Transaction anomaly detection method based on causal event graph and hypergraph neural network

Abstract

The application provides a transaction anomaly detection method based on a causal event graph and a hypergraph neural network, relates to the technical field of data mining and knowledge graph, and comprises the following steps: constructing a dynamic event graph, wherein the dynamic event graph is generated based on multi-source transaction data and comprises a plurality of event nodes and relationship edges between the event nodes, at least part of the relationship edges are causal edges with causal strength labels; identifying a candidate event set satisfying a preset causal pattern based on the causal edges in the dynamic event graph; mapping the candidate event set into a hyperedge in a hypergraph, wherein the hyperedge is used for encapsulating an abnormal transaction mode with high-order correlation; learning the hypergraph by using a hypergraph neural network to obtain representation vectors of nodes and hyperedges; and calculating a transaction anomaly score based on at least the representation vectors and the causal strength labels, and outputting an anomaly detection result.

Description

Technical Field

[0001] This application belongs to the field of data mining and knowledge graph technology, specifically involving a transaction anomaly detection method based on causal event graphs and hypergraph neural networks. Background Technology

[0002] With the increasing digitalization and complexity of financial transactions, bank transaction risk control systems face increasingly severe challenges. Traditional methods for detecting abnormal transactions mainly rely on rule-based engines and statistical models. Rule engines use predefined risk rules (such as single transaction amount thresholds, specific country lists, and transactions outside of working hours) for real-time matching and interception, but their lag is significant, making it difficult to adapt to constantly evolving fraud patterns, and the combination of rules can easily lead to high false positive or false negative rates. Statistical models and machine learning methods (such as logistic regression, random forests, and isolated forests) can discover abnormal patterns beyond the rules by learning from historical transaction characteristics. However, these methods usually rely on expert experience for feature engineering, and their ability to characterize complex, covert, and especially group fraud involving multiple accounts working together is limited. Furthermore, the model decision-making process lacks interpretability, making it difficult to meet the audit and explanation requirements of financial regulators regarding the basis for risk assessment.

[0003] In recent years, graph neural network technology has been introduced into the field of risk control to model the transaction network structure between accounts. This type of method treats accounts as nodes and transaction behaviors as edges, capturing direct flow paths of funds and local correlation patterns, and is effective in identifying directly related abnormal transaction pairs. However, traditional graph structures are limited to expressing binary relationships between pairs of accounts and cannot naturally depict high-order correlation patterns involving three or more entities, such as "multiple people conspiring, funds circulating among multiple accounts, and cross-channel collaborative crimes." These complex patterns are precisely the typical characteristics of professional fraudulent activities such as money laundering and fraud gangs. Furthermore, existing graph-based detection methods mostly focus on static or temporal snapshot analysis of network topology, which, while reflecting correlations, lacks the ability to deeply reason about the causal logic between events. Systems can typically only identify "frequent co-occurrence of transaction A and transaction B" or "account C being at the center of the network," but cannot determine "whether transaction A is a reasonable cause of transaction B," for example, failing to distinguish between large transfers in normal business transactions and illegal fund transfers disguised as loans in fraudulent scenarios. This lack of causal reasoning ability makes the system incapable of distinguishing carefully disguised transactions and unable to provide convincing reasons for risk assessment.

[0004] Therefore, existing bank transaction anomaly detection technologies still have the following prominent problems when dealing with new, complex, and organized fraud: First, they lack the ability to model high-order and hidden correlation patterns in transaction networks, resulting in low identification rates for organized fraud; second, they lack a mechanism to integrate and verify multimodal transaction information (such as time series, amount, text comments, behavioral sequences, and network structures) from a causal perspective, limiting the accuracy of identifying spoofed transactions; third, the models have weak interpretability, making it difficult to output clear, logically reasoned chains of evidence for anomalies, which cannot meet the stringent requirements of risk control business for decision-making transparency and regulatory compliance. Summary of the Invention

[0005] This application provides a transaction anomaly detection method based on causal event graphs and hypergraph neural networks to solve one of the aforementioned technical problems.

[0006] The technical solution adopted in this application is as follows: This application provides a method for detecting transaction anomalies based on causal event graphs and hypergraph neural networks, including: A dynamic event graph is constructed, which is generated based on multi-source transaction data and includes multiple event nodes and the relationship edges between event nodes, wherein at least some of the relationship edges are causal edges with causal strength labels; Based on the causal edges in the dynamic event graph, a set of candidate events that satisfy a preset causal pattern is identified; The candidate event set is mapped to a hyperedge in a hypergraph, wherein the hyperedge is used to encapsulate abnormal transaction patterns with higher-order correlations. The hypergraph is learned using a hypergraph neural network to obtain the representation vectors of nodes and hyperedges; Based at least on the representation vector and causal strength label, calculate the transaction anomaly score and output the anomaly detection result.

[0007] According to one embodiment of this application, constructing the dynamic event graph includes: Event elements are extracted from multi-source transaction data. These event elements include the event subject, event type, event time, event object, and event attributes. Event nodes are generated based on the event elements; Generate relation edges based on at least one of the following: temporal relationship, semantic relationship, fund flow relationship, or causal dependency relationship between event nodes; The causal strength is calculated for at least some of the relation edges, and causal labels are marked for relation edges that reach the causal strength threshold, thus generating causal edges.

[0008] According to one embodiment of this application, the causal strength calculation incorporates causal coefficients from at least two dimensions: Temporal causality coefficient, calculated based on the time interval or sequence pattern of events; The amount causality coefficient is calculated based on the distribution of transaction amounts or the pattern of fund flows. Semantic causality coefficient, calculated based on semantic analysis of event notes or related text; Behavioral causality coefficient, calculated based on user behavior sequences or risk scores; Structural causality coefficients are calculated based on the topological properties of event nodes in the graph.

[0009] According to one embodiment of this application, the causal strength calculation adopts a dynamic weight allocation mechanism, wherein the dynamic weights are generated through an attention mechanism based on the feature vectors of the causal coefficients of each dimension.

[0010] According to one embodiment of this application, the identification of a set of candidate events satisfying a preset causal pattern includes: Extract all causal edges and their associated event nodes from the dynamic event graph to form a set of causal event pairs; Clustering the set of causal events yields multiple candidate clusters; Calculate the average causal strength of each candidate cluster, and select candidate clusters whose average causal strength exceeds a set threshold, and use the set of event nodes contained in them as the candidate event set.

[0011] According to one embodiment of this application, mapping the candidate event set to hyperedges in a hypergraph includes: Assign a superedge type label to each candidate event set, and associate the superedge type label with the causal pattern corresponding to the candidate event set; The weight of the superedge is calculated based on the average causal strength and occurrence frequency of the causal edges in the candidate event set.

[0012] According to one embodiment of this application, the method further includes: When new transaction event data is input, the dynamic event graph is updated; If a new causal edge is added or the causal strength changes, the process of identifying the candidate event set and mapping the hyperedge is re-executed to dynamically update the hypergraph structure.

[0013] According to one embodiment of this application, the output anomaly detection result includes: Locate the event subgraph related to anomaly scoring and its associated superedges; Generate an interpretability report that includes a description of the abnormal causal chain.

[0014] A second aspect of this application provides a transaction anomaly detection system based on causal event graphs and hypergraph neural networks, comprising: An event graph construction module is used to construct a dynamic event graph based on multi-source transaction data. The graph includes causal edges with causal strength labels. The causal pattern recognition module is used to identify a set of candidate events that satisfy a preset causal pattern from the dynamic event graph; A hypergraph generation module is used to map the candidate event set to hyperedges in a hypergraph. The hypergraph learning module is used to learn the representation of the hypergraph using a hypergraph neural network; The anomaly decision module is used to calculate anomaly scores and output detection results based on the learned representations and causal strength.

[0015] According to one embodiment of this application, the system further includes a multimodal causal reasoning engine for fusing at least two modalities of information, including temporal, semantic, behavioral, structural, and monetary information, to calculate causal strength and label causal edges.

[0016] Due to the adoption of the above technical solution, the beneficial effects achieved by this application are as follows: This application constructs a dynamic event graph with causal strength labels, enabling the system to not only record the relationships between transaction events but also characterize their inherent causal logic. Based on this, the system identifies a set of candidate events that satisfy a preset causal pattern using the causal edges in the dynamic event graph and maps them to hyperedges in the hypergraph. This process aggregates and elevates microscopic, dispersed causal relationships into semantic hyperedges, allowing for the explicit modeling and encapsulation of high-order relationship patterns, such as "multi-account fund circulation" and "cross-channel collaborative money laundering," which involve three or more entities and are difficult to directly represent using traditional graph models. The hypergraph neural network then learns from the hypergraph containing these hyperedges, effectively capturing the representations of these high-order patterns, thereby significantly improving the detection rate and recognition accuracy of organized, complex, and concealed fraudulent transactions.

