in that, The step S01 of obtaining real-time cross-border capital flow transaction data stream includes: S11. Access the linked website in real time through a distributed message queue to obtain real-time cross-border payment messages, foreign exchange settlement and sales records, and cross-border investment and financing ledger data; S12. Perform multi-level caching processing on the cross-border payment messages, foreign exchange settlement and sales records and cross-border investment and financing ledger data, establish partition indexes according to transaction entity ID and timestamp, and form an ordered raw data stream buffer queue.

3. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 2, characterized in that, The preprocessing of the transaction data stream in step S01 to obtain a transaction sample sequence includes: S13. Extract the transaction dataset from the ordered raw data stream buffer queue and perform time-series slicing according to the preset sliding window step size and window width. S14. Generate a fixed-length time-series feature vector for each slice, wherein each time step in the time-series feature vector corresponds to a transaction record or a time aggregation unit; S15. Missing time steps are filled in using forward padding or linear interpolation to obtain a sequence of transaction samples with equal intervals and lengths.

4. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 3, characterized in that, The rigid compliance screening performed in step S02 includes: S21. Extract the transaction amount, transaction time, transaction frequency, information on the main entities of the payer and payee, and business background fields from the transaction dataset; S22. Input the extracted fields into the hierarchical rule base of the dynamic compliance rule engine for layer-by-layer matching. The hierarchical rule base includes at least a regulatory bottom line rule layer, an institutional internal control rule layer, and a dynamic adaptation rule layer. The regulatory bottom line rule layer stores mandatory foreign exchange regulatory rules that cannot be violated, the institutional internal control rule layer stores the internal risk control rules of financial institutions, and the dynamic adaptation rule layer stores new temporary screening rules generated based on historical violation data. S23. If the transaction data hits any prohibitive rule in any rule layer or exceeds the preset threshold condition, it will be immediately determined as a clear violation, the rule identifier, violation type and corresponding compliance basis will be recorded, and subsequent rule matching will be terminated. S24. If the transaction data does not hit any prohibitive rules and meets all necessary condition rules, it is determined as clearly compliant, and the transaction data is marked as data to be input into the time series anomaly detection engine.

5. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 1, characterized in that, Performing rigid compliance screening in step S02 further includes a rule matching acceleration and conflict resolution process, which comprises: S25. Before rule matching, dynamically load the corresponding rule subset according to the business scenario type and subject credit rating of the transaction data, and establish a hash index cache for high-frequency hit rules to accelerate the matching process; S26. For amount threshold type and frequency threshold type rules, a range tree data structure is used for range matching, reducing the linear scan complexity of O(n) to O(logn); S27. When a single piece of transaction data hits multiple rules with different determination results at the same time, invoke the rule conflict verification module to perform conflict resolution according to a preset rule priority weight table; Wherein, the priority of the regulatory bottom line rule layer is higher than that of the institutional internal control rule layer, the priority of the institutional internal control rule layer is higher than that of the dynamic adaptation rule layer, and the determination result of a higher-priority rule overrides the determination result of a lower-priority rule; S28. For rule combinations that still have logical contradictions after resolution, mark the transaction data as pending manual review and skip automatic determination, and simultaneously trigger an anomaly alarm of the rule engine to prompt maintenance personnel to check the consistency of the rule base.

6. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 1, characterized in that, Extracting implicit time series features and outputting anomaly scores through a pre-trained optimized time series Transformer anomaly detection model in step S03 comprises: S31. For transaction data that has been determined by the rule engine to be clearly compliant, construct a continuous time-series input matrix X=[X1,X2,...,X] according to a preset sliding window length. t ], where each time step X t It should contain feature vectors with at least four dimensions: transaction amount, transaction frequency, time interval, and fund path encoding. S32. Input the time series input matrix X into a Transformer encoder, calculate the global dependency relationship between different time steps through a multi-head self-attention mechanism, and output a high-dimensional time series feature matrix H; S33. Input the high-dimensional time series feature matrix H into a time series attention enhancement layer, perform weighted calculation on the features of each time step, enhance the feature expression of time steps with abnormal fluctuations, and obtain a weighted feature vector H'; S34. Input the weighted feature vector H' into a fully connected regression network, calculate the Mahalanobis distance D of the current transaction sequence relative to the pre-constructed normal behavior reference model, and generate an anomaly score S between 0 and 1.

7. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 6, characterized in that, Generating the anomaly score S in step S34 comprises: S341. Pre-extract the normal time series feature distribution through the time series Transformer anomaly detection model based on historical normal cross-border capital flow transaction data, and construct a normal behavior reference model, wherein the reference model includes the feature mean vector μ and covariance matrix Σ of each time step; S342. For the weighted feature vector H' of the real-time transaction sequence, calculate the Mahalanobis distance D between it and the normal behavior reference model; S343. Map the Mahalanobis distance D to the 0-1 interval through a Sigmoid function to obtain the anomaly score S; S344. Output the corresponding anomaly level according to the threshold interval where the anomaly score S is located: if S≤0.3, the transaction is determined to be normal; if 0.3<S<0.7, the transaction is determined to be suspected abnormal; if S≥0.7, the transaction is determined to be highly abnormal.

8. The method for real-time compliance monitoring of cross-border capital flows combining time-series anomaly detection and rule engine as described in claim 1, characterized in that, In step S04, performing logical fusion and hierarchical decision-making on the first monitoring result and the second monitoring result based on a preset fusion collaboration mechanism to generate a final compliance monitoring result includes: S41. Directly mark the clearly violating transactions in the first monitoring result as violation alarms and output the results; S42. For the clearly compliant transactions in the first monitoring result, obtain the corresponding abnormality score, and perform classification according to the following threshold rules: If the abnormality score is less than T1, it is determined to be normally released; If T1 ≤ the abnormality score < T2, it is determined to be suspected abnormality, and pushed to the first-level manual review queue; If the abnormality score is greater than or equal to T2, it is determined to be highly abnormal, pushed to the second-level emergency review queue, and a time-series abnormality warning is triggered; S43. Receive the judgment label returned by manual review, where the label includes: normal, violating, or expert judgment; S44. Use the transaction data confirmed to be violating as negative samples to perform incremental training on the time-series Transformer anomaly detection model; For transaction behaviors that are confirmed to be violating and not hit by the rule engine, automatically extract their time-series feature patterns and generate new rules, which are dynamically written into the hierarchical rule base of the rule engine after conflict verification.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, the steps of the real-time cross-border capital flow compliance monitoring method combining time-series anomaly detection and a rule engine according to any one of claims 1 to 8 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the steps of the real-time cross-border capital flow compliance monitoring method combining time-series anomaly detection and a rule engine according to any one of claims 1 to 8 are implemented.

Images