Machine learning based intelligent detection and early warning system and method for financial abnormal transactions

Abstract

The application discloses a machine learning-based financial abnormal transaction intelligent detection and early warning system and method, relates to the technical field of monitoring and analysis, and comprises the following steps: when the confrontation intention confidence score is in a preset fuzzy interval, adjusting interactive perturbation data and continuing to execute a behavior reflection discrimination cycle; when the confrontation intention confidence score is lower than the lower limit of the preset fuzzy interval, jumping out of the behavior reflection discrimination cycle and outputting low-risk release data; when the confrontation intention confidence score reaches a preset confirmation threshold, jumping out of the behavior reflection discrimination cycle, generating early warning blocking data containing a current operator identifier and a business serial number; and extracting historical low-risk transaction records of the current operator within a preset time window according to the early warning blocking data, recalculating risk scores of the historical low-risk transaction records, and outputting early warning records. The application has the effect of improving the efficiency of financial abnormal transaction intelligent detection and early warning.

Description

Technical Field

[0001] This application relates to the field of monitoring and analysis technology, and in particular to a machine learning-based intelligent detection and early warning system and method for abnormal financial transactions. Background Technology

[0002] Financial transaction data, as a crucial carrier of corporate cash flow and operational activities, directly reflects the status of fund payments, settlement approvals, and business execution. Its authenticity and compliance are related to the security of corporate assets and the effectiveness of internal controls. Meanwhile, human-computer interaction data during terminal operations records the behavioral rhythm of operators in stages such as amount entry, page switching, and submission confirmation. This accompanying data in the transaction formation process can reflect the stability and consistency of transaction execution from an operational perspective.

[0003] In real-world business scenarios, abnormal transactions don't necessarily manifest as a significant exceedance of limits. Some circumvention-oriented operations often involve splitting, rewriting, or submitting near the critical threshold around key boundaries such as approval limits and interception limits, creating a hidden correlation between transaction amounts and operational behaviors. Especially when transaction amounts approach control thresholds, operator pauses in data entry, amount modifications, page back navigation, and cursor movement changes may differ from normal business operations. These differences cannot be revealed by a single amount field but require comprehensive analysis combining transaction data and interaction process data.

[0004] However, existing financial risk control systems largely rely on fixed amount thresholds, blacklist rules, or post-event audit records for identification, primarily focusing on whether transaction results trigger rules, with less analysis of behavioral changes during the transaction generation process. For transactions approaching but not exceeding the threshold, traditional rules easily classify them as low-risk transactions and allow them to proceed; they also struggle to effectively distinguish between deliberate probing and repeated amount modifications that attempt to circumvent the rules. Furthermore, historically low-risk transactions are typically not reviewed after approval, making it difficult to reassess boundary-setting transactions by the same operator over a period of time, thus reducing the timeliness and targeted nature of financial anomaly transaction alerts. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this application provides a machine learning-based intelligent detection and early warning system and method for abnormal financial transactions.

[0006] Firstly, this application provides a machine learning-based intelligent detection and early warning method for abnormal financial transactions, including the following steps: Acquire the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction timing data; When the current transaction amount falls into the range near the preset interception threshold, the interaction feature vector is extracted from the human-computer interaction time sequence data; Compare the deviation between the interaction feature vector and the business interaction baseline model corresponding to the current operator's identifier; If the deviation exceeds the preset deviation threshold, the behavior reflex discrimination loop will be entered. The behavior reflection discrimination loop includes: injecting interaction perturbation data into the interface rendering data corresponding to the current business execution path data; collecting reflection interaction trajectory data during the effective period of the interaction perturbation data; extracting page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data; and generating an adversarial intent confidence score based on the page back frequency, amount re-entry magnitude, and cursor jitter frequency. When the confidence score of adversarial intent is within a preset fuzzy range, adjust the interaction perturbation data and continue to execute the behavior reflection discrimination loop; When the confidence score of the adversarial intent is lower than the lower limit of the preset fuzzy interval, the behavior reflection discrimination loop is exited and low-risk clearance data is output. When the confidence score of the adversarial intent reaches the preset confirmation threshold, the behavior reflection judgment loop is exited, and warning blocking data containing the current operator's identifier and business serial number is generated; Based on the warning and blocking data, extract the historical low-risk transaction records of the current operator within the preset time window, recalculate the risk score of the historical low-risk transaction records, and output the warning record.

[0007] Secondly, this application provides a machine learning-based intelligent detection and early warning system for abnormal financial transactions, including: The data acquisition module is used to obtain the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction time sequence data; The feature processing module is used to extract interaction feature vectors from human-computer interaction time series data when the current transaction amount falls into the vicinity of the preset interception threshold. The baseline management module is used to compare the deviation between the interaction feature vector and the business interaction baseline model corresponding to the current operator's identifier. The behavior reflection discrimination module is used to enter the behavior reflection discrimination loop if the deviation exceeds a preset deviation threshold. The behavior reflection discrimination loop includes: injecting interaction perturbation data into the interface rendering data corresponding to the current business execution path data; collecting reflection interaction trajectory data during the effective period of the interaction perturbation data; extracting page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data; and generating an adversarial intent confidence score based on the page back frequency, amount re-entry magnitude, and cursor jitter frequency. When the confidence score of adversarial intent is within a preset fuzzy range, adjust the interaction perturbation data and continue to execute the behavior reflection discrimination loop; When the confidence score of the adversarial intent is lower than the lower limit of the preset fuzzy interval, the behavior reflection discrimination loop is exited and low-risk clearance data is output. When the confidence score of the adversarial intent reaches the preset confirmation threshold, the behavior reflection judgment loop is exited, and warning blocking data containing the current operator's identifier and business serial number is generated; The early warning record module is used to extract the historical low-risk transaction records of the current operator within a preset time window based on the early warning blocking data, recalculate the risk score of the historical low-risk transaction records, and output the early warning record.

[0008] In summary, this application includes at least one of the following beneficial technical effects: 1. This application provides a machine learning-based intelligent detection and early warning method for abnormal financial transactions. By acquiring the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction time-series data, it correlates and analyzes the transaction result data with the operational behavior data during the transaction formation process. When the current transaction amount falls within the vicinity of a preset interception threshold, it does not directly make a judgment based on fixed amount rules. Instead, it extracts interaction feature vectors from the human-computer interaction time-series data and compares their deviation with the business interaction baseline model corresponding to the current operator's identifier. This allows it to identify instances where the same operator is involved in critical amount entry, page dwell, amount modification, and... Whether cursor movement and other aspects deviate from normal business habits, the above-mentioned processing method shifts the focus of early warning judgment from simply whether the amount exceeds the limit to also focusing on how the amount is formed. This effectively makes up for the identification lag caused by the reliance on fixed thresholds, static rules and post-audit in traditional financial risk control. At the same time, the current operator identification, current business execution path data, current transaction amount of the terminal and human-computer interaction time sequence data form a data closed loop under the same business context. This makes the deviation comparison have a clear individual reference basis, which can reduce misjudgment caused by differences in operating habits of different positions and personnel, and improve the ability to detect borderline avoidance transactions, tentative transaction submissions and abnormal amount rewriting behavior. 2. After the deviation exceeds a preset deviation threshold, the system further enters the behavior reflection judgment loop. Interactive perturbation data is injected into the interface rendering data corresponding to the current business execution path data, and reflection interaction trajectory data is collected during the effective period of the interactive perturbation data. An adversarial intent confidence score is generated from the frequency of page back navigation, the magnitude of amount re-entry, and the frequency of cursor jitter. This allows the system to observe the operator's actual reaction to slight interface perturbations, rather than relying solely on a single input result for risk assessment. When the adversarial intent confidence score is within a preset fuzzy range, the system adjusts the interactive perturbation data and continues to execute the behavior reflection judgment loop, thereby progressively confirming boundary samples. When the score is below the lower limit of the preset fuzzy range, low-risk release data is output. When the score reaches a preset confirmation threshold, early warning blocking data containing the current operator's identifier and business transaction number is generated, thus forming a clear release, re-judgment, and blocking triage mechanism. Furthermore, the system extracts historical low-risk transaction records of the current operator within a preset time window based on the early warning blocking data, recalculates the risk score, and outputs the early warning record, enabling low-risk transactions that had already been approved to be reviewed again in the new abnormal context. The above process combines the reflection judgment results of the current transaction with the proximity of the amount, time correlation, and personnel correlation of historical transactions, which not only improves the identification accuracy of a single abnormal transaction, but also enhances the ability to track continuous, split, and hidden financial abnormal behaviors. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a flowchart of a method for intelligent detection and early warning of abnormal financial transactions based on machine learning, as described in this application.