[0017] This enhances the ability to identify fraudulent transactions and improves the interpretability of decisions. Since the causal edges in the dynamic event graph are the result of strength calculation and labeling that integrates multi-dimensional information such as time sequence, amount, and semantics, they inherently contain a preliminary causal judgment of the transaction's rationality. When calculating the transaction anomaly score, the system makes a comprehensive decision based at least on the aforementioned representation vector and causal strength labels. This is equivalent to combining the complex patterns captured by neural networks with logically based causal reasoning evidence. When an anomaly is determined, the system can trace back to the specific abnormal causal edge and the abnormal super-edges (patterns) aggregated from it, thereby automatically generating a visual report containing the abnormal causal chain and pattern attribution. This not only improves the model's ability to identify fraudulent transactions that are "formally compliant but logically contradictory," but also meets the stringent requirements of financial risk control for transparent decision-making processes and clear, auditable evidence chains.

[0018] This method provides a detection framework that enables dynamic adaptation and continuous optimization. It constructs a dynamic event graph and can identify new causal patterns and generate new hyperedges based on new data, allowing the entire detection model to dynamically update as transaction data grows and fraud patterns evolve. This generative modeling and learning mechanism, from events to the graph and then to the hypergraph, overcomes the shortcomings of traditional fixed-rule or static feature-based models, which are lagging and rigid, achieving agile perception and improved adaptive detection capabilities for novel fraud patterns. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating the transaction anomaly detection method based on causal event graph and hypergraph neural network provided in this application embodiment; Figure 2 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application; Figure 3 This is a schematic diagram illustrating the overall data flow and interaction relationships provided in the embodiments of this application; Figure 4 This is an overall architecture diagram provided for embodiments of this application.

[0020] Figure label: 810, Processor; 820, Communication interface; 830, Memory; 840, Communication bus. Detailed Implementation

[0021] To more clearly illustrate the overall concept of this application, a detailed explanation is provided below with reference to the accompanying drawings.

[0022] Many specific details are set forth in the following description to provide a thorough understanding of this application. However, this application may also be implemented in other ways different from those described herein. Therefore, the scope of protection of this application is not limited to the specific embodiments disclosed below. It should be noted that, unless otherwise specified, the embodiments of this application and the features thereof can be combined with each other.

[0023] In this application, unless otherwise expressly specified and limited, the "above" or "below" of the second feature can mean that the first and second features are in direct contact, or that the first and second features are in indirect contact through an intermediate medium. In the description of this specification, references to terms such as "an embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples.

[0024] Example 1 like Figure 1 As shown, the transaction anomaly detection method based on causal event graphs and hypergraph neural networks includes: A dynamic event graph is constructed, which is generated based on multi-source transaction data and includes multiple event nodes and the relationship edges between event nodes, wherein at least some of the relationship edges are causal edges with causal strength labels.

[0025] Specifically, constructing a dynamic event graph refers to extracting basic units describing transaction behavior—"events"—from one or more data sources (i.e., "multi-source transaction data," such as core transaction logs, customer service call records, basic account information, device fingerprint logs, etc.). Each event is abstracted as an "event node," whose attributes typically include core elements such as the transaction subject (e.g., payment account), event type (e.g., "transfer"), timestamp, transaction object (e.g., receiving account), and amount. Nodes are connected by "relationship edges" based on the inherent connections between events. These relationships include, but are not limited to, chronological relationships, fund flow relationships, and semantic similarity relationships.

[0026] Specifically, the system analyzes and quantifies whether there are driving or explanatory relationships between events, that is, it calculates and assigns "causal strength labels" to some relational edges. This label is a numerical value or level representing the probability or strength of causality, and its calculation takes into account multiple dimensions. For example, the system analyzes whether the occurrence of event A significantly increases the probability of event B occurring (temporal and statistical causality), whether the amount of event B can be reasonably explained by the amount of event A (amount-based logical causality), and whether the postscript "payment" of event A and the postscript "refund" of event B constitute a reasonable causal narrative semantically (semantic causality). When the calculated causal strength exceeds a preset threshold, the corresponding relational edge is marked as a "causal edge" and carries its causal strength value. The resulting graph is "dynamic," meaning that it can update nodes, edges, and causal labels in real time or near real time as new transaction events flow in.

[0027] For example: Suppose the following data fragments are obtained from bank transaction records and customer service work orders: Account X transferred 100,000 yuan to account Y at 10:00, with the note "contract prepayment"; Account Y transferred 98,000 yuan to account Z at 10:05, with the note "material procurement"; at the same time, customer service records show that account X called to claim that the transfer was induced by fraud.

[0028] When constructing the event graph, two event nodes are first created: event node 1 (account X transfers funds to account Y) and event node 2 (account Y transfers funds to account Z). There must be at least one "relationship edge" between them representing a continuous flow of funds. The system then performs causal analysis: although the two transactions are closely timed and the fund flows are continuous, multi-dimensional information is incorporated when calculating their "causal strength." For example, semantic analysis might find that the postscript "contract prepayment" in node 1 and the postscript "material procurement" in node 2 are somewhat interpretable in common business logic, but the "fraudulent inducement" information provided by customer service records is introduced as strong negative semantic evidence. Ultimately, the system may calculate a low causal strength value for the sequence, or temporarily omit it as a strong causal edge due to contradictory evidence, but the analysis process and its results (strength value or label) represent the "causal strength label." If subsequent data analysis reveals that account Z is a known fraudulent account, the label of the edge between node 1 and node 2 as a suspicious causal edge may be retrospectively strengthened. The entire graph evolves as new and old information is continuously integrated.

[0029] Based on the causal edges in the dynamic event graph, a set of candidate events that satisfy a preset causal pattern is identified.

[0030] Specifically, identifying a set of candidate events that satisfy a preset causal pattern means that the system searches and matches within a constructed dynamic event graph based on a predefined template (i.e., a "preset causal pattern") representing specific abnormal transaction logic, or mined from historical data. These patterns are essentially subgraph structures or connection rules formed by specific types of causal edges between event nodes. The identification process involves the system traversing all "causal edges" with causal strength labels in the dynamic event graph, analyzing the event nodes connected by these edges and their attributes, and determining whether they collectively conform to the structural features and logical constraints described by a certain "preset causal pattern." When a subset of event nodes and the causal edge relationships between them satisfy all or the core conditions of a pattern, that subset is identified as a "candidate event set." For example, a preset "rapid cyclic money laundering causal loop" pattern might require that all event types within the pattern be "transfers," that event nodes form a closed loop by connecting end-to-end causal edges, that the time intervals on all causal edges are less than a threshold, and that the comprehensive evaluation value of the causal strength label is higher than the threshold. If the system finds a set of events (such as account A transferring to B, B transferring to C, and C transferring back to A) and its causal edges satisfying all the conditions of this pattern, it will output these three event nodes and their causal edges as a "candidate event set" for subsequent processing. This process enables the filtering of structured potential abnormal event groups that conform to specific suspicious logic from massive micro-causal relationships.

[0031] The candidate event set is mapped to a hyperedge in a hypergraph, wherein the hyperedge is used to encapsulate abnormal transaction patterns with higher-order correlations.

[0032] Specifically, mapping the candidate event set to a hyperedge in a hypergraph means that the system transforms each identified "candidate event set" into a "hyperedge" in hypergraph theory. In a hypergraph data structure, a hyperedge can connect any number of nodes (while edges in a traditional graph only connect two nodes). The mapping process is as follows: each "event node" in the candidate event set is treated as a vertex in the hypergraph; then, this group of vertices is treated as a whole to create a new hyperedge, which is associated with this group of vertices. This hyperedge represents the complete business logic pattern corresponding to the candidate event set, thus "encapsulating abnormal transaction patterns with higher-order associations." During this process, the hyperedge is assigned a type label corresponding to the "preset causal pattern" (e.g., "rapid loop money laundering," "shell company layer-by-layer transfers," etc.) and a weight attribute calculated based on factors such as the average strength of causal edges within the set and the number of events. Through this mapping, a group of events that were originally loosely connected by multiple causal edges in the event graph are abstracted and elevated into an independent, semantically clear high-order relation unit. This unit directly corresponds to a complete suspicious behavior pattern, which facilitates the holistic representation and learning of the hypergraph neural network.

[0033] For example, following the previous example, the system identifies a set of candidate events that satisfy the "rapid-cycle money laundering causal loop" pattern, including event node 1 (account A to account B), event node 2 (account B to account C), event node 3 (account C to account A), and the causal edges between them. In the mapping step, the system creates a new hyperedge in the hypergraph, connecting vertex 1, vertex 2, and vertex 3 (these three vertices correspond to the three event nodes mentioned above). This hyperedge is labeled as a "rapid-cycle money laundering loop," and its weight can be calculated based on the average strength of the causal edges between these three events, the size of the time window for loop formation, etc. Thus, these three events and the specific cyclical relationship they form are encapsulated into a single, high-order semantic unit (i.e., the hyperedge). In subsequent analysis, the system can directly operate on and evaluate this hyperedge, thereby elevating the detection focus from pairwise transfers to the higher-order pattern level of "a complete, anomalous money cycle."

[0034] The hypergraph is learned using a hypergraph neural network to obtain the representation vectors of nodes and hyperedges.

