Abnormal behavior detection method and device based on time sequence behavior sequence, storage medium and computer device

Abstract

The application discloses a kind of abnormal behavior detection method, device, storage medium and computer equipment based on time sequence behavior sequence, involve artificial intelligence technical field, can be applied to financial field, main purpose is in solving the problem of the detection accuracy of existing cheating behavior is poor. Including: obtaining the multidimensional behavior data of user, multidimensional behavior data is used to represent the behavior data generated by user participating in different financial business activities;Determine behavior edge sequence and behavior node based on multidimensional behavior data, and construct time sequence behavior graph based on behavior edge sequence and behavior node;Abnormal detection is carried out on time sequence behavior graph based on graph auto-encoding decoder, obtain behavior anomaly detection result, and behavior scoring is carried out based on abnormal detection result, obtain behavior scoring result, abnormal detection result includes edge adjacency matrix and node attribute, graph auto-encoding decoder is constructed based on heterogeneous graph attention network, and is trained based on normal behavior training sample.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology and can be applied to the financial field, particularly to an abnormal behavior detection method, device, storage medium, and computer equipment based on time-series behavior sequences. Background Technology

[0002] With the rapid development of big data, the financial sector is introducing big data processing technologies such as machine learning into financial marketing activities to meet rapidly changing market demands and identify fraudulent and other abnormal behaviors. Fraudulent behavior refers to the malicious misappropriation of marketing subsidies, such as sign-in rewards, lottery prizes, group-buying rebates, and points-based quiz prizes, by black market groups through methods like mass account manipulation, falsifying behavioral data, and using machine scripts. They then profit by engaging in activities like order padding and reselling prizes, severely infringing on the rights of legitimate users. Therefore, identifying fraudulent and other abnormal behaviors is a key focus of technological research and development for financial institutions.

[0003] Currently, the identification of abnormal behavior is typically based on single-point rules, which have limited capabilities and may rely on restrictions such as the same IP address, device fingerprint blacklists, or the same delivery address. However, these methods struggle to detect collaborative cheating behavior across time and users. Furthermore, single-point rules have a high false negative rate for new cheating methods such as device fingerprint forgery and click behavior simulation, and cannot cover the correlation detection of cheating behavior across multiple activity scenarios, including ad clicks, check-ins, lotteries, group buying, commission rebates, and points-based guessing games, significantly reducing the accuracy of cheating detection. Summary of the Invention

[0004] In view of this, this application provides a method, apparatus, storage medium and computer device for detecting abnormal behavior based on time-series behavior sequences, with the main purpose of solving the problem of poor detection accuracy of existing cheating behaviors.

[0005] According to one aspect of this application, an abnormal behavior detection method based on a temporal behavior sequence is provided, comprising: Acquire multidimensional behavioral data of users, which is used to characterize the behavioral data generated by users participating in different financial business activities; Based on the multidimensional behavioral data, behavioral edge sequences and behavioral nodes are determined, and a temporal behavioral graph is constructed based on the behavioral edge sequences and behavioral nodes. Anomaly detection is performed on the temporal behavior graph based on a graph autoencoder to obtain behavior anomaly detection results. Behavior scoring is then performed based on the anomaly detection results to obtain behavior scoring results. The anomaly detection results include an edge adjacency matrix and node attributes. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained on normal behavior training samples.

[0006] Furthermore, determining the behavior edge sequence and behavior nodes based on the multidimensional behavior data includes: Determine behavior nodes based on the user's basic data in the multidimensional behavior data; The time attribute, activity attribute, result attribute, and environment attribute are extracted from the multidimensional behavioral data, and the behavioral edge sequence is created using the time attribute, activity attribute, result attribute, and environment attribute.

[0007] Furthermore, before performing anomaly detection on the temporal behavior graph based on the graph autoencoder / decoder to obtain the behavior anomaly detection result, the method further includes: Obtain normal behavior training samples and construct a training sample graph based on the normal behavior training samples. The training sample graph includes an edge adjacency matrix that marks normal behavior and node attributes. The encoder in the graph autoencoder is constructed based on the heterogeneous graph attention network, and the decoder of the graph autoencoder is used to reconstruct the edge adjacency matrix and node attributes; The graph autoencoder is trained based on the training sample graph.

[0008] Furthermore, the anomaly detection results obtained by performing anomaly detection on the temporal behavior graph based on the graph autoencoder decoder include: Node feature vectors are extracted according to the behavior nodes, and the encoder is used to encode different types of behavior edge sequences to obtain timestamp codes; The node feature vector and the timestamp encoding are fused to obtain the encoded latent vector, and the encoded latent vector is reconstructed based on the decoder to obtain the edge adjacency matrix and the node attributes.

[0009] Furthermore, the behavior scoring based on the anomaly detection results to obtain the behavior scoring results includes: Calculate the degree of difference between the node attribute and the time attribute, the activity attribute, the result attribute, and the environment attribute; The first degree of deviation between the behavior node and the historical behavior is calculated based on Mahalanobis distance; The second degree of deviation is obtained by comparing the baseline subgraph structure with the subgraph structure in the time-series behavior graph. The behavior score is obtained by weighted fusion based on the degree of difference, the first degree of deviation, and the second degree of deviation.

[0010] Furthermore, after constructing the temporal behavior graph based on the behavior edge sequence and the behavior nodes, the method further includes: Based on the temporal graph mining algorithm, multiple subgraph structures are extracted from the temporal behavior graph. The subgraph structures are used to represent user behavior sequences with specific temporal relationships and activity type combinations. Based on the multidimensional behavioral data, the potential collaborative cheating behaviors are identified by matching them with the collaborative cheating feature library and marked in the subgraph structure to display the potential collaborative cheating behaviors in the subgraph structure.

[0011] Furthermore, after obtaining the behavior score result by performing behavior scoring based on the anomaly detection result, the method further includes: The behavioral risk level is determined based on the behavioral score results, and a graded intervention strategy is determined based on the behavioral risk level. The graded intervention strategy includes blocking strategy, de-weighting strategy and secondary verification strategy. The user behavior is intervened and processed based on the aforementioned tiered intervention strategy.