[0011] Figure 2 This is a schematic diagram of a system for intelligent detection and early warning of abnormal financial transactions based on machine learning, according to an embodiment of this application. Detailed Implementation

[0012] The following description, in conjunction with the implementation of the present invention, is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described, or use similar methods to replace them, as long as they do not deviate from the concept of the invention, and all such modifications and additions should fall within the protection scope of the present invention.

[0013] Example 1: This application is applicable to financial transaction scenarios such as corporate payments, expense reimbursements, supplier settlements, and fund transfers. Its core idea is not simply to use whether the current transaction amount exceeds a fixed limit as the basis for anomaly detection, but rather to process the current transaction amount and human-computer interaction timing data together under the same business serial number. When the transaction amount approaches a preset interception threshold, the system first determines whether the operator's operational rhythm deviates from their business interaction baseline model. If the deviation is high, it then introduces interaction perturbation data to observe the operator's behavioral reflection after being disturbed, generating an adversarial intent confidence score based on page back frequency, amount re-entry magnitude, and cursor jitter frequency. In this way, the object of financial anomaly transaction identification expands from a single transaction result to the transaction generation process, enabling more detailed handling of situations that are difficult to identify by fixed rules, such as critical amounts, repeated amount rewriting, and trial submissions.

[0014] This application discloses a machine learning-based intelligent detection and early warning method for abnormal financial transactions.

[0015] Reference Figure 1 A machine learning-based intelligent detection and early warning method for abnormal financial transactions includes the following steps: Acquire the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction timing data; Furthermore, the system acquires the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction time sequence data, including: Collect login session data and parse the current operator's identifier and business transaction number from the login session data; Read the page node sequence associated with the business serial number and generate the current business execution path data; The data acquisition terminal's business operation interface generates the underlying input event stream during the business input cycle; The underlying input event stream is split into key timestamp sequence, key value content sequence, and mouse coordinate sequence according to event type; The key-value sequence corresponding to the amount input box is concatenated according to the time order of the key timestamp sequence to generate the current transaction amount; Generate a keystroke rhythm time sequence based on the interval between adjacent timestamps in the keystroke timestamp sequence; Generate a cursor movement distance sequence based on the pixel span between adjacent coordinates in the mouse coordinate sequence; The keystroke rhythm time series and cursor movement distance series are aligned according to timestamps to generate human-computer interaction time series data corresponding to the current transaction amount.

[0016] In one specific implementation, the method is executed collaboratively by a data acquisition module, a feature processing module, a baseline management module, a behavior reflection discrimination module, and an early warning recording module within a financial anomaly transaction intelligent detection and early warning platform. The data acquisition module obtains the current operator identifier, current business execution path data, current transaction amount, and human-computer interaction timing data from login session data, page event logs, and transaction form data of the financial business system. The current operator identifier can be an employee number, job account identifier, or an anonymized account index; the current business execution path data consists of a sequence of page nodes and their corresponding node states under the same business transaction number, such as page nodes like the payment application page, payee confirmation page, amount entry page, and submission confirmation page, along with their entry time, exit time, and submission node identifier; the current transaction amount is derived from the concatenation of the key-value sequence of the amount input box, in yuan; and the human-computer interaction timing data is formed by aligning events such as key press times, mouse coordinates, and page focus changes with timestamps. All of the above data is bound to the same business transaction number to prevent the transaction amount and operation behavior from being separated from the same business context.

[0017] Specifically, after an operator logs into the financial business system and initiates a payment transaction, the data acquisition module first collects the login session data and then parses the current operator's identifier and transaction number from it. For example, the login session data includes account identifier U0236, session start time 2025-03-12 09:18:25, transaction number P202503120018, and job permission fields. The system retains the mapping relationship between the current operator's identifier and the transaction number. Subsequently, the system reads the page node sequence associated with the transaction number to generate the current business execution path data. This page node sequence is sorted by page arrival time, and each page node carries a page node identifier, page dwell time, form field set, and interface rendering status data, providing a clear data location when injecting interactive perturbation data at the submission node.

[0018] During the amount entry phase, the data acquisition module collects the underlying input event stream generated by the terminal's business operation interface within the business input cycle. The business input cycle can be defined as starting from the timestamp when the amount input box gains focus and ending at the timestamp when the amount input box loses focus or the submit button is triggered. The underlying input event stream typically includes fields such as event type, event timestamp, key value content, mouse horizontal coordinate, mouse vertical coordinate, and page focus indicator. The system splits the underlying input event stream according to event type into a key press timestamp sequence, a key value content sequence, and a mouse coordinate sequence. For example, the key press timestamp sequence is 09:20:01.120, 09:20:01.305, 09:20:01.467, 09:20:02.010, 09:20:02.185; the key value content sequence corresponding to the amount input box is 4, 9, 9, 9, 0; and the mouse coordinate sequence consists of several horizontal and vertical coordinate points in pixels. The system concatenates the key-value sequences corresponding to the amount input boxes according to the time sequence of the key timestamps to generate the current transaction amount, for example, 49,990 yuan. Because the key-value sequences are limited to the key-value sequences corresponding to the amount input boxes, and do not include input from the remarks box or the recipient search box, the data source for the current transaction amount is clear, and the unit remains monetary.

[0019] While generating the current transaction amount, the system generates a keystroke rhythm time sequence based on the interval between adjacent timestamps in the keystroke timestamp sequence. If two adjacent keystroke timestamps are respectively... and Both are in seconds, so the first... The keystroke rhythm time is Its physical meaning is the waiting time between two consecutive amount input actions, measured in seconds. This value can reflect the pause rhythm in the amount input process. For example, a longer wait before the last digit is entered often provides a closer picture of the transaction formation process than simply looking at the amount result.

[0020] The system also generates a cursor movement distance sequence based on the pixel span between adjacent coordinates in the mouse coordinate sequence. If two adjacent mouse coordinates are... and , The corresponding cursor movement distance is ,in, and They represent the first The mouse coordinates are the pixel positions on the screen in both the horizontal and vertical directions. The unit is pixels, and its physical meaning is the movement amplitude between adjacent mouse sampling points.

[0021] Next, the feature processing module aligns the keystroke rhythm time series and cursor movement distance series according to timestamps, generating human-computer interaction time series data corresponding to the current transaction amount. During time series alignment, a fixed time slice method can be used, for example, with 100 milliseconds as a time slice. Keystroke rhythm times and cursor movement distances falling within the same time slice are recorded under the same time node. If there are no keystroke events in a certain time slice, the keystroke rhythm field is set to a null value, and mouse movement data is retained. Subsequent dispersion calculations only count valid values. The resulting human-computer interaction time series data retains both the amount input behavior and the mouse trajectory changes before and after submission.

[0022] Furthermore, based on the above scheme, the acquisition process of current operator identification, current business execution path data, current transaction amount of the terminal, and human-computer interaction time sequence data can be configured with stricter data cleaning rules. After the login session data enters the data acquisition module, the system checks whether the session start time, account status, and business transaction number are complete. Data lacking a business transaction number is not included in subsequent deviation comparisons but is written to the abnormal acquisition log. When reading the page node sequence associated with the business transaction number, if the page node sequence lacks a submission node identifier, the system marks the current business execution path data as an incomplete path and only retains the current transaction amount and human-computer interaction time sequence data, without entering the interaction perturbation data injection. When splitting the underlying input event stream, the key press timestamp sequence, key value content sequence, and mouse coordinate sequence all retain the original timestamps. The timestamps are uniformly converted to millisecond-level Unix time to align the keystroke rhythm time sequence and cursor movement distance sequence under the same time base. The key value content sequence corresponding to the amount input box also filters out non-amount characters, such as separators, shortcut key identifiers, and function key identifiers, while retaining the editing actions corresponding to numbers, decimal points, and backspace. For backspace events, the system does not directly concatenate the backspace key value. Instead, it performs an editing operation on the concatenated amount string, deleting the last character, so that the current transaction amount is consistent with the actual value displayed in the input box.