[0035] Specifically, learning a hypergraph using a hypergraph neural network involves inputting the hypergraph structure, including hyperedges and their connected event nodes, into the hypergraph neural network model for training and representation learning. A hypergraph neural network is a deep learning model specifically designed for processing hypergraph structure data. Its core mechanism involves multi-layered information transmission and aggregation, allowing nodes and hyperedges in the hypergraph to interact and learn. Specifically, in each layer of learning, the representation of each "node" aggregates information from all its associated "hyperedges," and the representation of each "hyperedge" aggregates information from all its connected "nodes." After multiple iterations of this process, each node's final "node representation vector" not only contains its own event attribute information but also encodes its position within the entire hypergraph structure, all the higher-order patterns it participates in (i.e., which hyperedges it belongs to), and the semantics of these patterns. Similarly, each hyperedge's final "hyperedge representation vector" encodes the overall structural features of the pattern it encapsulates, the commonalities of its involved nodes, and the potential relationships between this pattern and other patterns in the graph. This process achieves the patterned and vectorized representation of complex higher-order associations.

[0036] For example, continuing the previous example, the hypergraph contains a hyperedge of type "fast-loop money laundering ring," connecting event node 1 (transfer from account A to B), node 2 (transfer from account B to C), and node 3 (transfer from account C to A). During the hypergraph neural network learning process, when generating the representation vector of node 1, it considers not only its own attributes (such as transfer amount and time) but also receives aggregated information from its own "fast-loop money laundering ring" hyperedge and other hyperedges that may contain node 1 (such as another "large-amount dispersed transfer" pattern hyperedge). Simultaneously, when generating the representation vector of the "fast-loop money laundering ring" hyperedge, it aggregates the representation information of its connected nodes 1, 2, and 3. After multiple rounds of learning, the representation vector of node 1 will contain the higher-order structural semantics that "this event is not only an independent transfer but also part of a suspicious money loop"; while the representation vector of the "fast-loop money laundering ring" hyperedge can characterize the overall vectorized features of this loop pattern. These learned representation vectors provide a deep and structured feature foundation for subsequent accurate quantification of anomalies.

[0037] Based at least on the representation vector and causal strength label, calculate the transaction anomaly score and output the anomaly detection result.

[0038] Specifically, calculating a transaction anomaly score refers to the system using a decision function to comprehensively quantify the risk of a target (which could be an event node, a hyperedge, or a group of related entities) to be evaluated. This decision function is "based on" at least two types of core input information: one is a "representation vector" learned by a hypergraph neural network, which encodes the target's structural position and semantic features in a high-order association pattern; the other is a "causal strength label" from a dynamic event graph, which provides raw quantitative evidence of the causal relationships between the events involved in the target. The scoring process integrates these two types of information. For example, the target's representation vector is input into a classifier or regression model, while the strength labels of relevant causal edges are input as important features or as weight adjustment factors. Through this integration, the score reflects both the overall anomaly of the target in the complex pattern network and the degree of suspicion of its micro-causal logic. "Outputting anomaly detection results" means that the system will finally compare the anomaly score calculated above with the preset judgment threshold, make a binary judgment or risk level classification on whether the transaction is abnormal, and output the conclusion and related evidence information (such as the specific events that led to the high score, super-edge patterns, contradictory causal points) into a structured early warning report or signal.

[0039] For example, following the previous example, for the superedge of the "rapid-cycle money laundering loop" and its associated event nodes, the system has obtained its "superedge representation vector" and the "strength labels of causal edges" between each event. When calculating the anomaly score of this money laundering loop, the system analyzes its superedge representation vector to determine whether it deviates from the distribution of known normal loop patterns (such as commercial refund loops) in the vector space. Simultaneously, it examines the strength labels of each causal edge it contains. For instance, it finds that the causal edge from event 2 (B to C) to event 3 (C to A) has a very low strength value because there is a lack of reasonable commercial explanation between the appendix "material procurement" and "contract final payment." The decision function integrates these two aspects of information to calculate a high anomaly score for the loop. In the output, the system not only marks the loop as "abnormal," but also clearly points out in the report that the anomaly pattern is a "rapid-cycle money laundering loop," the key contradiction lies in the "weak causal logic of the transfer from event 2 to event 3," and lists all involved accounts and transaction serial numbers, thus providing a traceable and interpretable detection conclusion.

[0040] According to one embodiment of this application, constructing the dynamic event graph includes: Event elements are extracted from multi-source transaction data. These event elements include the event subject, event type, event time, event object, and event attributes. Event nodes are generated based on the event elements; Generate relation edges based on at least one of the following: temporal relationship, semantic relationship, fund flow relationship, or causal dependency relationship between event nodes; The causal strength is calculated for at least some of the relation edges, and causal labels are marked for relation edges that reach the causal strength threshold, thus generating causal edges.

[0041] Specifically, the process of extracting event elements from multi-source transaction data aims to structurally extract raw, heterogeneous transaction-related data. The system identifies and extracts key information describing an independent transaction or related operation from multiple sources (e.g., core transaction log database, customer service text records, device logs, user profile tables). This information is defined as event elements. These include: the event subject (the account or user identifier initiating the transaction or operation), the event type (e.g., transfer, deposit, login, password change), the event time (the precise timestamp of the transaction or operation), the event object (the account or entity identifier of the other party receiving the transaction or operation), and event attributes (including transaction amount, postscript text, operating device IP address, biometric verification results, and other extended information). This process transforms unstructured or semi-structured raw data into a unified, semantically clear set of elements, providing atomic data units for subsequent graph construction.

[0042] Event nodes are generated based on the event elements: This step instantiates each independent set of event elements extracted in the previous step into a node in the dynamic event graph. Each event node is marked with a unique identifier and carries all its corresponding event elements as attributes of that node. For example, a specific transfer transaction, with its corresponding elements such as "Subject: Account A", "Type: Transfer", "Time: T1", "Object: Account B", and "Attributes: Amount X, Remarks Y", constitutes an "event node" with the above attributes in the graph. Through this step, discrete transaction records are transformed into basic entities in the graph network that can be connected and reasoned about.

[0043] Generate relationship edges based on relationships between event nodes: This step aims to establish connections between event nodes, forming the topological structure of the graph. The system analyzes the inherent relationships between any two event nodes according to specific business rules and algorithms, and creates edges connecting them based on these connections. The main relationship types include: temporal relationships (connections based on the chronological order of events), semantic relationships (connections based on the similarity or relevance of textual information such as event descriptions and type descriptions), fund flow relationships (connections based on whether there is a direct flow of funds between the event subject and object), and causal dependency relationships (connections based on preliminary judgments or rules that suggest one event may be the cause or result of another event). A single relationship edge can carry one or more relationship types. This step weaves isolated nodes into a network, initially presenting various logical and factual connections between transaction events.

[0044] The next step involves calculating the causal strength of relation edges and labeling them as causal edges. This step involves in-depth analysis and quantitative screening of the relation edges generated in the previous step, with the core objective of identifying associations with strong causal implications. The system performs a "causal strength calculation" on at least a portion of the relation edges (e.g., all relation edges, or edges initially screened as potentially causal). This calculation comprehensively considers various pieces of evidence, such as the temporal closeness and logical order of the two connected events, the matching or derivational logic of amounts, causal implications in semantic descriptions, and path patterns within the overall network structure. Through a computational model that integrates multi-dimensional evidence, a quantitative "causal strength" value is output for each calculated relation edge. The system presets a "causal strength threshold" and compares the calculated strength value with this threshold. For relation edges whose strength values ​​reach or exceed the threshold, the system assigns a specific "causal label," formally identifying them as a "causal edge." This causal edge not only indicates that the two events are related but also demonstrates a quantified and significant causal probability between them. Unlabeled edges are retained as ordinary relation edges. This step completes the refinement from ordinary association to causal association, laying the foundation for subsequent in-depth analysis based on causal patterns.

[0045] By executing the above four steps in sequence, the system finally constructs a dynamic event graph that includes event nodes, ordinary relation edges, and causal edges with strength labels. This graph can be continuously updated and evolved as new data is extracted and relation calculations are performed.

[0046] According to one embodiment of this application, the causal strength calculation incorporates causal coefficients from at least two dimensions: Temporal causality coefficient, calculated based on the time interval or sequence pattern of events; The amount causality coefficient is calculated based on the distribution of transaction amounts or the pattern of fund flows. Semantic causality coefficient, calculated based on semantic analysis of event notes or related text; Behavioral causality coefficient, calculated based on user behavior sequences or risk scores; Structural causality coefficients are calculated based on the topological properties of event nodes in the graph.

[0047] Specifically, the temporal causality coefficient quantifies the causal probability between events over time. Its calculation primarily relies on the timestamps of two or more events. Key considerations include: assessing whether the time interval between events is within a reasonable or typical range (e.g., the interval between a money transfer and its claimed payment collection should not be too long); and analyzing whether the sequence pattern of events conforms to known causal logic (e.g., a "login verification failure" event immediately followed by a "password reset request" event has stronger sequential causality than random occurrences). By analyzing the anomalies in time intervals, the regularity of sequences, or using time series prediction methods, the system assigns a temporal causality coefficient to each event pair. A higher coefficient indicates a greater probability of a causal relationship between the two events over time.