[0012] According to another aspect of this application, an abnormal behavior detection device based on a time-series behavior sequence is provided, comprising: The acquisition module is used to acquire multidimensional behavioral data of users, which is used to characterize the behavioral data generated by users participating in different financial business activities. A module is created to determine the behavior edge sequence and behavior nodes based on the multidimensional behavior data, and to construct a time-series behavior graph based on the behavior edge sequence and behavior nodes. The detection module is used to perform anomaly detection on the temporal behavior graph based on the graph autoencoder to obtain behavior anomaly detection results, and to perform behavior scoring based on the anomaly detection results to obtain behavior scoring results. The anomaly detection results include edge adjacency matrix and node attributes. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained based on normal behavior training samples.

[0013] Furthermore, the creation module is specifically used to determine behavior nodes according to the user basic data in the multidimensional behavior data; extract time attributes, activity attributes, result attributes and environmental attributes from the multidimensional behavior data, and use the time attributes, activity attributes, result attributes and environmental attributes to create the behavior edge sequence.

[0014] Furthermore, the device also includes: The training module is used to acquire normal behavior training samples and construct a training sample graph based on the normal behavior training samples. The training sample graph includes an edge adjacency matrix and node attributes that label normal behavior. The encoder in the graph autoencoder is constructed based on a heterogeneous graph attention network. The decoder of the graph autoencoder is used to reconstruct the edge adjacency matrix and node attributes. The model of the graph autoencoder is trained based on the training sample graph.

[0015] Furthermore, the detection module is specifically used to extract node feature vectors according to the behavior nodes, and to encode different types of behavior edge sequences through the encoder to obtain timestamp codes; to fuse the node feature vectors and the timestamp codes to obtain encoded latent vectors, and to reconstruct the encoded latent vectors based on the decoder to obtain the edge adjacency matrix and the node attributes.

[0016] Furthermore, the detection module is specifically used to calculate the degree of difference between the node attribute and the time attribute, the activity attribute, the result attribute, and the environmental attribute; calculate the first degree of deviation between the behavior node and historical behavior based on Mahalanobis distance; compare the baseline subgraph structure with the subgraph structure in the time-series behavior graph to obtain the second degree of deviation; and perform weighted fusion based on the degree of difference, the first degree of deviation, and the second degree of deviation to obtain the behavior score result.

[0017] Furthermore, the device also includes: The extraction module is used to extract multiple subgraph structures from the temporal behavior graph based on the temporal graph mining algorithm. The subgraph structures are used to represent user behavior sequences with specific temporal relationships and activity type combinations. The matching module is used to match the multidimensional behavioral data with the collaborative cheating feature library, identify potential collaborative cheating behaviors, and mark them in the subgraph structure to display the potential collaborative cheating behaviors in the subgraph structure.

[0018] Furthermore, the device also includes: The processing module is used to determine the behavior risk level based on the behavior scoring results, and to determine a graded intervention strategy based on the behavior risk level. The graded intervention strategy includes a blocking strategy, a demotion strategy, and a secondary verification strategy; and to intervene in user behavior based on the graded intervention strategy.

[0019] According to another aspect of this application, a storage medium is provided, wherein at least one executable instruction is stored therein, the executable instruction causing a processor to perform operations corresponding to the above-described abnormal behavior detection method based on time-series behavior sequences.

[0020] According to another aspect of this application, a computer device is provided, comprising: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction, which causes the processor to perform the operation corresponding to the above-described abnormal behavior detection method based on time-series behavior sequences.

[0021] By employing the above technical solutions, the technical solutions provided in the embodiments of this application have at least the following advantages: This application provides a method, apparatus, storage medium, and computer device for detecting abnormal behavior based on time-series behavioral sequences. Compared with existing technologies, the embodiments of this application acquire multi-dimensional behavioral data of users, which characterizes behavioral data generated by users participating in different financial business activities; determine behavioral edge sequences and behavioral nodes based on the multi-dimensional behavioral data, and construct a time-series behavioral graph based on the behavioral edge sequences and behavioral nodes; perform anomaly detection on the time-series behavioral graph based on a graph autoencoder / decoder to obtain behavioral anomaly detection results, and perform behavioral scoring based on the anomaly detection results to obtain behavioral scoring results. The anomaly detection results include the edge adjacency matrix and node attributes. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained on normal behavior training samples. It uses multi-dimensional behavioral data to construct a temporal behavior graph, characterizing the temporal sequence of behavior and entity associations. This enables the association mining of cheating behaviors across time, users, and multiple business scenarios, avoiding situations where single-point rules are difficult to identify collaborative cheating. At the same time, by using the graph autoencoder constructed based on the heterogeneous graph attention network for graph anomaly detection, it can effectively identify new cheating methods such as device fingerprint forgery and behavior simulation, reduce the false negative rate, and greatly improve the detection accuracy of cheating and other abnormal behaviors.

[0022] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0023] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart of an abnormal behavior detection method based on a temporal behavior sequence provided in an embodiment of this application is shown; Figure 2 This illustration shows a block diagram of an abnormal behavior detection device based on a time-series behavior sequence, according to an embodiment of this application. Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0024] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] Based on this, in one embodiment, the present invention provides an abnormal behavior detection method based on time-series behavior sequences. Taking the application of this method to computer devices such as servers as an example, the server can be an independent server or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms.

[0027] This application provides an abnormal behavior detection method based on a time-series behavior sequence, such as... Figure 1 As shown, the method includes: 101. Obtain multidimensional behavioral data of users.

[0028] In this embodiment of the application, the current execution entity, as the execution end for detecting abnormal user behavior, can obtain multi-dimensional behavioral data of different users from the financial application system or financial application. At this time, the multi-dimensional behavioral data is used to characterize the behavioral data generated by the user's participation in different financial business activities, and may include, but is not limited to, attributes such as user ID, activity type, behavior type (participation / completion / receiving / sharing, etc.), behavior timestamp, behavior result, device information, IP address, and geographical location.

[0029] It should be noted that the multidimensional behavioral data in this application embodiment can be obtained by collecting data generated from marketing activities based on the data collection module of the user logging into different financial applications. The user's behavioral attributes can be collected in real time by calling the data interface of the data collection module. This application embodiment does not make specific limitations.