[0023] When the current transaction amount falls into the range near the preset interception threshold, the interaction feature vector is extracted from the human-computer interaction time sequence data, and the deviation of the interaction feature vector is compared with the business interaction baseline model corresponding to the current operator's identifier.

[0024] Furthermore, the business interaction baseline model is generated in the following way: Retrieve historical transaction amounts and historical human-computer interaction time series data from archived normal transactions corresponding to the current operator's identifier; The historical human-computer interaction time series data are grouped according to the range of historical transaction amounts to obtain the interaction sample set of the amount range; Extract the keystroke rhythm distribution, amount modification frequency distribution, page dwell time distribution, and cursor movement distance distribution from the interaction sample set of amount ranges; The distribution of keystroke rhythm, number of amount modifications, page dwell time, and cursor movement distance are normalized and mapped to generate a business interaction baseline model for the current operator under different amount ranges.

[0025] Furthermore, when the current transaction amount falls within the vicinity of a preset interception threshold, an interaction feature vector is extracted from the human-computer interaction time-series data. This interaction feature vector is then compared with the deviation of the business interaction baseline model corresponding to the current operator's identifier, including: Calculate the distance between the current transaction amount and the preset interception threshold; When the amount falls into the adjacent range corresponding to the preset interception threshold, the last predetermined number of the amount segment in the current transaction amount is extracted. Locate the input time period corresponding to the predetermined amount segment at the end in the human-computer interaction time series data; Extract the number of amount modifications, the duration of the last digit, the keystroke rhythm dispersion, and the cursor movement distance dispersion within the input period to form an interaction feature vector; The deviation is obtained by calculating the difference between the interaction feature vector and the baseline vector of the same amount range in the business interaction baseline model, and then weighting and summing the differences.

[0026] In one specific implementation, the business interaction baseline model is pre-generated by the baseline management module and updated with historical data. The baseline management module obtains historical transaction amounts and historical human-computer interaction time series data from the archived normal transactions corresponding to the current operator's identifier. Archived normal transactions can come from transaction records in the audit system that have not been marked as abnormal, have not undergone return processing, and have completed the approval loop. The system groups the historical human-computer interaction time series data according to the amount range of historical transaction amounts to obtain an interaction sample set for each amount range. For example, 0 to 10,000 yuan, 10,000 to 30,000 yuan, 30,000 to 50,000 yuan, and above 50,000 yuan can be used as amount ranges, or the enterprise risk control system can set them in layers according to the approval amount. For each amount range interaction sample set, the baseline management module extracts the keystroke rhythm distribution, amount modification frequency distribution, page dwell time distribution, and cursor movement distance distribution. The keystroke rhythm distribution is derived from the mean, median, and quantile range of the historical keystroke rhythm time series; the amount modification frequency distribution is derived from the number of backspace, clear, and re-entry events within the amount input box; the page dwell time distribution is derived from the entry and exit times of each page node in the current business execution path data; and the cursor movement distance distribution is derived from the cumulative value and dispersion of the historical cursor movement distance series.

[0027] To ensure that data with different dimensions can be included in the same deviation comparison process, the baseline management module normalizes and maps the keystroke rhythm distribution, amount modification frequency distribution, page dwell time distribution, and cursor movement distance distribution to generate a business interaction baseline model for the current operator under different amount ranges. The normalization mapping can employ interval scaling, for example, for any feature value... The historical minimum value in the interaction sample set of this amount range and historical maximum value As the boundary, we obtain the normalized value. .in, This represents the behavioral feature value to be normalized. and These respectively represent the historical boundaries of the corresponding behavioral characteristics under the same current operator identifier and the same monetary range. It is a dimensionless value. If and If they are the same, then... The value is set to 0.5 to indicate that the feature fluctuates very little in historical normal transactions. The physical significance of this normalization process is that it compresses behavioral data in different units such as seconds, counts, and pixels to the same comparison scale, so that subsequent item-by-item difference calculations will not cause a certain type of data to be unreasonably amplified due to unit differences.

[0028] After the current transaction amount is generated on the terminal, the feature processing module calculates the distance between the current transaction amount and the preset interception threshold. If the current transaction amount is... The preset interception threshold is The monetary distance can then be expressed as ,in, and The unit for all values ​​is yuan. The unit is also yuan, and its physical meaning is the absolute proximity between the current transaction amount and the boundary of the institutional control. The preset interception threshold can be derived from the company's internal control system, for example, a single payment of 50,000 yuan will enter a higher level of approval; the adjacent range can be set as a preset ratio range above and below the preset interception threshold. For example, when the preset interception threshold is 50,000 yuan, the adjacent range can be 47,500 yuan to 50,000 yuan, or it can be determined by the distribution of critical transactions in historical audits. If the current transaction amount of 49,990 yuan falls into the adjacent range of the preset interception threshold, the system extracts the interaction feature vector from the human-computer interaction time series data and compares the deviation of the interaction feature vector with the business interaction baseline model corresponding to the current operator's identifier. If the current transaction amount does not fall into the adjacent range, this implementation does not trigger the behavior reflection judgment loop. The business data continues to flow according to the existing financial risk control process, while the current transaction amount and human-computer interaction time series data are retained as subsequent archived data.

[0029] During deviation comparison, the system first extracts a predetermined number of digits from the end of the current transaction amount. This predetermined number can be two to four digits; in this example, it's three digits. For the current transaction amount of 49,990 yuan, the predetermined number of digits is 990. This predetermined number of digits is used because avoidance modifications to critical amounts are usually concentrated at the end of the digits, such as changing 50,000 to 49,990. Input pauses, deletions, and re-entries at the end of the digits better reflect the operation process. The system locates the input time period corresponding to the predetermined number of digits in the human-computer interaction time sequence data. For example, it finds the keystroke timestamp interval corresponding to the numbers 9, 9, and 0, and extends it forward and backward by 300 milliseconds to preserve cursor movement and pause information before and after input.

[0030] Subsequently, the number of amount modifications, the duration of the last digit's dwell time, the keystroke rhythm dispersion, and the cursor movement distance dispersion are extracted from the input period to form an interaction feature vector. The number of amount modifications is the statistical number of amount input events such as backspace, clear, and select all within the input period; the duration of the last digit's dwell time is the time difference between the completion of the input of the last digit of the predetermined number of amount segments and the loss of focus of the amount input box, in seconds; the keystroke rhythm dispersion can be the standard deviation of the effective keystroke rhythm time, in seconds; and the cursor movement distance dispersion can be the standard deviation of the effective cursor movement distance, in pixels.

[0031] To avoid the influence of different feature units on the deviation comparison, the system normalizes each feature in the interaction feature vector according to the baseline vector of the same amount range in the business interaction baseline model before calculating the difference of each item. The current feature after normalization is In the business interaction baseline model, the baseline vector of the same amount range is the first... Item for , No. Item weight is Then the deviation It can be represented as ,in, and All are dimensionless values. The weights are dimensionless, and the sum of the weights is 1. It is also a dimensionless value. The physical meaning of this formula is to convert the current operator's behavioral deviation at the critical amount input point into a distance on a uniform scale. The larger the value, the more the current transaction behavior deviates from the common operational patterns in its archived normal transactions. The weights can be determined by the contribution of different features in historical audit data to anomaly differentiation. For example, the weight for the number of amount modifications is 0.35, the weight for the duration of the last digit's stay is 0.25, the weight for keystroke rhythm dispersion is 0.20, and the weight for cursor movement distance dispersion is 0.20. The preset deviation threshold can be determined based on the historical normal transaction deviation distribution corresponding to the current operator's identifier. For example, the 95th percentile of the historical normal transaction deviation can be used, so that the behavior reflection discrimination loop only enters when the deviation exceeds the preset deviation threshold, reducing interference with daily transactions.