[0048] Amount Causality Coefficient: This coefficient is used to assess the causal plausibility between events from a monetary perspective. It is calculated and analyzed based on the monetary attributes involved in transaction events. Key methods include: checking whether the amounts between related transactions match or have an explainable derivative relationship (e.g., whether a large outflow corresponds to multiple small inflows with similar total amounts); determining whether transaction amounts conform to historical distribution patterns of specific entities or scenarios (e.g., a sudden large inflow from a personal account consistent with corporate trade characteristics is considered abnormal); and matching fund flow paths to see if they match known fraud or money laundering patterns (e.g., "breaking down large sums into smaller ones" or "circular transfers"). Through the matching degree, abnormality degree, and pattern fit of the amounts, the system calculates the amount causality coefficient; a higher value indicates a more robust causal logic at the monetary level.

[0049] Semantic Causality Coefficient: This coefficient assesses causality by performing semantic analysis on textual information related to an event. Its calculation primarily processes unstructured text such as transaction notes, customer service records, and contract summaries. The system utilizes natural language processing techniques to identify explicitly stated causal conjunctions in the text (such as "because," "therefore," "used for payment"), or to understand the overall semantics of the text through a pre-trained language model, determining whether one event is the cause, purpose, or result of another event. For example, the note "Pay the final payment for contract XX" and "Received a refund for contract XX" may semantically form a closed-loop causal relationship. The depth of semantic analysis and the clarity of causal expression jointly influence the value of this coefficient; a higher coefficient indicates stronger causality supported by textual evidence.

[0050] Behavioral causality coefficient: This coefficient assesses the anomaly of causality from the perspective of user or account behavior habits and risk background. Its calculation relies on historical behavioral sequences and real-time risk intelligence. The system compares whether there are significant deviations in the behavioral patterns of relevant subjects before and after the event being evaluated, such as sudden changes in transaction time, frequency, or device usage habits; at the same time, it incorporates the subject's existing risk score (such as from the credit system, blacklists, or past suspicious transaction records). If the event involves high-risk subjects, the causal probability of its association needs to be carefully assessed. The behavioral causality coefficient comprehensively reflects the degree of deviation between the event and the subject's normal behavioral patterns and the subject's risk background. The higher the coefficient, the lower the probability that the causal relationship is based on normal behavior.

[0051] Structural causality coefficient: This coefficient is calculated based on the position and topological characteristics of event nodes within a constructed dynamic event graph. It examines event pairs within the entire transaction network. The calculation method includes: evaluating the centrality indicators of nodes in the graph (such as degree centrality and betweenness centrality), as nodes in key network positions are more likely to have causal influences; analyzing the path characteristics connecting two events, such as path length and whether they pass through known high-risk nodes or communities; and examining whether the structure of the local subgraph to which the events belong resembles certain causal propagation patterns. The structural causality coefficient captures the causal implications implied by the macroscopic network structure; a higher coefficient indicates stronger structural evidence of a causal relationship between the two events from a global topological perspective.

[0052] When calculating the final causal strength, the system obtains the corresponding causal coefficients from at least two of the aforementioned dimensions and integrates them through weighted summation, machine learning model fusion, and other methods to form a comprehensive causal strength value. This multi-dimensional fusion mechanism ensures that causal judgments consider both micro-level direct evidence (such as time, amount, and text) and macro-level contextual and pattern information (such as behavior and structure), thereby improving the ability and robustness to identify complex and hidden causal relationships.

[0053] According to one embodiment of this application, the causal strength calculation adopts a dynamic weight allocation mechanism, wherein the dynamic weights are generated through an attention mechanism based on the feature vectors of the causal coefficients of each dimension.

[0054] Specifically, the core of the dynamic weight allocation mechanism is that when the system integrates causal coefficients from multiple dimensions to calculate the final causal strength, it does not pre-set fixed weights for each dimension, but rather adaptively determines the importance of each causal coefficient based on the specific event pair being evaluated and its context information.

[0055] In practice, the system first calculates the causal coefficient for each dimension (such as time series, amount, semantics, etc.), along with other contextual features related to that dimension (such as the confidence level of the dimension itself, historical statistical information, etc.), and processes them through an encoding layer (such as a fully connected neural network) to transform them into a numerical "feature vector". Each dimension corresponds to such a feature vector, which contains the deep representation information of that dimension in the specific evaluation scenario.

[0056] Subsequently, the system introduces an "attention mechanism" to calculate dynamic weights. This mechanism takes the feature vectors of each dimension as input and, through its internal calculation process (e.g., calculating the similarity between a "query" vector and the feature vectors of each dimension as "key" vectors), evaluates which dimension's evidence is more crucial or reliable in the current causal judgment context of a specific event pair. The attention mechanism calculates an "attention score" for each dimension's feature vector, which reflects the relative importance of that dimension in the current causal reasoning.

[0057] Finally, the system normalizes these attention scores (e.g., using the Softmax function), transforming them into a set of "dynamic weights" that sum to 1, which are then assigned to the corresponding causal coefficients of each dimension. These weights are used to perform a weighted summation of the causal coefficients across all dimensions, resulting in a comprehensive causal strength value.

[0058] Through this mechanism, the system can adjust the evaluation focus in real time and flexibly according to the specific characteristics of each pair of event relationships (for example, for transactions with ambiguous postscripts, it relies more on time series and amount analysis; for transactions involving complex network paths, it focuses more on structural analysis), thereby improving the context adaptability and accuracy of causal strength calculation.

[0059] According to one embodiment of this application, the identification of a set of candidate events satisfying a preset causal pattern includes: Extract all causal edges and their associated event nodes from the dynamic event graph to form a set of causal event pairs; Clustering the set of causal events yields multiple candidate clusters; Calculate the average causal strength of each candidate cluster, and select candidate clusters whose average causal strength exceeds a set threshold, and use the set of event nodes contained in them as the candidate event set.

[0060] Specifically, all causal edges and their associated event nodes are extracted from the dynamic event graph to form a set of causal event pairs. This step first traverses the constructed dynamic event graph, filtering out all relationship edges marked as "causal edges." For each causal edge, the system extracts the two event nodes connected by the edge and considers these three elements (i.e., the starting event node, the causal edge itself, and the target event node) as a complete "causal event pair." All such causal event pairs in the graph are aggregated to form a "set of causal event pairs" to be analyzed. This set contains all micro-event relationships in the graph that have been quantitatively verified to have potential causal connections, serving as the foundational data for subsequent pattern mining.

[0061] The set of causal event pairs is clustered to obtain multiple candidate clusters. This step aims to discover groups of similarities in relation type and event attributes from a large number of micro-causal event pairs, i.e., potential pattern prototypes. The system uses clustering algorithms (such as density-based clustering or spectral clustering) to process the set of causal event pairs. During clustering, the algorithm mainly calculates similarity based on two key features of each causal event pair: first, the "relationship type" represented by the causal edge (e.g., semantic labels such as "repayment reason" or "fund flow"); and second, the "attribute vector" of the nodes involved in the event pair (which may include encoded representations of time, amount, semantic, and other dimensional features). By calculating the similarity between all event pairs, the algorithm groups event pairs with high similarity into the same group, and each such group is called a "candidate cluster". Each candidate cluster represents a set of micro-associations that are highly similar in causal logic and event characteristics, which may point to a recurring suspicious transaction pattern.

[0062] The average causal strength of each candidate cluster is calculated, and candidate clusters with an average causal strength exceeding a set threshold are selected. The set of event nodes contained in these clusters is then used as the candidate event set. This step evaluates and filters the significance of each candidate cluster obtained from clustering. First, for a candidate cluster, the average "causal strength" label value of the causal edges corresponding to all causal event pairs within the cluster is calculated to obtain the "average causal strength" of the cluster. This indicator reflects the significance of the overall causal logic of the potential pattern. Then, the system compares the average causal strength of each cluster with a "set threshold." This threshold can be a static empirical value or dynamically calculated based on the distribution of historical normal transaction data (such as the mean plus several times the standard deviation). Candidate clusters with an average causal strength exceeding the threshold are considered to have sufficiently anomalous significance in their causal patterns and are retained; clusters below the threshold are considered noise or ordinary association patterns and are filtered out. Finally, for each retained candidate cluster, all event nodes involved in all causal event pairs within the cluster are extracted (after deduplication) to form an "event node set," which is ultimately determined as the "candidate event set" that conforms to the preset causal pattern. These sets are direct inputs for subsequent construction of hyperedges and encapsulation of higher-order patterns.

[0063] According to one embodiment of this application, mapping the candidate event set to hyperedges in a hypergraph includes: Assign a superedge type label to each candidate event set, and associate the superedge type label with the causal pattern corresponding to the candidate event set; The weight of the superedge is calculated based on the average causal strength and occurrence frequency of the causal edges in the candidate event set.