[0030] 102. Determine the behavior edge sequence and behavior nodes based on the multidimensional behavior data, and construct a temporal behavior graph based on the behavior edge sequence and behavior nodes.

[0031] In this embodiment, the behavior nodes can be constructed from a user dimension, with one node corresponding to one user. Behavior edges are used to represent the sequence relationship of user behavior, that is, the relationship between the behaviors of different users, in order to construct a time-series behavior graph. Each edge can carry multi-dimensional attributes from the behavior data, which may include, but are not limited to, time attributes, activity attributes, result attributes, and environmental attributes.

[0032] In one specific embodiment, the obtained temporal behavior graph can be stored using a graph database (such as Neo4j) or a distributed graph storage system, supporting real-time incremental updates and historical backtracking queries.

[0033] In another embodiment of this application, for further definition and explanation, the step of determining the behavior edge sequence and behavior node based on the multidimensional behavior data includes: Determine behavior nodes based on the user's basic data in the multidimensional behavior data; The time attribute, activity attribute, result attribute, and environment attribute are extracted from the multidimensional behavioral data, and the behavioral edge sequence is created using the time attribute, activity attribute, result attribute, and environment attribute.

[0034] To uncover anomalies in user behavior and improve the accuracy of abnormal behavior identification, when determining behavior edge sequences and behavior nodes, the current execution end first determines behavior nodes based on user basic data in the multidimensional behavior data. User basic data refers to data used to represent user identity, such as user name, user ID number, and user mobile phone number, to uniquely bind nodes in the graph. Therefore, behavior nodes are based on a user's user basic data; for example, one user ID matches one behavior node. This application embodiment does not impose specific limitations.

[0035] Furthermore, time attributes, activity attributes, result attributes, and environmental attributes are extracted from the multidimensional behavioral data. Here, the time attribute represents the timestamp of the behavior, the duration of the behavior, and the time interval between adjacent behaviors; the activity attribute represents the activity type, activity ID, and activity parameters; the activity type can include check-in, prize, group buying, commission rebate, points-based guessing, etc.; the result attribute represents the behavior result, the type and quantity of the reward obtained; the behavior result can be success, failure, suspected cheating, etc.; the environmental attribute represents device fingerprint, IP address range, geographical location, etc., without specific limitations in this embodiment. During attribute extraction, the data can be directly extracted and then divided into attributes; this embodiment does not impose specific limitations on this either.

[0036] Finally, behavioral edge sequences are created using time attributes, activity attributes, result attributes, and environment attributes. Each edge represents a sequence of user behaviors, and each edge includes multi-dimensional attributes.

[0037] 103. Perform anomaly detection on the temporal behavior graph based on the graph autoencoder decoder to obtain behavior anomaly detection results, and perform behavior scoring based on the anomaly detection results to obtain behavior scoring results.

[0038] In this embodiment, a graph autoencoder / decoder is pre-trained to encode and decode the constructed temporal behavior graph to obtain anomaly detection results. These results include the edge adjacency matrix and node attributes obtained by decoding and reconstructing the temporal behavior graph. The graph autoencoder / decoder is constructed based on a heterogeneous graph attention network and trained using normal behavior training samples. The heterogeneous graph attention network is used to encode the temporal behavior graph; however, this embodiment does not impose specific limitations on its implementation.

[0039] Furthermore, after obtaining the anomaly detection results, the edge adjacency matrix and node attributes are used to score the behavior of each user, which can then be displayed as a specific score.

[0040] It should be noted that the abnormal behavior detection in this embodiment can be deployed using a microservice architecture and interface with the marketing campaign system via a RESTful API or message queue. It supports both real-time detection and offline analysis modes, with real-time detection latency controlled within 100ms to meet the immediate response needs of users participating in activities. Simultaneously, it provides a management dashboard for operations personnel to view fraud detection statistics, risk trends, intervention records, and model performance evaluations.

[0041] In another embodiment of this application, for further definition and explanation, before the step of performing anomaly detection on the temporal behavior graph based on a graph autoencoder / decoder to obtain the behavior anomaly detection result, the method further includes: Obtain normal behavior training samples, and construct a training sample graph based on the normal behavior training samples; Constructing the encoder in a graph autoencoder / decoder based on a heterogeneous graph attention network; The graph autoencoder is trained based on the training sample graph.

[0042] To achieve the goal of encoding and decoding heterogeneous graphs and thus improve the accuracy of behavior analysis, a graph self-encoder / decoder is pre-trained. Specifically, when constructing the graph self-encoder / decoder, an encoder is first built based on a heterogeneous graph attention network, mapping behavior nodes to the latent space. This allows the decoder to reconstruct the adjacency matrix and node attributes of the graph based on the latent vectors. Simultaneously, normal behavior training samples are obtained, and a training sample graph is constructed based on these samples. This training sample graph includes the edge adjacency matrix and node attributes labeling normal behavior, and the graph self-encoder / decoder is then trained using this training sample graph.

[0043] In one specific embodiment, each normal behavior sample contains multiple types of heterogeneous data contained in the user node, such as access interface, computer equipment, and operational resources. Behavioral edges are determined based on different types of relationships, such as user-check-in activity edges, user-lottery activity edges, and user-group buying relationship edges. Using each user as a graph node and different behavioral relationships as edges, nodes and edges are encoded to construct a training sample graph of the heterogeneous graph. This graph only contains nodes and connections corresponding to normal behaviors and does not include abnormal behavior data. Furthermore, a graph autoencoder / decoder framework is constructed, consisting of an encoder and a decoder. The encoder is built using a heterogeneous graph attention network (HAN). For various node and edge types in the heterogeneous graph, a multi-head attention mechanism is set up, and attention feature aggregation is performed independently for each relationship subgraph to learn the feature weights corresponding to different entity interaction relationships. Through a hierarchical network, neighbor node features are fused layer by layer, mapping the high-dimensional heterogeneous graph input to a low-dimensional latent vector space, and outputting the embedded representation corresponding to the sample graph. The decoder employs a multilayer perceptron (MLP) to receive low-dimensional latent vectors from the encoder and reconstruct the node features and adjacency structure of the original heterogeneous graph. Finally, multiple training sample graphs representing normal behavior are input into the encoder-decoder in batches for unsupervised training. The training loss function is the sum of the structural reconstruction loss and the node feature reconstruction loss, and the encoder is used to obtain the graph embedding. Furthermore, the decoder can reconstruct the topological structure and node attributes of the input sample graphs, continuously backpropagating to optimize network parameters and minimize reconstruction error. The training constraint is set to use only normal behavior sample graphs throughout the training process, allowing the model to learn the heterogeneous topological distribution corresponding to normal behavior.