[0032] Specifically, during the generation of the business interaction baseline model, the baseline management module performs a minimum sample size check on the archived normal transactions corresponding to the current operator's identifier. For example, if the interaction sample set for the same amount range is less than 30, the system does not immediately generate a separate business interaction baseline model for the current operator within that amount range. Instead, it supplements the sample with archived normal transactions from the same position and within the same approval authority, and marks the sample source ratio in the model record. As the number of archived normal transactions corresponding to the current operator's identifier increases, the system gradually increases the weight of individual samples. The keystroke rhythm distribution, amount modification frequency distribution, page dwell time distribution, and cursor movement distance distribution are all stored using amount ranges as indexes, so that when the current transaction amount falls into a certain amount range, the system can directly read the baseline vector under the same amount range. After this processing, the business interaction baseline model can reflect the current operator's personal operating habits and will not cause unstable deviation comparisons due to insufficient early samples.

[0033] During the deviation comparison process, the preset interception threshold and adjacent range are not hard-coded into the program, but are provided by the risk control configuration table. The risk control configuration table can store different preset interception thresholds according to transaction type, payment account, approval organization, and job authority. After calculating the amount distance, the system first determines the transaction type of the current transaction, and then reads the corresponding preset interception threshold and adjacent range. If the transaction type is supplier payment, the preset interception threshold can be 50,000 yuan, and the adjacent range can be an amount range no more than 2,500 yuan away from the preset interception threshold; if the transaction type is internal reserve fund transfer, the preset interception threshold can be configured separately according to the system. When extracting the last predetermined number of digits of the amount segment, the system simultaneously records the keystroke timestamp of each digit of the amount segment to locate the input time period in the human-computer interaction time sequence data. The end point of the dwell time of the last digit is preferentially taken as the time when the amount input box loses focus; if the operator directly clicks the submit button, the submit button trigger time is taken. The resulting interaction feature vector is not a rough statistical analysis of the entire page behavior, but is formed around the input behavior at the critical amount end, which is more in line with the data change position in the critical transaction avoidance scenario.

[0034] If the deviation exceeds the preset deviation threshold, the behavior reflex discrimination loop will be entered. The behavior reflection discrimination loop includes: injecting interaction perturbation data into the interface rendering data corresponding to the current business execution path data; collecting reflection interaction trajectory data during the effective period of the interaction perturbation data; extracting page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data; and generating an adversarial intent confidence score based on the page back frequency, amount re-entry magnitude, and cursor jitter frequency. Furthermore, interactive perturbation data is injected into the UI rendering data corresponding to the current business execution path data, including: Read the submission node identifier and UI rendering status data from the current business execution path data; Interactive perturbation data is generated based on the submission node identifier. The interactive perturbation data includes asynchronous loading duration data, additional verification field data, and perturbation level data. Write the asynchronous loading duration data into the submission response field of the UI rendering state data, and write the additional validation field data into the form field set of the UI rendering state data. Record the write timestamp of the interactive perturbation data, and generate the effective period of the interactive perturbation data based on the write timestamp; A mapping relationship is established between the perturbation level data and the writing timestamp to form a perturbation execution record.

[0035] Furthermore, reflection interaction trajectory data is collected during the effective period of the interaction perturbation data, including: The starting point of the effective period of the interactive perturbation data is used as the collection starting point, and the page event stream after the collection starting point is captured; Extract the page back event, amount input event, mouse move event, and page focus switch event from the page event stream; The page back event, amount input event, mouse movement event, and page focus switching event are sorted according to the time of occurrence to generate reflection interaction trajectory data; Establish a mapping relationship between the reflection interaction trajectory data and the current transaction amount, interaction perturbation data, and perturbation execution record under the same business serial number.

[0036] Furthermore, page back frequency, amount re-entry magnitude, and cursor jitter frequency are extracted from the reflection interaction trajectory data, including: Count the number of page back events in the reflection interaction trajectory data to generate the page back frequency; Extract the current transaction amount before the interactive perturbation data takes effect, and extract the last amount value corresponding to the amount input event in the reflected interaction trajectory data; The absolute value of the difference between the current transaction amount and the last transaction amount is converted proportionally according to the current transaction amount to generate the amount re-entry range; The number of adjacent movement direction changes is calculated based on the mouse movement events in the reflected interaction trajectory data, and the ratio of the number of adjacent movement direction changes to the effective time period of the interaction perturbation data is converted to generate the cursor jitter frequency. The frequency of page back navigation, the amount of data re-entry, and the frequency of cursor jitter are combined into a reflection feature vector.

[0037] Furthermore, an adversarial intent confidence score is generated based on the frequency of page back navigation, the amount re-entered, and the cursor jitter frequency, including: Obtain the historical reflection feature vectors corresponding to confirmed circumvention transactions and confirmed normal transactions from the historical audit records; Calculate the first similarity between the reflection feature vector and the historical reflection feature vector corresponding to the confirmed circumvention transaction, and the second similarity between the reflection feature vector and the historical reflection feature vector corresponding to the confirmed normal transaction. The attribution strength of the reflected feature vector is determined based on the difference between the first similarity and the second similarity. The attribution strength and deviation are weighted and aggregated to generate a confidence score for adversarial intent.

[0038] In one specific implementation, if the deviation exceeds a preset deviation threshold, the behavior reflection discrimination module enters a behavior reflection discrimination loop. The first step of this loop is to inject interactive perturbation data into the interface rendering data corresponding to the current business execution path data. The behavior reflection discrimination module reads the submission node identifier and interface rendering status data from the current business execution path data. The submission node identifier is used to determine the location of the perturbation, for example, the page node where the payment submission button is located; the interface rendering status data records the response status of the submission button, the set of form fields, the validation prompt area, the asynchronous loading status, and other page rendering fields. The system generates interactive perturbation data based on the submission node identifier. The interactive perturbation data includes asynchronous loading duration data, additional validation field data, and perturbation level data. The asynchronous loading duration data can be a short loading delay of 0.8 seconds to 2.5 seconds. The additional validation field data can be rendering data for fields such as payment recipient confirmation and amount / case accuracy confirmation. The perturbation level data indicates the intensity of the perturbation data in this round of interaction. For example, Level 1 indicates only a short asynchronous loading duration data is written; Level 2 indicates a longer asynchronous loading duration data is written and additional validation field data is added; Level 3 indicates extending the validation field dwell time based on Level 2. The system writes the asynchronous loading duration data to the submit response field in the interface rendering status data, writes the additional validation field data to the form field set in the interface rendering status data, records the write timestamp of the interaction perturbation data, and generates the effective period of the interaction perturbation data based on the write timestamp. If the write timestamp is 09:21:10.000, the asynchronous loading duration data is 1.5 seconds, and the additional validation field data dwells for 2.0 seconds, then the effective period of the interaction perturbation data can be set to 09:21:10.000 to 09:21:12.000. The system also establishes a mapping relationship between the perturbation level data and the writing timestamp to form a perturbation execution record. The perturbation execution record is bound to the same business serial number to ensure that the previous round of judgment results can be used when the perturbation level is upgraded in the future.

[0039] During the effective period of the interactive perturbation data, the behavior reflection discrimination module collects reflective interaction trajectory data. The collection starts from the beginning of the effective period of the interactive perturbation data and extracts the page event stream after that point. The page event stream includes page back events, amount input events, mouse movement events, and page focus switching events. The system extracts these events from the page event stream and sorts them according to their occurrence time to generate reflective interaction trajectory data. For example, after the interactive perturbation data takes effect, if the operator first moves the cursor to the amount input box, then deletes the last digit, then returns to the previous page to view the approval prompt, and finally resubmits, these actions will be organized into reflective interaction trajectory data arranged by time. The system establishes a mapping relationship between the reflective interaction trajectory data and the current transaction amount, interactive perturbation data, and perturbation execution record under the same business serial number, so that each round of behavior reflection discrimination can be traced back to the corresponding transaction amount, perturbation level, and page status.