[0064] Specifically, a hyperedge type label is assigned to each candidate event set, and this label is associated with the causal pattern corresponding to the candidate event set. This step aims to give each candidate event set a clear semantic identifier. Based on the common features of the clustering process that generated the candidate event set, and the overall patterns exhibited by the event nodes and causal edges within the set, the system summarizes them into a specific "causal pattern." This pattern corresponds to a pre-defined or learned abnormal transaction type, such as a "rapid-cycle money laundering loop" or "shell company multi-level transfers." The system then assigns a "hyperedge type label" describing the pattern name or category to the candidate event set. This label serves as a key semantic attribute of the hyperedge, enabling direct identification of the high-level business logic encapsulated by the hyperedge in subsequent processing.

[0065] Based on the average causal strength and frequency of occurrence of causal edges in the candidate event set, the weight of each hyperedge is calculated. This step calculates a quantified weight value for each hyperedge to characterize its importance or anomalous confidence. The weight calculation mainly relies on two core factors: first, the "average causal strength," which is the arithmetic mean of the causal strength labels of all causal edges included in the candidate event set, reflecting the strength of the overall causal logic of the pattern; and second, the "frequency of occurrence," which can be measured by indicators such as the number of causal event pairs included in the candidate event set or the number of unique event nodes involved, reflecting the prevalence or activity level of the pattern. The system combines the average causal strength with the frequency of occurrence (or a normalized frequency indicator) using a predetermined weighted calculation formula to calculate a comprehensive weight value. This weight will be assigned to the corresponding hyperedge to distinguish the differences in importance between different hyperedges in hypergraph neural network learning or subsequent decision-making.

[0066] According to one embodiment of this application, the method further includes: When new transaction event data is input, the dynamic event graph is updated; If a new causal edge is added or the causal strength changes, the process of identifying the candidate event set and mapping the hyperedge is re-executed to dynamically update the hypergraph structure.

[0067] Specifically, when new transaction event data is input, the dynamic event graph is updated: the system continuously receives new transaction records, customer service records, and other multi-source data. For this new data, the system immediately executes the event graph construction process: first, it extracts new event elements and generates new event nodes; second, it analyzes the relationships between these new nodes and existing nodes in the graph, establishing new time-series, fund flow, and other relationship edges; finally, it calculates the causal strength of these new or affected relationship edges and labels the edges that meet the conditions with causal tags. This process integrates new events and their associations into the existing dynamic event graph in real-time or near real-time, keeping the graph up-to-date and reflecting the latest transaction facts and causal assumptions.

[0068] If a new causal edge is added or the causal strength changes, the steps of identifying the candidate event set and mapping hyperedges are re-executed to dynamically update the hypergraph structure. During the event graph update process, the system monitors whether changes occur in the graph that may affect high-level pattern recognition. These changes mainly include two situations: first, the appearance of a new causal edge; and second, a significant change in the causal strength label value of an existing causal edge (for example, due to the addition of new evidence, the causal strength of an edge changes from below a threshold to above a threshold). Once such a change is detected, the system triggers an update to the pattern discovery process. This means that the system will re-execute the two core steps of "identifying the candidate event set that satisfies the preset causal pattern" and "mapping the candidate event set to hyperedges in the hypergraph" based on the updated full graph containing the new causal states. Through re-clustering and filtering, new suspicious patterns may be identified, and new hyperedges are created and added to the hypergraph; at the same time, some existing hyperedges may be downweighted or removed due to weakened or disappeared causal evidence supporting them.

[0069] Through the above mechanism, the update of the event graph directly and automatically drives the synchronous update of the hypergraph structure, enabling the entire anomaly detection model to keep up with the dynamic evolution of trading behavior and risk patterns, and achieve end-to-end adaptive optimization, thereby overcoming the lag defects of models based on static rules or fixed-period updates.

[0070] According to one embodiment of this application, the output anomaly detection result includes: Locate the event subgraph related to anomaly scoring and its associated superedges; Generate an interpretability report that includes a description of the abnormal causal chain.

[0071] Specifically, the system locates the event subgraphs and their associated hyperedges related to the anomaly score: When the system calculates that a target (such as a specific event node or hyperedge) has a high anomaly score, it performs source tracing and localization operations. Specifically, the system automatically extracts all underlying evidence directly related to the formation of the anomaly score from the stored dynamic event graph and hypergraph structure. This includes: tracing back to the dynamic event graph to find the event subgraph that led to the high score—that is, a group of event nodes and their connecting edges that are tightly connected by causal edges and whose attributes and causal strength make a core contribution to the anomaly conclusion. Simultaneously, the system locates the hyperedge that encapsulates the anomaly pattern within the hypergraph. By querying the association between the graph and the hypergraph (e.g., the mapping table between hyperedges and the event nodes they connect to), the system determines which hyperedge(s) contains nodes from the aforementioned event subgraph, thereby associating microscopic anomaly event evidence with macroscopic anomaly pattern identifiers.

[0072] Generate an interpretable report containing a description of the abnormal causal chain: Based on the above location results, the system automatically integrates information to generate a structured, human-readable risk report. The core of the report is the description of the abnormal causal chain. The system extracts key causal edge sequences from the located event subgraphs and organizes them into a clear "causal chain" according to time or logical order. For each link in the chain, the report lists specific event details (such as subject, time, amount, type) and the causal strength value and key dimensional evidence used in that link (such as "high causal strength due to extremely short time intervals and matching amounts"). Simultaneously, the report clearly indicates the abnormal pattern to which the causal chain belongs (i.e., the type label of the superedge, such as "rapid-cycle money laundering loop") and explains why this pattern is judged as abnormal. The report is ultimately presented in a combined text and graphics format (such as visual subgraphs and structured text), forming an interpretable report with clear logical basis that can be used for risk assessment, regulatory reporting, or case investigation.

[0073] A second aspect of this application provides a transaction anomaly detection system based on causal event graphs and hypergraph neural networks, comprising: An event graph construction module is used to construct a dynamic event graph based on multi-source transaction data. The graph includes causal edges with causal strength labels. The causal pattern recognition module is used to identify a set of candidate events that satisfy a preset causal pattern from the dynamic event graph; A hypergraph generation module is used to map the candidate event set to hyperedges in a hypergraph. The hypergraph learning module is used to learn the representation of the hypergraph using a hypergraph neural network; The anomaly decision module is used to calculate anomaly scores and output detection results based on the learned representations and causal strength.

[0074] According to one embodiment of this application, the system further includes a multimodal causal reasoning engine for fusing at least two modalities of information, including temporal, semantic, behavioral, structural, and monetary information, to calculate causal strength and label causal edges.

[0075] A second aspect of this application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any of the embodiments of the first aspect above.

[0076] Figure 2 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 2As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830, and a communication bus 840, wherein the processor 810, the communication interface 820, and the memory 830 communicate with each other via the communication bus 840. The processor 810 may call logical instructions in the memory 830 to execute the method in any of the embodiments of the first aspect described above, the method including: A dynamic event graph is constructed, which is generated based on multi-source transaction data and includes multiple event nodes and the relationship edges between event nodes, wherein at least some of the relationship edges are causal edges with causal strength labels; Based on the causal edges in the dynamic event graph, a set of candidate events that satisfy a preset causal pattern is identified; The candidate event set is mapped to a hyperedge in a hypergraph, wherein the hyperedge is used to encapsulate abnormal transaction patterns with higher-order correlations. The hypergraph is learned using a hypergraph neural network to obtain the representation vectors of nodes and hyperedges; Based at least on the representation vector and causal strength label, calculate the transaction anomaly score and output the anomaly detection result.

[0077] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory, random access memory, magnetic disks, or optical disks.

[0078] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program, the computer program being able to be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer being able to perform the methods provided by the above methods, the method comprising: A dynamic event graph is constructed, which is generated based on multi-source transaction data and includes multiple event nodes and the relationship edges between event nodes, wherein at least some of the relationship edges are causal edges with causal strength labels; Based on the causal edges in the dynamic event graph, a set of candidate events that satisfy a preset causal pattern is identified; The candidate event set is mapped to a hyperedge in a hypergraph, wherein the hyperedge is used to encapsulate abnormal transaction patterns with higher-order correlations. The hypergraph is learned using a hypergraph neural network to obtain the representation vectors of nodes and hyperedges; Based at least on the representation vector and causal strength label, calculate the transaction anomaly score and output the anomaly detection result.

[0079] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the methods provided by the above methods, the method comprising: A dynamic event graph is constructed, which is generated based on multi-source transaction data and includes multiple event nodes and the relationship edges between event nodes, wherein at least some of the relationship edges are causal edges with causal strength labels; Based on the causal edges in the dynamic event graph, a set of candidate events that satisfy a preset causal pattern is identified; The candidate event set is mapped to a hyperedge in a hypergraph, wherein the hyperedge is used to encapsulate abnormal transaction patterns with higher-order correlations. The hypergraph is learned using a hypergraph neural network to obtain the representation vectors of nodes and hyperedges; Based at least on the representation vector and causal strength label, calculate the transaction anomaly score and output the anomaly detection result.