[0044] In a model training example, independent attention parameters are used for learning, and the node update formula for the l-th layer is expressed as: ; in, This represents the set of neighboring nodes of node v under relation r. Let (v, u) be the attention weights of the edge (v, u) under relation r. Let be the parameter matrix of relation r, and σ be the activation function. Let U be the representation of node u at level l, and R be the set of real numbers.

[0045] In another embodiment of this application, for further definition and explanation, the step of performing anomaly detection on the temporal behavior graph based on a graph autoencoder / decoder to obtain behavior anomaly detection results includes: Node feature vectors are extracted according to the behavior nodes, and the encoder is used to encode different types of behavior edge sequences to obtain timestamp codes; The node feature vector and the timestamp encoding are fused to obtain the encoded latent vector, and the encoded latent vector is reconstructed based on the decoder to obtain the edge adjacency matrix and the node attributes.

[0046] To achieve joint encoding and accurate reconstruction of spatial and temporal features of heterogeneous graphs, enabling the model to effectively learn the node attributes, topological relationships, and temporal evolution patterns of normal behavior, and providing a reliable model foundation for subsequent behavior anomaly detection based on reconstruction errors, the following steps are taken: During detection, firstly, the node feature vectors corresponding to each node are extracted. This involves normalizing the original node features, filling in missing values, and unifying dimensionality preprocessing. Then, a feature mapping network is used to convert the high-dimensional original attributes of each node into fixed-dimensional node feature vectors, completing the feature vectorization representation of all behavioral nodes. Secondly, various behavioral edges are sorted according to the timing of behavior occurrence, forming multi-class behavioral edge temporal sequences. These sequences are then encoded using a heterogeneous graph attention network encoder, outputting timestamp codes containing dynamic temporal information about the behavior. Finally, the extracted node feature vectors and the corresponding behavioral edge timestamp codes are fused. In this embodiment, a weighted concatenation method can be used, combining a heterogeneous graph attention mechanism to allocate weights for spatial and temporal features. This integrates node attributes, graph topology, and temporal dynamic features, unifying the feature dimensions to obtain an encoded latent vector that combines spatial structure and temporal information, serving as a global deep feature representation of the heterogeneous graph. Finally, the encoded latent vector is input into the decoder for feature reconstruction. The decoder performs reverse decoding on the latent vector, restoring the relationships and connection weights between nodes, reconstructing the edge adjacency matrix of the heterogeneous graph, replicating the sample graph topology, and simultaneously mapping the node fusion features to restore the attribute features of each dimension, obtaining the node attributes of the corresponding behavioral nodes, thus completing the dual reconstruction of node attributes and graph structure.

[0047] In another embodiment of this application, for further definition and explanation, the step of performing behavior scoring based on the anomaly detection result to obtain the behavior scoring result includes: Calculate the degree of difference between the node attribute and the time attribute, the activity attribute, the result attribute, and the environment attribute; The first degree of deviation between the behavior node and the historical behavior is calculated based on Mahalanobis distance; The second degree of deviation is obtained by comparing the baseline subgraph structure with the subgraph structure in the time-series behavior graph. The behavior score is obtained by weighted fusion based on the degree of difference, the first degree of deviation, and the second degree of deviation.

[0048] To score the degree of behavioral anomaly in anomaly detection results and adapt to the risk detection needs of various complex financial business scenarios, thereby improving the accuracy of behavioral anomaly detection, specifically, for each behavioral node in the time-series behavioral graph, the node attributes are aligned and differences are calculated with the corresponding time attribute, activity attribute, result attribute, and environment attribute. Preferably, a hybrid difference algorithm combining Euclidean distance and feature cosine difference can be used to compare the numerical deviation of the predicted node attribute with the original four types of attributes dimension by dimension, obtaining the individual difference value of the node attribute relative to the four types of attributes. After normalizing the four individual difference values, they are summed to obtain the final difference degree. At this point, the greater the difference degree, the greater the deviation between the attribute characteristics of the current user behavior node and the attribute characteristics of conventional compliant financial behavior, and the higher the probability of behavioral anomaly.

[0049] In this embodiment, when calculating the first degree of deviation, a historical financial behavior feature dataset for the corresponding user can be pre-constructed. This dataset stores node feature data of all compliant and normal financial behaviors of the user throughout their history, forming a user-specific historical behavior feature distribution matrix. For the target behavior node in the current time-series behavior graph, using the user's historical normal behavior feature dataset as the benchmark sample set, the Mahalanobis distance between the target behavior node's feature vector and the overall distribution of the benchmark sample set is calculated. The normalized value of the calculated Mahalanobis distance is used as the first degree of deviation. A higher first degree of deviation indicates a stronger anomalous change in the current behavior compared to the user's historical behavior.

[0050] In this embodiment, a standard benchmark subgraph library for financial business can be pre-constructed. This library stores standard benchmark subgraph structures corresponding to various normal financial business scenarios. The benchmark subgraphs include standard node distributions, edge relationships, topological structures, and node feature ranges, covering the normal behavioral graph structures of global financial businesses such as transfers, wealth management, credit, and payments. Furthermore, from the user's current temporal behavior graph, several subgraph structures to be detected are obtained by splitting them according to single or multiple consecutive financial business behaviors. Each subgraph structure to be detected is compared with the standard benchmark subgraph structure of the corresponding business scenario through topological comparison, node feature comparison, and edge adjacency comparison. The subgraph structure similarity, node feature matching degree, and edge sequence consistency are quantitatively calculated, and the second deviation degree is obtained by subtracting the overall matching degree value from 1. Here, the second deviation degree is used to characterize the deviation between the local subgraph structure of the user's current behavior graph and the industry standard normal behavior structure. A higher value indicates that the behavior structure is less consistent with the logic of conventional financial business behavior.