[0040] Subsequently, the behavior reflection discrimination module extracts page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data. Page back frequency is directly calculated from the number of page back events in the reflection interaction trajectory data, measured in times. Physically, it represents the number of times the operator returns to the previous page to check or adjust business information after the interaction perturbation data takes effect. The calculation of amount re-entry magnitude first extracts the current transaction amount before the interaction perturbation data takes effect, and then extracts the last amount value corresponding to the amount input event in the reflection interaction trajectory data. If the current transaction amount before the interaction perturbation data takes effect is... The last amount was The amount to be re-recorded ,in, and The unit is yuan, and It is a positive number. This is a dimensionless proportional value, its physical meaning being the relative change in the amount after being re-entered due to the influence of interactive perturbation data. If the current transaction amount is 49,990 yuan and the last amount was 48,990 yuan, then the amount re-entry magnitude is approximately 0.020, indicating that the transaction amount underwent a relative rewrite of approximately 2.0% after the interactive perturbation data took effect. The cursor jitter frequency is calculated based on the number of adjacent movement direction changes from mouse movement events in the reflected interaction trajectory data, and then converted into a ratio between the number of adjacent movement direction changes and the effective period of the interactive perturbation data. If the number of adjacent movement direction changes is... The effective period of the interactive perturbation data is [length missing]. The cursor jitter frequency is calculated in seconds. The unit is times per second, and its physical meaning is the frequency of cursor movement direction changes per unit time. The page back frequency, amount re-entry magnitude, and cursor jitter frequency are combined into a reflection feature vector. The three components of the reflection feature vector correspond to the number of times, the proportion, and times per second, respectively, and are used for subsequent similarity calculation after normalization.

[0041] To generate a confidence score for adversarial intent, the behavior reflection discrimination module obtains historical reflection feature vectors corresponding to confirmed circumvention transactions and confirmed normal transactions from historical audit records. Historical audit records can come from archived data such as auditor confirmation results, return reasons, and anomaly handling records. The system calculates the first similarity between the reflection feature vector and the historical reflection feature vector corresponding to confirmed circumvention transactions, and the second similarity between the reflection feature vector and the historical reflection feature vector corresponding to confirmed normal transactions. Similarity can be obtained using normalized Euclidean distance transformation, for example, the first similarity... ,in, The second similarity is the Euclidean distance between the reflection feature vector and the center of the historical reflection feature vector corresponding to the confirmed circumvention transaction; ,in, Let be the Euclidean distance between the centers of the reflected feature vector and the historical reflected feature vectors corresponding to confirmed normal transactions. Since the components of the reflected feature vector have been normalized... and All are dimensionless distances. and Both fall within the range of 0 to 1, and their physical meanings are the degree to which the current reflection behavior closely approximates a confirmed evasion transaction and a confirmed normal transaction, respectively. The system determines the attribution strength of the reflection feature vector based on the difference between the first similarity and the second similarity, for example, the attribution strength. ,in, This is a dimensionless value. The closer the value is to 1, the closer the current reflection feature vector is to a confirmed circumvented transaction; the closer the value is to 0, the closer it is to a confirmed normal transaction.

[0042] Finally, the system weights and sums the attribution strength and deviation to generate a confidence score for adversarial intent. If the deviation... Normalized to the range of 0 to 1, confidence score of adversarial intent It can be represented as ,in, This is the weight, and its value can be 0.6. Indicates the attribution of behavior after being subjected to interactive perturbation data. This indicates the operational deviation before the injection of interactive perturbation data. It uses a dimensionless scoring system. This scoring system places abnormal inputs before the transaction and the reaction behavior after being disturbed on the same scale, which can avoid making overly strong judgments based on a single amount modification or a single page rollback.

[0043] Specifically, when injecting interactive perturbation data into the interface rendering data corresponding to the current business execution path data, the behavior reflection judgment module does not change substantive business fields such as transaction amount, recipient, and approval rules. Instead, it writes asynchronous loading duration data and additional validation field data into the interface rendering state data. After the asynchronous loading duration data is written to the submission response field, the page displays a brief loading state in the submission confirmation area. After the additional validation field data is written to the form field set, the page displays non-substantive modification fields such as adding amount capitalization verification and recipient reconfirmation. After establishing a mapping relationship between the perturbation level data and the writing timestamp, the system can distinguish the intensity of interactive perturbation data in different rounds, preventing the analysis of reflection interaction trajectory data generated under different perturbation levels from being mixed together. The effective period of interactive perturbation data is jointly determined by the writing timestamp, asynchronous loading duration data, and the dwell time of the additional validation field data. The start and end points of the collection window are clear, which is conducive to maintaining consistency in the calculation of page back frequency, amount re-entry magnitude, and cursor jitter frequency.

[0044] When collecting reflected interaction trajectory data during the effective period of the interactive perturbation data, the page event stream first enters the event buffer, which is then stored in segments according to the business serial number. The behavior reflection discrimination module uses the start point of the effective period of the interactive perturbation data as the collection starting point and intercepts the page event stream backward. The interception duration can cover the effective period of the interactive perturbation data and the subsequent short observation period, for example, extending it by 3 seconds after the effective period ends to collect the user's supplementary actions after the prompt disappears. Page back events are categorized by browser back, page next button, and reverse jump of path nodes; amount input events include adding characters, deleting characters, overwriting and pasting, and clearing and re-entering in the amount input box; mouse movement events retain coordinates and timestamps; page focus switching events record the movement of focus from the submit button, amount input box, and payment object field. After sorting by the event occurrence time, the reflected interaction trajectory data can reflect the actual behavior sequence after the interactive perturbation data takes effect, rather than just retaining the summary statistics. Although this sequence information is further refined when generating page rollback frequency, amount re-entry range, and cursor jitter frequency, it is still saved using the same business serial number for subsequent retrieval of warning records.

[0045] In the generation of reflection feature vectors, page back frequency, amount re-entry amplitude, and cursor jitter frequency cover behavioral reflections at three levels: page path, amount content, and cursor trajectory, respectively. When counting page back frequency, events that repeatedly trigger the same page back control with an interval of less than 200 milliseconds can be merged into one to avoid duplicate counting due to double-clicks. The last amount value corresponding to an amount input event is based on the last stable display value of the amount input box within the effective period and its observation period. The stable display value can be defined as the amount value for which no amount input event has occurred within 500 milliseconds. When calculating the number of adjacent movement direction changes for cursor jitter frequency, the system first calculates the movement direction angle based on adjacent mouse coordinates, and then compares the changes in adjacent direction angles. When the direction angle change exceeds a preset angle threshold, it is counted as one adjacent movement direction change. The preset angle threshold can be 45 degrees to exclude minor sampling jitter in normal straight-line movement. The cursor jitter frequency obtained in this way is closer to the behavioral amplitude of an operator repeatedly hesitating and moving back and forth after being disturbed, rather than the fine noise of the mouse device itself.

[0046] When generating the confidence score for adversarial intent, the historical reflection feature vectors corresponding to confirmed circumvention transactions and confirmed normal transactions in historical audit records are updated periodically. Confirmed circumvention transactions can include transactions confirmed by audits to involve splitting payments, altering threshold amounts, or circumventing approval levels; confirmed normal transactions can include threshold transactions that have been manually reviewed and confirmed to have reasonable business basis. To avoid an excessive number of samples of one type affecting similarity, the system can first calculate the center vectors of the two types of historical reflection feature vectors separately, and then calculate the distance between the reflection feature vector and the center vector. If there are large differences within a certain type of historical reflection feature vector, multiple center vectors can be formed by grouping according to transaction type, and the center vector with the highest similarity can be used to participate in the calculation of the first and second similarity scores. When weighting and summarizing the attribution strength and deviation, the weights are... This can be determined by reviewing historical audit records from the previous quarter, i.e., in different... The system calculates the false positive rate of archived samples based on a given value, selecting a value that minimizes the false positive rate and keeps the number of reviews manageable. Thus, the adversarial intent confidence score is not simply a conclusion drawn from a general model, but is calculated using a clear data path based on reflection feature vectors, historical audit records, and deviation.

[0047] When the confidence score of adversarial intent is within a preset fuzzy range, adjust the interaction perturbation data and continue to execute the behavior reflection discrimination loop; When the confidence score of the adversarial intent is lower than the lower limit of the preset fuzzy interval, the behavior reflection discrimination loop is exited and low-risk clearance data is output. When the confidence score of the adversarial intent reaches the preset confirmation threshold, the behavior reflection judgment loop is exited, and warning blocking data containing the current operator's identifier and business serial number is generated; Based on the warning and blocking data, extract the historical low-risk transaction records of the current operator within the preset time window, recalculate the risk score of the historical low-risk transaction records, and output the warning record.