[0080] Example 2 like Figure 3 As shown, the overall process is as follows: 1. Construction of a dynamic event graph with enhanced causality: Subject, object, and event tuples are extracted from multi-source transaction data, the relationships between events are defined, and a dynamic event graph that grows over time is constructed to represent "who did what, when, where, and why". Causal labels are defined based on causal reasoning.

[0081] 2. Dynamic generation of hypergraph structure: Based on the semantic and logical relationships in the event graph, a hypergraph structure is dynamically generated, with hyperedges encapsulating complex fraud units and modeling high-order association patterns.

[0082] 3. Dynamic Multimodal Causal Reasoning: Create a three-stage causal reasoning process to discover and verify causal relationships between transaction characteristics and quantify anomaly indices.

[0083] 4. Hypergraph Neural Network Learning and Fusion Decision Making: Utilize hypergraph neural networks to learn higher-order representations, combine causal reasoning results to make comprehensive anomaly judgments, and construct a complete cognitive closed loop of "perception-cognition-decision". like Figure 4As shown, the implementation principle of the core module is explained below: 1. Multimodal data fusion This module integrates data from various sources and covering different types (such as text, images, and audio) to provide more comprehensive and accurate information for anomaly detection. Specifically, bank transactions involve multi-dimensional data, including transaction amount, transaction time, transaction location, and the parties involved, as well as their semantic and behavioral information. To achieve effective integration of different types of data, a spatiotemporal alignment algorithm is first used (ensuring that the data is in the same time base and spatial reference frame) to uniformly process transaction logs. Simultaneously, timestamps, device logs, and IP geolocation data are also unified to a single time base. Through this series of operations, a correlation matrix is ​​generated, establishing close connections between various types of data in the spatiotemporal dimensions.

[0084] Building upon this foundation, we combine text, image, and speech big data models to perform in-depth processing on different types of data. The text big data model performs semantic parsing and feature extraction on transaction text information; the image big data model identifies and analyzes transaction-related image data (such as invoices, videos, etc.); and the speech big data model performs content understanding and key information extraction on voice information in transactions (such as customer service call recordings, etc.).

[0085] (1) Construct a "multimodal-event element" mapping table: such as facial features → event subject (account holder), amount field of bill image → event attribute (transaction amount), "fraud inducement" keyword of customer service voice → event semantic tag; (2) Added "Modal Consistency Verification" step: If the facial features do not match the biometric information reserved in the account, the behavioral causality coefficient (BC) of the event will be automatically reduced and marked as "Subject Questionable" event.

[0086] By processing data of different modalities through the above mechanisms, cross-correlation and verification of data can be achieved (such as verifying and correlating the "ATM cash withdrawal" behavior with the action recognition results in the surveillance video), ensuring the accuracy and consistency of various types of data, and finally confirming complete and reliable transaction data, providing reliable data support for subsequent verification modules.

[0087] 2. Dynamic Multimodal Causal Inference Engine The system weights and fuses different causal evidences from time-series data, semantic text, and network structures to generate a comprehensive causal strength score, and dynamically adjusts the weights of each modality based on knowledge of banking transactions.

[0088] Temporal causality: Based on the time interval between events and the interval between events between events of the same historical subject and object, calculate the temporal causality coefficient of the current event.

[0089] Semantic Causality: Leveraging Large Language Modeling (LLM) for deep semantic analysis of massive amounts of customer service records, LLM accurately extracts causal statements related to financial transaction risks from unstructured customer service records through specific semantic parsing algorithms and causal relationship extraction models. For example, if a customer service record details a user's feedback such as "forced to transfer money due to being induced by a fraudulent phone call," which has a clear causal logic, LLM can identify the causal relationship between the cause event "being induced by a fraudulent phone call" and the result event "forced to transfer money," thus providing crucial semantic causal evidence for subsequent anomaly detection. Furthermore, through cluster analysis of numerous similar causal statements, potential and common causal patterns leading to abnormal transaction behavior can be uncovered, such as "unexplained transfers due to account theft," continuously improving the semantic causal knowledge base and enhancing the accuracy and comprehensiveness of identifying semantic causal relationships related to transaction risks.

[0090] Structural causality: Using network analysis techniques, taking an event graph network or hypergraph as an example, key nodes and core communities are identified by calculating node centrality indicators and applying community discovery algorithms. For instance, node C has extremely high degree centrality and serves as a bridge for multiple key transaction paths, thus being identified as a hub node in a known money laundering network. The transaction characteristics of its associated node groups highly match the money laundering patterns, providing structural causal evidence for combating money laundering.

[0091] Behavioral Causality: Regarding transaction frequency, normal customers maintain a stable rhythm. Sudden, high-frequency, large-amount transfers without a reasonable explanation are closely related to risks such as subsequent illegal fund transfers. In terms of IP addresses and devices, customers have frequently used ranges and preferences. The appearance of unfamiliar IP addresses or unused devices suggests account theft or manipulation. Biometric fingerprints, as unique identifiers, indicate potential forgery or misuse if fingerprints do not match or are abnormally identified during transactions. By comprehensively analyzing these multi-dimensional behavioral causal characteristics, banks can accurately detect abnormal transaction signals, provide early warnings of risks, and ensure transaction security.

[0092] 3. Construction of dynamic event graphs with enhanced causality (micro-causal discovery): The construction of dynamic event graphs aims to deeply mine information from multi-source transaction data and integrate dynamic multimodal causal reasoning processes to form event graphs with causal labels and strengths, rather than just temporal correlations. It presents transaction events and their relationships in an intuitive and dynamic way, providing strong support for the construction of hypergraphs and super-order causal inferences.

[0093] 3.1 Event Extraction Using pre-trained models (such as BERT-BiLSTM-CRF), five key elements of an event are accurately extracted from pre-processed data: event subject, event type, event time, event object, and event attributes. The subject clearly identifies the initiator of the transaction, such as account A; the type defines the transaction behavior, such as transfer, remittance, deposit, withdrawal, account opening, and account closing; the time records the specific moment the transaction occurred, such as t; the object indicates the recipient of the transaction, such as account B; and the attributes cover key information such as amount X and remarks Y. A method based on semantic similarity (Sentence-BERT calculating event vector similarity) + attribute matching (consistency of subject, object, amount, and time) is used to merge and deduplicate the extracted events, ensuring that each real transaction corresponds to a unique event node.

[0094] This step involves creating a subject-object graph and its event graph, transforming complex transaction data into structured event tuples, and providing a clear data foundation for subsequent relationship definition and linking.

[0095] 3.2 Creating Event Nodes Based on the event subject and object extracted in 3.1, create event nodes.

[0096] Example of a node for event 1: { "nodes": [ { "id": "event_001", / / Unique identifier for the event node "type": "event", / / Node type is event "properties": { "subject": "Account A", / / Subject "event_type": "transfer", / / Event type "time": "2024-01-01 10:00:00", / / Time "object": "Account B", / / Object "amount": 5000, / / Amount (the specific attribute value within the attribute) "remark": "Shopping transfer" / / Postscript } } ] } 3.3 Relationship Definition and Causality Strength Detection Multiple relationships between events are defined to construct complex networks. Temporal relationships clarify the chronological order of events, such as event A preceding event B; causal relationships reveal the inherent logic of events, such as event A being the "repayment reason" for event B; transfer relationships form a fund loop, reflecting the flow of funds; semantic similarity relationships establish associations based on the similarity described in appendices. Events with these relationships are linked to construct a dynamic event graph G_event = (V_event, E_relation) that grows over time, where nodes represent events, edges represent relationships between events, and event edges include ordinary edges and causal edges (edges_type). The types of relationships between events include event co-occurrence, temporal sequence, causal dependence, and semantic similarity (relation_type).

[0097] In causal reasoning of transaction events, causal coefficients are calculated from five dimensions: time sequence, amount, semantics, behavior, and structure, combined with the dynamic modeling characteristics of event graphs and a multi-dimensional feature fusion mechanism. When the weighted overall causal strength exceeds a threshold, the relationship between the events is labeled with a causal tag.

[0098] The following is a framework for calculating dynamic weighted causal coefficients based on the principles of causal graph learning, temporal pattern mining, and semantic role labeling: (I) Dimensional Causality Coefficient Calculation Model 1. Temporal Coefficient (TC) Calculation principle: Based on Granger causality test and time window sliding correlation analysis.

[0099] Mathematical formula:

[0100] Granger: Using VAR models to test the predictive power of preceding events X on subsequent events Y; Pearson: Calculates the sliding correlation coefficient between events X and Y within a time window τ; Time_Abnormal: "Event density within the time window" and "abruptness of event intervals" (e.g., if the normal transaction interval is 1-7 days, and suddenly it becomes 3 transactions within 1 hour, it is considered a time sequence abnormality). in,

[0101] t_acutal is the current event interval. t_avg is the historical average interval, which approaches 1 during mutations.

[0102] α=0.5, β=0.3, γ=0.2: Weight allocation (prioritizing the capture of causal directionality); Example: If user A's transfer event X occurs 10 seconds before user B's receipt event Y, and the Granger test p-value is <0.01, then TC = 0.92.