[0051] Finally, in this embodiment, differentiated weighting can be preset. Preferably, the degree of difference is weighted as W1, the first degree of deviation is weighted as W2, and the second degree of deviation is weighted as W3, and W1+W2+W3=1. Specifically, for high-risk financial business scenarios, the weights of the first and second degrees of deviation can be appropriately increased, balancing user-specific behavioral mutations with industry standard behavioral deviations. For regular financial business scenarios, the weights of the three types of indicators are evenly distributed. This embodiment does not impose specific limitations. The weighted fusion formula is expressed as: The behavior detection score is calculated as follows: Difference Level × W1 + First Deviation Level × W2 + Second Deviation Level × W3. Based on preset multi-level risk thresholds, the score is mapped to the corresponding behavior rating. The detection results include four levels: normal, slightly abnormal, moderately abnormal, and highly abnormal. Specific risk scores can also be output, enabling accurate detection and scoring of user financial behavior.

[0052] In another embodiment of this application, for further definition and explanation, after constructing a temporal behavior graph based on the behavior edge sequence and the behavior nodes, the method further includes: Based on the temporal graph mining algorithm, multiple subgraph structures are extracted from the temporal behavior graph. The subgraph structures are used to represent user behavior sequences with specific temporal relationships and activity type combinations. Based on the multidimensional behavioral data, the potential collaborative cheating behaviors are identified by matching them with the collaborative cheating feature library and marked in the subgraph structure to display the potential collaborative cheating behaviors in the subgraph structure.

[0053] To uncover the possibility of behavioral fraud and thus improve the accuracy of abnormal behavior detection based on behavioral graphs, after constructing a complete temporal behavioral graph, the graph contains multiple behavioral nodes and temporal behavioral edges arranged according to time nodes. Different nodes and edges correspond to different types of financial activities and operational temporal logic. In this embodiment, a frequent temporal subgraph mining algorithm can be used, combined with the temporal constraint rules of financial business scenarios, to perform local structural decomposition and feature extraction on the global temporal behavioral graph.

[0054] In one embodiment, a time-series constraint window and activity type filtering rules are preset. The time-series constraint window is used to limit the time interval of continuous behavior, such as a 5-minute, 30-minute, or 24-hour financial operation time-series window. The activity type combination rules are used to limit the single-type or combination-type matching conditions of various financial services such as transfers, wealth management, credit granting, quick payments, and account top-ups. Then, the edge adjacency matrix and node attributes of the time-series behavior graph are traversed. Based on the financial activity type corresponding to the behavior node, the time sequence relationship corresponding to the behavior edge, and the behavior trigger association relationship, continuous behavior nodes and associated behavior edges that satisfy specific time sequence relationships and specific activity type combinations are aggregated and split into independent subgraph structures. Each extracted subgraph structure is a complete user behavior sequence, which can accurately represent the continuous operation behavior pattern of users within a fixed time interval and under a specific combination of financial services.

[0055] In a specific example, a combination of actions involving multiple small-amount transfers to multiple accounts consecutively within a short period, centralized transfer aggregation, and overnight cross-regional payments will be identified by the time-series graph mining algorithm as a dedicated time-series subgraph. Meanwhile, normal time-series combinations of daily wealth management subscriptions, maturity redemptions, and regular balance changes will be identified as regular compliant subgraphs. Through this method, multiple structurally independent, feature-clear subgraph structures carrying time-series and business combination information can be extracted in batches from the global time-series behavior graph.

[0056] It should be noted that the current execution end pre-builds a financial collaborative fraud feature library, that is, it pre-builds and continuously iterates and updates the collaborative fraud feature library. The feature library stores typical collaborative fraud behavior feature rules and sample features under various financial scenarios, including the main features of fraud scenarios such as group order brushing, group cashing out, bulk acquisition of financial benefits, multi-person collaborative fake transactions, and group fund diversion and money laundering. This application embodiment does not make specific limitations. In addition, the specific storage dimensions of the feature library also include multi-dimensional fraud feature templates such as multi-user time-series operation consistency features, cross-account fund closed-loop flow features, batch same device features, same IP operation features, concentrated period homogeneous business operation features, and abnormal high-frequency linkage transaction features. This application embodiment does not make specific limitations.

[0057] In this embodiment, when identifying potential fraud based on multidimensional behavioral data features, the user's original multidimensional behavioral data can be retrieved, and core features such as account association information, operation timestamps, device environment information, fund flow information, business operation behavior features, and user interaction association information can be extracted. These features are then compared across the entire domain with various standard fraud feature templates in the collaborative fraud feature library. The matching process can combine feature similarity matching with hard rule matching. Specifically, for explicit fraud rules, precise rule matching is used, such as batch transfers from multiple accounts with the same IP address at the same time. For ambiguous group collaborative behavior features, feature similarity calculation matching can be used. This application does not impose specific limitations on these methods. Finally, when the user's multidimensional behavioral data satisfies any one of the collaborative fraud feature templates and the matching degree reaches a preset threshold, it is determined that the user group's behavior exhibits potential collaborative fraud behavior.

[0058] In this embodiment of the application, subgraph structure labeling refers to locating the target subgraph structure to which the behavior sequence corresponding to the cheating behavior belongs after identifying potential collaborative cheating behavior, and labeling the target subgraph structure to display the labeled graph structure so that potential collaborative cheating behavior can be displayed in the subgraph structure for users to query.

[0059] In one embodiment, a collaborative cheating risk label can be added to the subgraph, the type of cheating behavior can be marked, the feature matching degree can be recorded, and the risk level can be marked. At the same time, the original temporal relationship, activity type combination, and node and edge topology information of the subgraph are preserved, without destroying the original behavior sequence characteristics of the subgraph. Multiple marked subgraph structures can be displayed in batches, distinguishing between subgraphs with normal behavior and subgraphs with potential collaborative cheating. This not only preserves the user's complete temporal behavior sequence information, but also achieves accurate positioning and visual labeling of collaborative cheating behavior.