[0048] Furthermore, when the confidence score of adversarial intent falls within a preset fuzzy range, the interaction perturbation data is adjusted and the behavior reflex discrimination loop continues to be executed, including: Read the interaction perturbation data, perturbation execution records, reflection interaction trajectory data, and adversarial intent confidence score in the current behavior reflection discrimination loop; The current perturbation level is determined based on the perturbation level data in the perturbation execution record; When the confidence score of the adversarial intent is within the preset fuzzy range, the current perturbation level is increased by one level, and updated interactive perturbation data is generated; Write the updated interactive perturbation data into the interface rendering data corresponding to the current business execution path data, and collect the next round of reflection interaction trajectory data; When the perturbation level reaches the preset maximum level and the confidence score of the adversarial intent does not reach the preset confirmation threshold, the behavior reflection discrimination loop ends and a record to be reviewed is generated.

[0049] Furthermore, based on the early warning blocking data, historical low-risk transaction records of the current operator within a preset time window are extracted. The risk score for these historical low-risk transaction records is recalculated, and early warning records are output, including: The system analyzes the current operator's identifier, current transaction amount, confidence score of the intent to obstruct, and business transaction number from the early warning and blocking data. Extract historical low-risk transaction records within a preset time window that are below a preset interception threshold based on the current operator's identification; Extract historical transaction amounts, historical recipients, and historical submission times from historical low-risk transaction records; Based on the similarity between historical transaction amounts and current transaction amounts, the number of times historical recipients were repeated, and the interval between historical submission time and the submission time corresponding to the business serial number, the risk score of historical low-risk transaction records was recalculated. Read the reflection interaction trajectory data under the same business serial number based on the business serial number; The recalculated risk score, business serial number, reflection interaction trajectory data, and current operator identifier are combined to generate an early warning record.

[0050] In one specific implementation, the behavior reflection discrimination loop has clearly defined branches and termination conditions. The preset fuzzy range can be determined by the boundary distribution of false alarm samples and missed alarm samples in historical audit records, for example, between 0.45 and 0.70; the preset confirmation threshold can be above 0.70; and the preset lower limit of the fuzzy range is 0.45. If the confidence score of the adversarial intent is lower than the preset lower limit of the fuzzy range, the behavior reflection discrimination module exits the behavior reflection discrimination loop and outputs low-risk release data. The low-risk release data may include the current operator's identifier, business transaction number, current transaction amount, deviation, adversarial intent confidence score, and discrimination time, for continued record keeping of the transaction process. If the adversarial intent confidence score reaches the preset confirmation threshold, the system exits the behavior reflection discrimination loop and generates warning blocking data containing the current operator's identifier and business transaction number. The warning blocking data may also record the current transaction amount, adversarial intent confidence score, triggered perturbation level data, and reflection interaction trajectory data index, facilitating subsequent review of the transaction formation process by auditors.

[0051] When the confidence score for adversarial intent falls within a preset fuzzy range, the behavior reflection discrimination module does not directly issue a high-risk conclusion. Instead, it adjusts the interaction perturbation data and continues executing the behavior reflection discrimination loop. At this point, the system reads the interaction perturbation data, perturbation execution records, reflection interaction trajectory data, and adversarial intent confidence score from the current behavior reflection discrimination loop. Based on the perturbation level data in the perturbation execution records, it determines the current perturbation level. If the current perturbation level is level one, and the confidence score for adversarial intent is still within the preset fuzzy range, the system raises the current perturbation level by one level, generating updated interaction perturbation data. The updated interaction perturbation data still includes asynchronous loading duration data, additional verification field data, and perturbation level data; only the asynchronous loading duration data and additional verification field data are adjusted according to the perturbation level. Subsequently, the system writes the updated interaction perturbation data into the interface rendering data corresponding to the current business execution path data, collects the next round of reflection interaction trajectory data, and extracts the page back frequency, amount re-entry magnitude, and cursor jitter frequency again to generate a new adversarial intent confidence score. If the perturbation level reaches the preset maximum level and the confidence score of the adversarial intent does not reach the preset confirmation threshold, the system terminates the behavior reflection judgment loop and generates a record to be reviewed. The record to be reviewed is not the same as the early warning blocking data. It includes the business serial number, the current operator's identifier, the confidence score of the adversarial intent in each round, the perturbation level data in each round, and the reflection interaction trajectory data index, which facilitates the viewing of boundary samples during manual auditing.

[0052] After generating the warning blocking data, the warning recording module extracts historical low-risk transaction records of the current operator within a preset time window based on the warning blocking data, recalculates the risk score for the historical low-risk transaction records, and outputs the warning record. The warning recording module first parses the current operator's identifier, current transaction amount, confidence score of the anti-intention intent, and business transaction number from the warning blocking data. The preset time window can be set to 7 days, 15 days, or 30 days depending on the frequency of the enterprise's financial transactions; in this embodiment, 30 days is used. The system extracts historical low-risk transaction records below the preset interception threshold within the preset time window based on the current operator's identifier. These records did not previously trigger the interception rules, but after the same current operator's identifier appears in the warning blocking data, the risk score needs to be recalculated in conjunction with the current business context. For each historical low-risk transaction record, the historical transaction amount, historical recipient, and historical submission time are extracted. The system recalculates the risk score for the historical low-risk transaction record based on the closeness between the historical transaction amount and the current transaction amount, the number of times the historical recipient is repeated, and the interval between the historical submission time and the submission time corresponding to the business transaction number. For example, if the historical transaction amount is... The current transaction amount is The degree of closeness of the amounts Desirable ,in, and The unit for all values ​​is yuan. This is a dimensionless value representing the relative closeness between historical and current transaction amounts. If the result is less than 0, it is treated as 0 to avoid negative values ​​when the amount difference is too large. The number of times a historical recipient is repeated can be converted into repetition intensity. For example, the number of times the same historical payment recipient appears within a preset time window is [number missing]. Repeatability ,in, For the number of times, This is a dimensionless value, representing the degree to which a payment recipient appears repeatedly within a preset time window. The interval between historical submission times and the submission times corresponding to business transaction numbers can be converted into time proximity. ,For example ,in, This represents the number of days between the historical submission time and the submission time corresponding to the business serial number. The preset time window length is in days. A dimensionless value representing the temporal proximity of two transactions; if equal ,but The risk score is 0. It can be represented as ,in, and The weights are 1, and the sum is 1. A confidence score for counter-intent is assigned. The physical meaning of this risk score is to convert the correlation between historical low-risk transaction records and current alerted transactions in terms of amount, recipient, submission time, and behavioral risk into a unified score, thereby reordering approved transactions in a new context. The alert record module reads the reflected interaction trajectory data under the same business transaction number based on the business transaction number, and merges the recalculated risk score, business transaction number, reflected interaction trajectory data, and current operator identifier to generate an alert record. The alert record can be written to the audit database, and its fields include business transaction number, current operator identifier, current transaction amount, counter-intent confidence score, trigger time, reflected interaction trajectory data index, list of historical low-risk transaction records, and corresponding risk score.

[0053] in, and Confirmation can be performed by replaying archived audit samples. Specifically, this involves selecting confirmed abnormal transactions and confirmed normal transactions from historical audit records, and calculating the degree of similarity in amounts for each sample. Repeatability Time proximity and confidence score of adversarial intent ; in satisfying And given that all weights are greater than 0, adjust according to the preset step size. and Perform combined enumerations, for example, with a preset step size of 0.05; for each set of weights, substitute it into the risk score. The obtained risk scores are compared with the confirmation results in historical audit records. The recall rate of confirmed abnormal transactions ranked above a preset risk percentile and the pass rate of confirmed normal transactions ranked below a preset risk percentile are calculated. Provided the recall rate reaches a preset recall threshold, the group with the highest pass rate is selected as the weighted average. and This confirmation method uses four weights determined by the actual audit results of historical transactions. This ensures that the risk score takes into account factors such as similar amounts, duplicate recipients, similar submission times, and current behavioral risks. It also prevents the recalculation of historical low-risk transaction records from being biased towards a single factor due to the arbitrary fixing of a certain weight.