[0103] 2. Amount Coefficient (AC) Calculation principle: Based on anomaly detection of amount ratio and matching of fund flow patterns.

[0104] Mathematical formula:

[0105] KL: Calculates the KL divergence of the transaction amount distribution (to detect the proportion of anomalies); Match: Matching degree based on the fund flow rule base (such as the "large amount transfer out → multiple small amounts transfer in" pattern). γ=0.7, δ=0.3: Weight allocation (prioritize detecting abnormal amounts); Example: If X is a transfer out of 100,000 yuan, Y is 5 transfers in of 20,000 yuan each, and the KL divergence is >0.5, then AC = 0.88.

[0106] 3. Semantic Coefficient (SC) Computational principle: Based on event semantic role labeling and dependency parsing; Mathematical formula:

[0107] (illustrate: The core verb referring to event X, Refers to the semantic arguments of event Y; The syntactic root node of X, (Refers to the modifier node of Y). SRL: Calculate the semantic role matching degree of agent-recipient relationship (e.g., whether the agent of the "transfer" action is the recipient). Dep: Calculates the path similarity between the core verb and its modifiers in the dependency syntax tree; =0.5,ζ=0.5: Weight allocation (balancing action and modification relationship); Example: If the semantic role matching degree of "User A transfers money to User B" in the transaction description is 0.9, then SC=0.75.

[0108] 4. Behavior Coefficient (BC) Computational principle: Based on user behavior sequence pattern mining and risk scoring model; Mathematical formula:

[0109] SeqMatch: Calculates the edit distance similarity of action sequences (such as login-transfer-confirmation); RiskScore: A risk score for payees based on an anti-fraud rule engine; =0.6, =0.4: Weight allocation (prioritize matching behavioral patterns); Example: If the payee has recently engaged in high-frequency, low-amount test transactions, and the sequence matching degree of the transactions is 0.8, then BC = 0.82.

[0110] 5. Structural Coefficient (STC) Computational principle: Based on node embedding representation and hierarchical path analysis of graph neural networks (GNN), it captures the topological importance and hierarchical transitivity of events in the graph.

[0111] Mathematical formula:

[0112] Node location encoding: If event node X is located in the core region of the graph (high centrality) and connects to multiple high-frequency trading nodes, its location encoding value is higher.

[0113] Hierarchical path coefficient, calculated using the shortest path algorithm to determine the number of hops and directional consistency between events.

[0114] σ: Sigmoid activation function (output range [0,1]); W1,W2,b: Trainable parameter matrix.

[0115] Example: If the node position is important and the hierarchical direction is correct, then STC=0.85.

[0116] (II) Dynamic weight allocation mechanism Employing a multi-head attention mechanism to dynamically adjust dimensional weights:

[0117] hi: Feature vectors of each dimension (encoded via Bi-LSTM), where: i ∈{temporal, amount, semantic, behavior, struct}; W,b: Trainable parameter matrix.

[0118] Example: Time sequence weight 0.25, monetary weight 0.15, semantic weight 0.35, behavioral weight 0.1, structural weight 0.15.

[0119] (III) Overall causal strength

[0120] The first term is a weighted linear combination.

[0121] The second term is the entropy regularization term (to prevent a certain dimension from becoming overly dominant).

[0122] Example: After inputting the coefficients for each dimension, the output is a comprehensive strength of 0.9.

[0123] Example of the causality coefficient part of the causal edge between event 1 and event 2 in the final graph database: { ...... "edges": [ { "id": "causal_001", "source": "event_001", "target": "event_002", "edges_type": "CAUSES", / / CAUSES: Causal reinforcement edges. NORMAL: Normal edges. "properties": { "relation_type": "causal dependency", / / causal dependency "fusion_strategy": "Linear Weighted Method", "fusion_result": { "strength": 0.9, "weights": [0.25, 0.15, 0.35, 0.1, 0.15], "formula": "weighted_sum_with_interaction", "consistency_score": 0.88, "causes_label": TRUE } }, ...... , "semantic": { "strength": 0.70, "text_evidence": ["Transfer message: Urgent cash flow", "Customer service record: Account abnormal"], "similarity": 0.80, "sentiment": "negative", "topic_modeling": ["urgency", "financial_pressure"] }, "behavioral": { "strength": 0.85, "pattern": "fast_in_fast_out", "historical_frequency": "abnormal_high", "device_match": true, "location_change": true, "velocity_anomaly": 0.75 }, "structural": { "strength": 0.80, "network_position": "intermediary_node", "degree_centrality": 0.75, "betweenness": 0.68, "clustering_coefficient": 0.82 } ] } 4. Causal pattern-driven generation of higher-order hypergraphs (mesoscopic pattern recognition) From a vast amount of micro-level causal relationships, recurring or exceptionally significant causal patterns are extracted. These structures often correspond to specific transaction patterns. The causal patterns at the event layer are transformed into semantic structures at the hypergraph layer, and these patterns are mapped to hyperedges of the hypergraph. The specific process is as follows.

[0124] 4.1. Causal Pattern Mining To extract representative transaction patterns from massive amounts of micro-causal relationships and better identify abnormal transactions, causal pattern mining is performed. This involves collecting all causally labeled event pairs and their associated attribute information from a causal-enhanced dynamic event graph, forming a causal event dataset. ,in and It is an event node. It refers to the type of relationship between events. This is a vector of related attributes, including features across temporal, monetary, semantic, behavioral, and structural dimensions, where N is the number of causal event pairs. A clustering algorithm (Spectral Clustering) is used to cluster the causal event dataset, grouping event pairs with similar causal patterns together. To measure the similarity between event pairs, a similarity function is defined. This function takes into account both the similarity of relation types and attribute vectors.

[0125]

[0126] in, It is the similarity of relation types, which can be calculated by cosine similarity after one-hot encoding; It is the similarity of attribute vectors, calculated using cosine similarity; and These are weight parameters that satisfy... .

[0127] The causal event dataset was divided into K clusters using a clustering algorithm. Each cluster represents a potential causal pattern.

[0128] 4.2. Causal Pattern Validation and Screening 4.3. For each cluster Calculate the average causal strength of its internal event pairs. ,in , Is the event related to The overall causal strength (calculated in the construction of the dynamic event graph with enhanced causality).

[0129] Set a causal strength threshold The average causal strength Clusters with significant causal patterns are filtered out, and only those with significant causal patterns are retained.

[0130] threshold Adaptive setting method: (1) Adopt the “3σ criterion + business constraints”: Based on the causal strength / abnormal coefficient distribution of historical normal transaction data, calculate the mean μ and standard deviation σ, and set the initial threshold as μ+3σ; (2) Introduce business weights: Adjust the threshold according to regulatory requirements (such as recall rate priority in anti-money laundering). For example, when it is necessary to improve the recall rate, the threshold is lowered to μ+2.5σ, and the optimal threshold is verified by the confusion matrix (Precision-Recall curve). (3) Dynamic update: The distribution is recalculated and the threshold is adjusted every quarter based on new transaction data to adapt to the evolution of abnormal transaction patterns.

[0131] For the retained clusters, further analysis of their internal relation types and attribute characteristics is conducted to summarize the specific description and feature rules of the causal pattern. For example, if the event pairs in a cluster mainly involve "transfer" events, and the causal strength in the amount and semantic dimensions is high, and keywords such as "loan" frequently appear in the remarks, a causal pattern of "abnormal transfers based on loan reasons" can be summarized.

[0132] Through the analysis and mining of a large amount of bank transaction data, nearly 20 abnormal transaction types were summarized, including fund circulation patterns, hierarchical causal patterns, intermediary causal patterns, and shell company patterns. Corresponding abnormal transaction tags were labeled ("rapid circulation money laundering causal loop", "long-term circulation fund arbitrage loop", "virtual currency intermediary money laundering network", etc.). The identified pattern rules serve as prior knowledge for subsequent causal discovery, accelerating the identification of new patterns and continuously improving the pattern library. 4.4. Hyperedge Generation For each validated causal pattern Determine the set of event nodes involved.

[0133] .

[0134] Collection of event nodes Mapped to a hyperedge in a hypergraph The type of the superedge corresponds to the type of the causal pattern (as shown in the screenshot of the table above). For example, if the causal pattern is "fast loop money laundering causal loop", then the type of the superedge is "fast loop money laundering". When generating superedges, deduplication is performed to avoid duplicate event nodes affecting the causal contribution calculation.

[0135] For super-edge Assign a weight The weight is determined based on factors such as the frequency of occurrence of the causal pattern in historical data and the average causal strength. The following is the formula for calculating the weight:

[0136] Here, α and β are weight adjustment parameters that satisfy α+β=1. These two parameters were determined experimentally based on the characteristics of actual transaction data and the requirements for abnormal transaction detection. It is a cluster The number of unique event pairs in the dataset, where N is the total number of event pairs in the causal event dataset. It is a cluster The average causal strength.

[0137] 4.5. Hypergraph Construction Initialize an empty hypergraph. .in It is a set of event nodes, initially containing all event nodes that appear in the causal event dataset. It is a set of hyperedges, initially empty. Hyperedges are generated for each validated causal pattern. The generated hyperedge Add to superedge set In the middle, update the set of superedges. This completes the construction of the hypergraph.