[0060] In another embodiment of this application, for further definition and explanation, the step of performing behavior scoring based on the anomaly detection result, and after obtaining the behavior scoring result, the method further includes: The behavioral risk level is determined based on the behavioral score results, and a graded intervention strategy is determined based on the behavioral risk level. The user behavior is intervened and processed based on the aforementioned tiered intervention strategy.

[0061] In order to achieve the purpose of risk classification of cheating behavior and thus use the risk of cheating to block the behavior, the current execution end, after obtaining the behavior scoring results, uses the behavior scoring results to determine the behavior risk level. Specifically, different risk levels can be divided based on the score of the behavior scoring results.

[0062] In one example, 0 ≤ behavioral score result < 0.4 indicates a low-risk level, 0.4 ≤ behavioral score result < 0.7 indicates a medium-risk level, and 0.7 ≤ behavioral score result ≤ 1.0 indicates a high-risk level.

[0063] When determining the tiered intervention strategy, different intervention strategy mapping relationships can be pre-established to directly determine the tiered intervention strategies corresponding to different risk levels. In this case, the tiered intervention strategy includes blocking strategies, demotion strategies, and secondary verification strategies. Specifically, blocking strategies refer to strategies that cancel the reward eligibility of cheating users and freeze their participation rights in related activities; demotion strategies refer to strategies that reduce the participation weight of cheating users in activities, such as reducing the probability of winning a lottery or reducing the commission rate; and secondary verification strategies refer to strategies that require users to complete additional identity verification, such as facial recognition or human customer service follow-up, so that user behavior can be processed according to the corresponding strategy. This application embodiment does not impose specific limitations.

[0064] In one example, a weighting reduction strategy is matched for low-risk levels, a secondary verification strategy is matched for medium-risk levels, and a blocking strategy is matched for high-risk levels.

[0065] In a specific example, during the 2026 "618" shopping festival, an e-commerce platform simultaneously launched four marketing activities: daily check-in for points, lucky draws for prizes, group buying for discounts, and a points-based quiz for big wins. Some high-value prizes, such as new mobile phones and large coupons, sold out within minutes of the activities starting. However, most of the user accounts participating in these activities were newly registered, and their shipping addresses were concentrated in a few anomalous areas. The current detection system collects real-time behavioral data from all users across the four activities to construct a temporal behavioral graph. The graph includes user nodes, activity participation edges, device association edges, IP address edges, and other relationship types, with each edge carrying a timestamp and activity type label. After encoding the graph using a graph autoencoder, it was found that the node embedding vectors of approximately 500 accounts were highly clustered in the latent space, with overall anomaly scores exceeding 0.85. At this point, the high-risk threshold was 0.7. There was a risk of cheating. Technical analysis revealed that these 500 accounts likely used only 30 device fingerprints, with each fingerprint associated with an average of 16 accounts. Furthermore, the accounts exhibited highly synchronized behavior throughout the activities, such as check-in intervals of less than one second and concentrated participation in the lottery within the same timeframe. This indicates that these accounts maintained a consistent participation rhythm across all four activities: first, check in to earn points; then, use those points to participate in the lottery and quizzes; finally, obtain additional discounts through group buying, forming a complete chain of fraudulent activity. Therefore, when marking these 500 accounts as high-risk cheating accounts, intervention measures included blocking all unissued rewards (e.g., not shipping already claimed prizes), freezing the accounts' access to subsequent activities, and adding the relevant device fingerprints and IP ranges to a blacklist. Finally, audit log analysis revealed that these cheating accounts were all controlled by the same criminal group, using device emulators to register accounts in bulk and employing automated scripts to participate in all activities simultaneously, aiming to monopolize high-value prizes for resale and profit. During the promotional period, the system identified and blocked 23,000 fraudulent accounts, protecting a marketing budget of approximately 1.8 million yuan. The prize winning rate for legitimate users increased from 35% to 68%, and the event satisfaction rate improved by 22 percentage points.

[0066] In a specific example, a financial management app launched a points-based prediction activity where users could use points to predict the rise or fall of investment product yields, earning points for correct predictions. The platform also implemented a referral reward mechanism: users who shared the prediction activity link with friends received extra points as a commission after their friends participated. However, some users experienced unusually rapid point accumulation despite minimal corresponding investment activity, raising suspicions of exploiting the commission mechanism to accumulate points. The system collected data on user participation history in the points-based prediction activity, referral reward relationship chains, and point change records to construct a time-series behavioral graph. The graph included various relationship types, such as user nodes, prediction participation edges, sharing relationship edges, and commission receiving edges. Through a time-series graph pattern mining algorithm, it was determined that three users, A, B, and C, formed a sharing loop: A shared with B, B shared with C, and C shared with A. Each user earned commission points through the sharing link and used those points to participate in the prediction activity. Specific characteristics include: highly regular sharing intervals, such as a 24-hour cycle; a strong temporal correlation between betting and sharing behaviors; and highly consistent prediction results among the three users, indicating a lack of independent judgment and randomness. Device fingerprints also show that the three accounts originate from the same IP segment, suggesting possible manipulation by the same criminal group. The system marked accounts A, B, and C as medium-to-high risk, with an overall anomaly score of 0.62-0.71. Intervention measures included triggering secondary verification for A, B, and C, such as SMS verification code combined with facial recognition; freezing accounts upon verification failure; deducting points earned through cyclical commissions; and adding the cyclical sharing pattern to the collaborative cheating feature database for future detection. Finally, the fairness of the platform's points-based betting activities was significantly improved, with a 15% increase in normal user participation and a 28% improvement in points consumption efficiency. Simultaneously, the platform's audit logs provided a complete chain of evidence of cheating behavior, effectively preventing subsequent consumer disputes and legal risks.