[0054] Specifically, when the adversarial intent confidence score is within a preset fuzzy range, the adjustment of the interaction perturbation data remains gradual. If the first round of perturbation level data is level one, the updated interaction perturbation data can adjust the asynchronous loading duration from 0.8 seconds to 1.5 seconds and add additional verification field data; if it is still within the preset fuzzy range after the second round, the current perturbation level is raised to level three, and the dwell time of the additional verification field data is further increased. After each round of behavior reflection discrimination loop, the system writes the current round of interaction perturbation data, perturbation execution record, reflection interaction trajectory data, and adversarial intent confidence score into the loop record under the same business serial number. The preset maximum level can be level three to avoid the discrimination loop causing excessive waiting time for normal business. If the perturbation level reaches the preset maximum level and the adversarial intent confidence score does not reach the preset confirmation threshold, the system generates a record to be reviewed instead of continuing to add intensity. The setting of the record to be reviewed allows the boundary samples to retain a manual judgment entry point, while avoiding process blockage caused by the loop not being able to terminate.

[0055] During the early warning record generation phase, the recalculation of historical low-risk transaction records does not involve re-evaluating all historical transactions. Instead, it uses the current operator identifier and business transaction number from the early warning blocking data as entry points to extract historical low-risk transaction records within a preset time window that are below a preset interception threshold. The historical transaction amount, historical recipient, and historical submission time in these records are compared with the current transaction amount and the submission time corresponding to the business transaction number. If multiple historical low-risk transaction records are close to the current transaction amount in terms of amount, and the historical recipient has a high frequency of repetition, the risk score will increase accordingly. Conversely, if the historical submission time is far from the submission time corresponding to the current business transaction number, the time proximity decreases, and the risk score decreases accordingly. The system reads the reflection interaction trajectory data under the same business transaction number and merges the recalculated risk score, business transaction number, reflection interaction trajectory data, and current operator identifier to generate an early warning record. The early warning record retains the reflection interaction trajectory data, allowing auditors to trace the sequence of events such as page back events, amount input events, mouse movement events, and page focus switching events when reviewing the risk score, thereby correlating the scoring results with the original operation process.

[0056] In a practical application example, the current operator, U0236, initiates a transaction with transaction number P202503120018, corresponding to a current transaction amount of 49,990 yuan. The preset interception threshold is 50,000 yuan, and the adjacent range is 47,500 yuan to 50,000 yuan. The system collects two amount modification events in the human-computer interaction time sequence data for this transaction, with the last digit remaining for 3.2 seconds. The keystroke rhythm dispersion is higher than the business interaction baseline model for the current operator in the 30,000 to 50,000 yuan amount range, and the calculated deviation is 0.62, while the preset deviation threshold is 0.55. Therefore, the system enters the behavior reflection judgment loop. The first round of interaction perturbation data is written with asynchronous loading time data of 1.0 second and first-level perturbation level data. During the effective period, one page focus switching event and a low cursor jitter frequency are collected. The generated adversarial intent confidence score is 0.52, which is within the preset fuzzy range. The system upgraded the perturbation level data to level two, and the updated interaction perturbation data added additional verification fields. In the second round of reflection interaction trajectory data, a page back event occurred, and the last amount value corresponding to the amount input event changed to 48,990 yuan, with an increased cursor jitter frequency. Based on this, the system generated a new reflection feature vector, calculated the first and second similarities using historical audit records, and ultimately obtained an adversarial intent confidence score of 0.76, reaching the preset confirmation threshold. The system then generated warning blocking data containing the current operator's identifier and business transaction number, and extracted historical low-risk transaction records within 30 days below the preset interception threshold based on the current operator's identifier. For transactions with historical transaction amounts close to 49,990 yuan and repeated historical recipients, the risk score was recalculated. Finally, the recalculated risk score, business transaction number, reflection interaction trajectory data, and current operator's identifier were merged to generate a warning record. Throughout the process, each piece of data comes from the same business transaction number and its associated historical records. The current transaction amount, human-computer interaction time sequence data, interaction feature vector, deviation, reflection interaction trajectory data, and adversarial intent confidence score are sequentially linked to form a traceable intelligent detection and early warning data chain for abnormal financial transactions.

[0057] Example 2: This application also discloses a machine learning-based intelligent detection and early warning system for abnormal financial transactions.

[0058] Reference Figure 2 A machine learning-based intelligent detection and early warning system for abnormal financial transactions includes: The data acquisition module is used to obtain the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction time sequence data; The feature processing module is used to extract interaction feature vectors from human-computer interaction time series data when the current transaction amount falls into the vicinity of the preset interception threshold. The baseline management module is used to compare the deviation between the interaction feature vector and the business interaction baseline model corresponding to the current operator's identifier. The behavior reflection discrimination module is used to enter the behavior reflection discrimination loop if the deviation exceeds a preset deviation threshold. The behavior reflection discrimination loop includes: injecting interaction perturbation data into the interface rendering data corresponding to the current business execution path data; collecting reflection interaction trajectory data during the effective period of the interaction perturbation data; extracting page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data; and generating an adversarial intent confidence score based on the page back frequency, amount re-entry magnitude, and cursor jitter frequency. When the confidence score of adversarial intent is within a preset fuzzy range, adjust the interaction perturbation data and continue to execute the behavior reflection discrimination loop; When the confidence score of the adversarial intent is lower than the lower limit of the preset fuzzy interval, the behavior reflection discrimination loop is exited and low-risk clearance data is output. When the confidence score of the adversarial intent reaches the preset confirmation threshold, the behavior reflection judgment loop is exited, and warning blocking data containing the current operator's identifier and business serial number is generated; The early warning record module is used to extract the historical low-risk transaction records of the current operator within a preset time window based on the early warning blocking data, recalculate the risk score of the historical low-risk transaction records, and output the early warning record.

[0059] The above content is merely an example and illustration of the concept of the present invention. Those skilled in the art can make various modifications or additions to the specific embodiments described or use similar methods to replace them, as long as they do not deviate from the concept of the invention, they should all fall within the protection scope of the present invention.

[0060] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0061] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to any specific implementation. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention.

Claims

1. A machine learning-based intelligent detection and early warning method for abnormal financial transactions, characterized in that, Includes the following steps: Acquire the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction timing data; When the current transaction amount falls into the range near the preset interception threshold, the interaction feature vector is extracted from the human-computer interaction time sequence data; Compare the deviation between the interaction feature vector and the business interaction baseline model corresponding to the current operator's identifier; If the deviation exceeds the preset deviation threshold, the behavior reflex discrimination loop will be entered. The behavior reflection discrimination loop includes: injecting interaction perturbation data into the interface rendering data corresponding to the current business execution path data; collecting reflection interaction trajectory data during the effective period of the interaction perturbation data; extracting page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data; and generating an adversarial intent confidence score based on the page back frequency, amount re-entry magnitude, and cursor jitter frequency. When the confidence score of adversarial intent is within a preset fuzzy range, adjust the interaction perturbation data and continue to execute the behavior reflection discrimination loop; When the confidence score of the adversarial intent is lower than the lower limit of the preset fuzzy interval, the behavior reflection discrimination loop is exited and low-risk clearance data is output. When the confidence score of the adversarial intent reaches the preset confirmation threshold, the behavior reflection judgment loop is exited, and warning blocking data containing the current operator's identifier and business serial number is generated; Based on the warning and blocking data, extract the historical low-risk transaction records of the current operator within the preset time window, recalculate the risk score of the historical low-risk transaction records, and output the warning record.

2. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 1, characterized in that, Obtain the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction time sequence data, including: Collect login session data and parse the current operator's identifier and business transaction number from the login session data; Read the page node sequence associated with the business serial number and generate the current business execution path data; The data acquisition terminal's business operation interface generates the underlying input event stream during the business input cycle; The underlying input event stream is split into key timestamp sequence, key value content sequence, and mouse coordinate sequence according to event type; The key-value sequence corresponding to the amount input box is concatenated according to the time order of the key timestamp sequence to generate the current transaction amount; Generate a keystroke rhythm time sequence based on the interval between adjacent timestamps in the keystroke timestamp sequence; Generate a cursor movement distance sequence based on the pixel span between adjacent coordinates in the mouse coordinate sequence; The keystroke rhythm time series and cursor movement distance series are aligned according to timestamps to generate human-computer interaction time series data corresponding to the current transaction amount.

3. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 1, characterized in that, The business interaction baseline model is generated in the following way: Retrieve historical transaction amounts and historical human-computer interaction time series data from archived normal transactions corresponding to the current operator's identifier; The historical human-computer interaction time series data are grouped according to the range of historical transaction amounts to obtain the interaction sample set of the amount range; Extract the keystroke rhythm distribution, amount modification frequency distribution, page dwell time distribution, and cursor movement distance distribution from the interaction sample set of amount ranges; The distribution of keystroke rhythm, number of amount modifications, page dwell time, and cursor movement distance are normalized and mapped to generate a business interaction baseline model for the current operator under different amount ranges.

4. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 3, characterized in that, When the current transaction amount falls within the range of a preset interception threshold, an interaction feature vector is extracted from the human-computer interaction time-series data. This interaction feature vector is then compared with the deviation of the business interaction baseline model corresponding to the current operator's identifier, including: Calculate the distance between the current transaction amount and the preset interception threshold; When the amount falls into the adjacent range corresponding to the preset interception threshold, the last predetermined number of the amount segment in the current transaction amount is extracted. Locate the input time period corresponding to the predetermined amount segment at the end in the human-computer interaction time series data; Extract the number of amount modifications, the duration of the last digit, the keystroke rhythm dispersion, and the cursor movement distance dispersion within the input period to form an interaction feature vector; The deviation is obtained by calculating the difference between the interaction feature vector and the baseline vector of the same amount range in the business interaction baseline model, and then weighting and summing the differences.

5. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 1, characterized in that, Inject interactive perturbation data into the UI rendering data corresponding to the current business execution path data, including: Read the submission node identifier and UI rendering status data from the current business execution path data; Interactive perturbation data is generated based on the submission node identifier. The interactive perturbation data includes asynchronous loading duration data, additional verification field data, and perturbation level data. Write the asynchronous loading duration data into the submission response field of the UI rendering state data, and write the additional validation field data into the form field set of the UI rendering state data. Record the write timestamp of the interactive perturbation data, and generate the effective period of the interactive perturbation data based on the write timestamp; A mapping relationship is established between the perturbation level data and the writing timestamp to form a perturbation execution record.

6. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 5, characterized in that, During the effective period of the interactive perturbation data, reflective interaction trajectory data were collected, including: The starting point of the effective period of the interactive perturbation data is used as the collection starting point, and the page event stream after the collection starting point is captured; Extract the page back event, amount input event, mouse move event, and page focus switch event from the page event stream; The page back event, amount input event, mouse movement event, and page focus switching event are sorted according to the time of occurrence to generate reflection interaction trajectory data; Establish a mapping relationship between the reflection interaction trajectory data and the current transaction amount, interaction perturbation data, and perturbation execution record under the same business serial number.

7. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 6, characterized in that, Extract page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflected interaction trajectory data, including: Count the number of page back events in the reflection interaction trajectory data to generate the page back frequency; Extract the current transaction amount before the interactive perturbation data takes effect, and extract the last amount value corresponding to the amount input event in the reflected interaction trajectory data; The absolute value of the difference between the current transaction amount and the last transaction amount is converted proportionally according to the current transaction amount to generate the amount re-entry range; The number of adjacent movement direction changes is calculated based on the mouse movement events in the reflected interaction trajectory data, and the ratio of the number of adjacent movement direction changes to the effective time period of the interaction perturbation data is converted to generate the cursor jitter frequency. The frequency of page back navigation, the amount of data re-entry, and the frequency of cursor jitter are combined into a reflection feature vector.

8. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 7, characterized in that, An adversarial intent confidence score is generated based on page back frequency, amount re-entry magnitude, and cursor jitter frequency, including: Obtain the historical reflection feature vectors corresponding to confirmed circumvention transactions and confirmed normal transactions from the historical audit records; Calculate the first similarity between the reflection feature vector and the historical reflection feature vector corresponding to the confirmed circumvention transaction, and the second similarity between the reflection feature vector and the historical reflection feature vector corresponding to the confirmed normal transaction. The attribution strength of the reflected feature vector is determined based on the difference between the first similarity and the second similarity. The attribution strength and deviation are weighted and aggregated to generate a confidence score for adversarial intent.

9. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 5, characterized in that, When the confidence score of adversarial intent falls within a preset fuzzy range, the interaction perturbation data is adjusted and the behavior reflection discrimination loop continues, including: Read the interaction perturbation data, perturbation execution records, reflection interaction trajectory data, and adversarial intent confidence score in the current behavior reflection discrimination loop; The current perturbation level is determined based on the perturbation level data in the perturbation execution record; When the confidence score of the adversarial intent is within the preset fuzzy range, the current perturbation level is increased by one level, and updated interactive perturbation data is generated; Write the updated interactive perturbation data into the interface rendering data corresponding to the current business execution path data, and collect the next round of reflection interaction trajectory data; When the perturbation level reaches the preset maximum level and the confidence score of the adversarial intent does not reach the preset confirmation threshold, the behavior reflection discrimination loop ends and a record to be reviewed is generated.

10. The intelligent detection and early warning method for abnormal financial transactions based on machine learning according to claim 1, characterized in that, Based on the early warning and blocking data, extract the historical low-risk transaction records of the current operator within a preset time window, recalculate the risk score for the historical low-risk transaction records, and output early warning records, including: The system analyzes the current operator's identifier, current transaction amount, confidence score of the intent to obstruct, and business transaction number from the early warning and blocking data. Extract historical low-risk transaction records within a preset time window that are below a preset interception threshold based on the current operator's identification; Extract historical transaction amounts, historical recipients, and historical submission times from historical low-risk transaction records; Based on the similarity between historical transaction amounts and current transaction amounts, the number of times historical recipients were repeated, and the interval between historical submission time and the submission time corresponding to the business serial number, the risk score of historical low-risk transaction records was recalculated. Read the reflection interaction trajectory data under the same business serial number based on the business serial number; The recalculated risk score, business serial number, reflection interaction trajectory data, and current operator identifier are combined to generate an early warning record.

11. A machine learning-based intelligent detection and early warning system for abnormal financial transactions, applied to the machine learning-based intelligent detection and early warning method for abnormal financial transactions as described in any one of claims 1-10, characterized in that, include: The data acquisition module is used to obtain the current operator's identifier, current business execution path data, current transaction amount on the terminal, and human-computer interaction time sequence data; The feature processing module is used to extract interaction feature vectors from human-computer interaction time series data when the current transaction amount falls into the vicinity of the preset interception threshold. The baseline management module is used to compare the deviation between the interaction feature vector and the business interaction baseline model corresponding to the current operator's identifier. The behavior reflection discrimination module is used to enter the behavior reflection discrimination loop if the deviation exceeds a preset deviation threshold. The behavior reflection discrimination loop includes: injecting interaction perturbation data into the interface rendering data corresponding to the current business execution path data; collecting reflection interaction trajectory data during the effective period of the interaction perturbation data; extracting page back frequency, amount re-entry magnitude, and cursor jitter frequency from the reflection interaction trajectory data; and generating an adversarial intent confidence score based on the page back frequency, amount re-entry magnitude, and cursor jitter frequency. When the confidence score of adversarial intent is within a preset fuzzy range, adjust the interaction perturbation data and continue to execute the behavior reflection discrimination loop; When the confidence score of the adversarial intent is lower than the lower limit of the preset fuzzy interval, the behavior reflection discrimination loop is exited and low-risk clearance data is output. When the confidence score of the adversarial intent reaches the preset confirmation threshold, the behavior reflection judgment loop is exited, and warning blocking data containing the current operator's identifier and business serial number is generated; The early warning record module is used to extract the historical low-risk transaction records of the current operator within a preset time window based on the early warning blocking data, recalculate the risk score of the historical low-risk transaction records, and output the early warning record.

Images