[0138] Example of a hyperedge in the final graph database: { "hyperedges": [ { "id": "hyperedge_001", "type": "superedge", "properties": { "hyperedge_type": "rapid loop money laundering causal cycle", "description": "A short-term, closed-loop fund transfer pattern consisting of multiple transfer events, typically used for rapid transfer and obfuscation of fund origin." "generation_time": "2024-01-01 12:00:00", "weight": 0.92, "anomaly_score": 0.87, "causal_pattern_rule": "The event type is 'transfer'; the timing is close (interval < 5 minutes); forming a closed-loop path A->B->C->A; the semantic appendix is ​​ambiguous or contradictory." "involved_event_ids": ["event_001", "event_005", "event_009", "event_015"], "involved_accounts": ["Account A", "Account B", "Account C", "Account D"] } }, { "id": "hyperedge_002", "type": "superedge", "properties": { "hyperedge_type": "shell company multi-level transfer model", "description": "Funds are transferred through multiple layers of newly registered or inactive shell company accounts to create a complex transaction background." "generation_time": "2024-01-01 12:05:00", "weight": 0.88, "anomaly_score": 0.91, "causal_pattern_rule": "The subject / object is a company account registered less than 30 days ago; the transaction amounts are similar; the transaction structure is either a single chain or a tree-like diffusion structure; and there is a lack of reasonable business remarks." "involved_event_ids": ["event_002", "event_007", "event_011", "event_018", "event_022"], "involved_accounts": ["Company Account X_20231201", "Company Account Y_20231205", "Personal Account Z", "Company Account W_20231210"] } } ] } 4.6. Calculation of Anomaly Coefficient To quantify the "atypicality" of shared hyperedges in causal structures—that is, the degree of deviation of their causal association patterns from normal clusters—anomaly coefficients are calculated. The specific steps are as follows: (1) Calculate the local causal contribution of the hyperedge. For each shared hyperedge e, compute the events connecting it in the cluster. The local causal contribution of the hyperedge e in the cluster is measured. The relative importance of causal structure.

[0139]

[0140] The numerator is the sum of the causal strengths of all event pairs within the hyperedge e, multiplied by the hyperedge weight.

[0141] Denominator: Cluster The total causal contribution (normalization factor) of all superedges within the region is calculated to ensure that the local causal contribution is within the range of [0,1]. (2) Calculate the expected causal contribution of the hyperedge (based on similar causal patterns)

[0142] Where N is the number of clusters under the same causal pattern.

[0143] (3) Calculate the anomaly coefficient An anomaly coefficient is defined by combining the actual and expected contributions of a hyperedge. The higher the anomaly coefficient, the more significant the hyperedge *e* is within the cluster. The more abnormal the causal pattern in the text:

[0144] Molecular weight: The absolute difference between the actual contribution and the expected contribution, reflecting the degree of deviation.

[0145] Denominator: Standard deviation σ of the global contribution, used for normalization (to make outlier coefficients comparable).

[0146] 5. Collaborative Reasoning and Iterative Optimization (Macroscopic System Evolution) This layer aims to establish a two-way feedback mechanism between the event graph and the hypergraph, dynamically adjusting the causality coefficient. This forms a closed loop, allowing the event graph and hypergraph to reinforce each other, enabling the system to learn from detection results and continuously optimize the accuracy of causal judgment and anomaly detection precision.

[0147] 5.1. Forward Reasoning (Event → Hypergraph) New evidence reinforcement: When new supporting events are discovered, the causal strength is increased by updating the event graph, discovering new causal patterns, and updating the hyperedges.

[0148] Time decay: The contribution of superedge weights generated by historical causal patterns decays over time if they are not activated or strengthened by new related events for a long period of time.

[0149] Time decay factor The last activation time t_last, and the decay period constant. The formula for attenuated causal strength:

[0150] When strength_current < θ_decay (e.g., 0.3), the superedge is automatically removed to avoid invalid structures consuming resources.

[0151] 5.2. Reverse Reasoning (Hypergraph → Event) Conflict evidence handling: When contradictory evidence appears, a special verification is initiated to trace the relevant super-edges and locate the causal chain in the event graph.

[0152] Rule: When the causal coefficient of a new event conflicts with the pattern rule of the superedge (e.g., the superedge pattern is "interval < 5 minutes", and the interval of the new event is > 30 minutes), and the weight of the conflict dimension is ≥ 0.2, it is judged as conflict evidence and tracing is initiated.

[0153] 6. System Early Warning and Report Generation The system identifies abnormal situations based on the transaction's anomaly coefficient. When the coefficient exceeds a set threshold, the transaction is deemed abnormal. The system automatically locates the key event subgraph causing the anomaly, its corresponding superedge (i.e., the anomaly pattern), and the most significant causal contradiction (such as "the transfer amount and the reason given in the remarks are seriously mismatched"), and generates a report in the form of visual charts and natural language descriptions.

[0154] For any parts not mentioned in this application, existing technologies may be used or referenced.

[0155] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0156] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A transaction anomaly detection method based on causal event graphs and hypergraph neural networks, characterized in that, Includes the following steps: A dynamic event graph is constructed, which is generated based on multi-source transaction data and includes multiple event nodes and the relationship edges between event nodes, wherein at least some of the relationship edges are causal edges with causal strength labels; Based on the causal edges in the dynamic event graph, a set of candidate events that satisfy a preset causal pattern is identified; The candidate event set is mapped to a hyperedge in a hypergraph, wherein the hyperedge is used to encapsulate abnormal transaction patterns with higher-order correlations. The hypergraph is learned using a hypergraph neural network to obtain the representation vectors of nodes and hyperedges; Based at least on the representation vector and causal strength label, calculate the transaction anomaly score and output the anomaly detection result.

2. The method according to claim 1, characterized in that, The construction of the dynamic event graph includes: Event elements are extracted from multi-source transaction data. These event elements include the event subject, event type, event time, event object, and event attributes. Event nodes are generated based on the event elements; Generate relation edges based on at least one of the following: temporal relationship, semantic relationship, fund flow relationship, or causal dependency relationship between event nodes; The causal strength is calculated for at least some of the relation edges, and causal labels are marked for relation edges that reach the causal strength threshold, thus generating causal edges.

3. The method according to claim 2, characterized in that, The causal strength calculation incorporates causal coefficients from at least two of the following dimensions: Temporal causality coefficient, calculated based on the time interval or sequence pattern of events; The amount causality coefficient is calculated based on the distribution of transaction amounts or the pattern of fund flows. Semantic causality coefficient, calculated based on semantic analysis of event notes or related text; Behavioral causality coefficient, calculated based on user behavior sequences or risk scores; Structural causality coefficients are calculated based on the topological properties of event nodes in the graph.

4. The method according to claim 3, characterized in that, The causal strength calculation adopts a dynamic weight allocation mechanism, and the dynamic weights are generated through an attention mechanism based on the feature vectors of the causal coefficients of each dimension.

5. The method according to claim 1, characterized in that, The set of candidate events that satisfy the preset causal pattern includes: Extract all causal edges and their associated event nodes from the dynamic event graph to form a set of causal event pairs; Clustering the set of causal events yields multiple candidate clusters; Calculate the average causal strength of each candidate cluster, and select candidate clusters whose average causal strength exceeds a set threshold, and use the set of event nodes contained in them as the candidate event set.

6. The method according to claim 5, characterized in that, The process of mapping the candidate event set to hyperedges in a hypergraph includes: Assign a superedge type label to each candidate event set, and associate the superedge type label with the causal pattern corresponding to the candidate event set; The weight of the superedge is calculated based on the average causal strength and occurrence frequency of the causal edges in the candidate event set.

7. The method according to claim 1, characterized in that, The method further includes: When new transaction event data is input, the dynamic event graph is updated; If a new causal edge is added or the causal strength changes, the process of identifying the candidate event set and mapping the hyperedge is re-executed to dynamically update the hypergraph structure.

8. The method according to claim 1, characterized in that, The output anomaly detection results include: Locate the event subgraph related to anomaly scoring and its associated superedges; Generate an interpretability report that includes a description of the abnormal causal chain.

9. A transaction anomaly detection system based on causal event graphs and hypergraph neural networks, characterized in that, include: An event graph construction module is used to construct a dynamic event graph based on multi-source transaction data. The graph includes causal edges with causal strength labels. The causal pattern recognition module is used to identify a set of candidate events that satisfy a preset causal pattern from the dynamic event graph; A hypergraph generation module is used to map the candidate event set to hyperedges in a hypergraph. The hypergraph learning module is used to learn the representation of the hypergraph using a hypergraph neural network; The anomaly decision module is used to calculate anomaly scores and output detection results based on the learned representations and causal strength.

10. The system according to claim 9, characterized in that, The system also includes a multimodal causal reasoning engine for fusing at least two modalities of information from temporal, semantic, behavioral, structural, and monetary perspectives to calculate causal strength and label causal edges.

Images