[0067] This application provides an abnormal behavior detection method based on a time-series behavior sequence. This method acquires multi-dimensional user behavior data, which characterizes the user's behavior generated during different financial business activities. Based on the multi-dimensional behavior data, it determines behavior edge sequences and behavior nodes, and constructs a time-series behavior graph based on the behavior edge sequences and behavior nodes. Anomaly detection is performed on the time-series behavior graph using a graph autoencoder / decoder to obtain behavior anomaly detection results. A behavior score is then calculated based on the anomaly detection results to obtain a behavior score result. The anomaly detection results include edge sequences and behavior nodes. The adjacency matrix and node attributes are used in the graph autoencoder, which is constructed based on a heterogeneous graph attention network and trained on normal behavior training samples. It uses multi-dimensional behavioral data to construct a temporal behavior graph, characterizing the temporal sequence of behavior and entity associations. This enables the mining of associations of cheating behaviors across time, users, and multiple business scenarios, avoiding the difficulty of identifying collaborative cheating by single-point rules. At the same time, by using the graph autoencoder constructed based on the heterogeneous graph attention network for graph anomaly detection, it can effectively identify new cheating methods such as device fingerprint forgery and behavior simulation, reduce the false negative rate, and greatly improve the detection accuracy of cheating and other abnormal behaviors.

[0068] Furthermore, as a response to the above Figure 1 The implementation of the method shown in this application provides an abnormal behavior detection device based on a time-series behavior sequence, such as... Figure 2 As shown, the device includes: The acquisition module 21 is used to acquire multidimensional behavioral data of users, which is used to characterize the behavioral data generated by users participating in different financial business activities; Module 22 is used to determine the behavior edge sequence and behavior node based on the multidimensional behavior data, and to construct a time-series behavior graph based on the behavior edge sequence and behavior node. The detection module 23 is used to perform anomaly detection on the temporal behavior graph based on the graph autoencoder, obtain behavior anomaly detection results, and perform behavior scoring based on the anomaly detection results to obtain behavior scoring results. The anomaly detection results include edge adjacency matrix and node attributes. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained based on normal behavior training samples.

[0069] Furthermore, the creation module is specifically used to determine behavior nodes according to the user basic data in the multidimensional behavior data; extract time attributes, activity attributes, result attributes and environmental attributes from the multidimensional behavior data, and use the time attributes, activity attributes, result attributes and environmental attributes to create the behavior edge sequence.

[0070] Furthermore, the device also includes: The training module is used to acquire normal behavior training samples and construct a training sample graph based on the normal behavior training samples. The training sample graph includes an edge adjacency matrix and node attributes that label normal behavior. The encoder in the graph autoencoder is constructed based on a heterogeneous graph attention network. The decoder of the graph autoencoder is used to reconstruct the edge adjacency matrix and node attributes. The model of the graph autoencoder is trained based on the training sample graph.

[0071] Furthermore, the detection module is specifically used to extract node feature vectors according to the behavior nodes, and to encode different types of behavior edge sequences through the encoder to obtain timestamp codes; to fuse the node feature vectors and the timestamp codes to obtain encoded latent vectors, and to reconstruct the encoded latent vectors based on the decoder to obtain the edge adjacency matrix and the node attributes.

[0072] Furthermore, the detection module is specifically used to calculate the degree of difference between the node attribute and the time attribute, the activity attribute, the result attribute, and the environmental attribute; calculate the first degree of deviation between the behavior node and historical behavior based on Mahalanobis distance; compare the baseline subgraph structure with the subgraph structure in the time-series behavior graph to obtain the second degree of deviation; and perform weighted fusion based on the degree of difference, the first degree of deviation, and the second degree of deviation to obtain the behavior score result.

[0073] Furthermore, the device also includes: The extraction module is used to extract multiple subgraph structures from the temporal behavior graph based on the temporal graph mining algorithm. The subgraph structures are used to represent user behavior sequences with specific temporal relationships and activity type combinations. The matching module is used to match the multidimensional behavioral data with the collaborative cheating feature library, identify potential collaborative cheating behaviors, and mark them in the subgraph structure to display the potential collaborative cheating behaviors in the subgraph structure.

[0074] Furthermore, the device also includes: The processing module is used to determine the behavior risk level based on the behavior scoring results, and to determine a graded intervention strategy based on the behavior risk level. The graded intervention strategy includes a blocking strategy, a demotion strategy, and a secondary verification strategy; and to intervene in user behavior based on the graded intervention strategy.

[0075] This application provides an abnormal behavior detection device based on a time-series behavior sequence. This embodiment acquires multi-dimensional behavioral data of a user, which characterizes the behavioral data generated by the user participating in different financial business activities. Based on the multi-dimensional behavioral data, it determines behavioral edge sequences and behavioral nodes, and constructs a time-series behavior graph based on the behavioral edge sequences and behavioral nodes. Anomaly detection is performed on the time-series behavior graph using a graph autoencoder / decoder to obtain anomaly detection results, and a behavior score is obtained based on the anomaly detection results. The anomaly detection results include edge sequences and behavioral nodes. The adjacency matrix and node attributes are used in the graph autoencoder, which is constructed based on a heterogeneous graph attention network and trained on normal behavior training samples. It uses multi-dimensional behavioral data to construct a temporal behavior graph, characterizing the temporal sequence of behavior and entity associations. This enables the mining of associations of cheating behaviors across time, users, and multiple business scenarios, avoiding the difficulty of identifying collaborative cheating by single-point rules. At the same time, by using the graph autoencoder constructed based on the heterogeneous graph attention network for graph anomaly detection, it can effectively identify new cheating methods such as device fingerprint forgery and behavior simulation, reduce the false negative rate, and greatly improve the detection accuracy of cheating and other abnormal behaviors.

[0076] According to one embodiment of this application, a storage medium is provided, the storage medium storing at least one executable instruction, which can execute the abnormal behavior detection method based on time-series behavior sequence in any of the above method embodiments.

[0077] Figure 3 The diagram shows a structural schematic of a computer device according to one embodiment of the present application. The specific embodiments of the present application do not limit the specific implementation of the computer device.

[0078] like Figure 3 As shown, the computer device may include: a processor 302, a communications interface 304, a memory 306, and a communications bus 308.

[0079] The processor 302, communication interface 304, and memory 306 communicate with each other via communication bus 308.

[0080] Communication interface 304 is used to communicate with other network elements such as clients or other servers.

[0081] The processor 302 is used to execute program 310, specifically to perform the relevant steps in the above-described data query method embodiment.

[0082] Specifically, program 310 may include program code that includes computer operation instructions.

[0083] Processor 302 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application. The computer device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or they may be processors of different types, such as one or more CPUs and one or more ASICs.

[0084] Memory 306 is used to store program 310. Memory 306 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0085] Specifically, program 310 can be used to cause processor 302 to perform the following operations: Acquire multidimensional behavioral data of users, which is used to characterize the behavioral data generated by users participating in different financial business activities; Based on the multidimensional behavioral data, behavioral edge sequences and behavioral nodes are determined, and a temporal behavioral graph is constructed based on the behavioral edge sequences and behavioral nodes. Anomaly detection is performed on the temporal behavior graph based on a graph autoencoder to obtain behavior anomaly detection results. Behavior scoring is then performed based on the anomaly detection results to obtain behavior scoring results. The anomaly detection results include an edge adjacency matrix and node attributes. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained on normal behavior training samples.

[0086] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0087] It should be noted that any AI models, software tools, or components not belonging to this company appearing in the embodiments of this application are merely illustrative examples and do not represent actual use. All user personal information involved in the embodiments of this application has been authorized (with the knowledge and consent) by the relevant parties or has been fully authorized by all parties, and the executing entity may obtain it through various legal and compliant means. The collection, storage, use, processing, transmission, provision, and disclosure of the information, data, and signals involved all comply with the relevant laws and regulations of the relevant countries and regions, and do not violate public order and good morals.

[0088] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for detecting abnormal behavior based on temporal behavior sequences, characterized in that, include: Acquire multidimensional behavioral data of users, which is used to characterize the behavioral data generated by users participating in different financial business activities; Based on the multidimensional behavioral data, behavioral edge sequences and behavioral nodes are determined, and a temporal behavioral graph is constructed based on the behavioral edge sequences and behavioral nodes. Anomaly detection is performed on the temporal behavior graph based on the graph autoencoder to obtain behavior anomaly detection results, and behavior scoring is performed based on the anomaly detection results to obtain behavior scoring results. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained based on normal behavior training samples.

2. The method according to claim 1, characterized in that, The process of determining the behavior edge sequence and behavior node based on the multidimensional behavior data includes: Determine the behavioral nodes that represent user identity based on the user's basic data in the multidimensional behavioral data; The time attribute, activity attribute, result attribute, and environment attribute are extracted from the multidimensional behavioral data, and the behavioral edge sequence is created using the time attribute, activity attribute, result attribute, and environment attribute.

3. The method according to claim 1, characterized in that, Before obtaining the behavior anomaly detection result by performing anomaly detection on the temporal behavior graph based on the graph autoencoder decoder, the method further includes: Obtain normal behavior training samples and construct a training sample graph based on the normal behavior training samples. The training sample graph includes an edge adjacency matrix that marks normal behavior and node attributes. The encoder in the graph autoencoder is constructed based on the heterogeneous graph attention network, and the decoder of the graph autoencoder is used to reconstruct the edge adjacency matrix and node attributes; The graph autoencoder is trained based on the training sample graph.

4. The method according to claim 1, characterized in that, The anomaly detection results include the edge adjacency matrix and node attributes. The anomaly detection of the temporal behavior graph based on the graph autoencoder decoder yields behavior anomaly detection results including: Node feature vectors are extracted according to the behavior nodes, and the encoder is used to encode different types of behavior edge sequences to obtain timestamp codes; The node feature vector and the timestamp encoding are fused to obtain the encoded latent vector, and the encoded latent vector is reconstructed based on the decoder to obtain the edge adjacency matrix and the node attributes.

5. The method according to claim 1, characterized in that, The behavior scoring based on the anomaly detection results to obtain the behavior scoring results includes: Calculate the degree of difference between the node attribute and the time attribute, the activity attribute, the result attribute, and the environment attribute; The first degree of deviation between the behavior node and the historical behavior is calculated based on Mahalanobis distance; The second degree of deviation is obtained by comparing the baseline subgraph structure with the subgraph structure in the time-series behavior graph. The behavior score is obtained by weighted fusion based on the degree of difference, the first degree of deviation, and the second degree of deviation.

6. The method according to claim 1, characterized in that, After constructing the temporal behavior graph based on the behavior edge sequence and the behavior nodes, the method further includes: Based on the temporal graph mining algorithm, multiple subgraph structures are extracted from the temporal behavior graph. The subgraph structures are used to represent user behavior sequences with specific temporal relationships and activity type combinations. Based on the multidimensional behavioral data, the potential collaborative cheating behaviors are identified by matching them with the collaborative cheating feature library and marked in the subgraph structure to display the potential collaborative cheating behaviors in the subgraph structure.

7. The method according to any one of claims 1-6, characterized in that, After obtaining the behavior score result by performing behavior scoring based on the anomaly detection result, the method further includes: The behavioral risk level is determined based on the behavioral score results, and a graded intervention strategy is determined based on the behavioral risk level. The graded intervention strategy includes blocking strategy, de-weighting strategy and secondary verification strategy. The user behavior is intervened and processed based on the aforementioned tiered intervention strategy.

8. An abnormal behavior detection device based on a time-series behavior sequence, characterized in that, include: The acquisition module is used to acquire multidimensional behavioral data of users, which is used to characterize the behavioral data generated by users participating in different financial business activities. A module is created to determine the behavior edge sequence and behavior nodes based on the multidimensional behavior data, and to construct a time-series behavior graph based on the behavior edge sequence and behavior nodes. The detection module is used to perform anomaly detection on the temporal behavior graph based on the graph autoencoder to obtain behavior anomaly detection results, and to perform behavior scoring based on the anomaly detection results to obtain behavior scoring results. The anomaly detection results include edge adjacency matrix and node attributes. The graph autoencoder is constructed based on a heterogeneous graph attention network and trained based on normal behavior training samples.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method of claim 1.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the steps of the method of claim 1.

Images