Model training method, electronic device, storage medium, and program product

Abstract

The application provides a model training method, an electronic device, a storage medium and a program product, relates to the technical field of computers, and is used for extracting risk features through an unsupervised self-training manner, so as to reduce the dependence on labeled data. The method comprises the following steps: obtaining a first training sample set; inputting sample basic features of a current sample into a behavior modal encoder to obtain behavior modal features, and inputting sample risk scene features of the current sample into a risk scene modal encoder to obtain risk scene modal features; constructing a double-modal alignment loss; constructing risk features based on the behavior modal features and the risk scene modal features, and determining a sparse loss based on the risk features; reconstructing the risk features by using a decoder to obtain reconstructed behavior state data, and determining a reconstruction loss; and updating a feature extraction model to be trained to obtain a trained feature extraction model, with the aim of minimizing the double-modal alignment loss, the reconstruction loss and the sparse loss.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a model training method, electronic device, storage medium, and program product. Background Technology

[0002] With the accelerated digital transformation of the aviation industry, airline membership systems have evolved from simple flight reward programs into a vast ecosystem integrating consumption, payment, and lifestyle services. This transformation means that membership accounts are no longer just carriers of flight records, but rather represent valuable assets throughout the user's entire lifecycle. However, with the increasing frequency of points redemption, mileage accumulation, and rights transfer, fraudulent activities such as unauthorized logins from other locations and mileage resale are rampant. This forces airlines to build more stringent risk control measures to ensure the security of member assets and the compliant operation of the platform.

[0003] Traditional airline risk control technologies primarily rely on conventional rule engines or general machine learning models, but both fall short in handling today's complex business scenarios. Traditional rule engines often rely on static interception based on fixed thresholds, lacking the ability to perceive the dynamic evolution of risks, resulting in persistently high false positive and false negative rates. While general machine learning algorithms possess non-linear fitting capabilities, they are limited by the sparsity of airline fraud samples and lack the rigid constraints of risk control rules; their "black box" nature makes it difficult to meet the stringent requirements of financial-grade auditing for decision interpretability. Furthermore, traditional solutions have significant shortcomings in feature extraction, failing to fully leverage the high-dimensional and multimodal characteristics of airline member data. Summary of the Invention

[0004] This application provides a model training method, electronic device, storage medium, and program product. Through the label-free self-supervised model training method of dual-modal encoder and multi-task joint optimization, it achieves deep feature fusion, improves the model's ability to represent complex risk scenarios and its recognition accuracy, and solves the problem of insufficient feature extraction in the prior art.

[0005] In a first aspect, this application provides a model training method, comprising: acquiring a first training sample set, the first training sample set containing multiple sample behavioral state data; the sample behavioral state data including sample basic features and sample risk scenario features, the sample basic features being used to characterize the basic attributes and behavioral information of the sample account, and the sample risk scenario features being used to characterize risk scenario information; inputting the sample basic features of the current sample into the behavioral modality encoder of the feature extraction model to be trained to obtain behavioral modality features, and inputting the sample risk scenario features of the current sample into the risk scenario modality encoder of the feature extraction model to be trained to obtain risk scenario modality features; the dimensionality of the behavioral modality features is lower than that of the sample basic features, and the dimensionality of the risk scenario modality features is lower than that of the sample risk scenario features. Risk scenario features are identified; a bimodal alignment loss is constructed based on behavioral modal features and risk scenario modal features, which characterizes the semantic consistency between the behavioral modal features and the risk scenario modal features; risk features are constructed based on the behavioral modal features and risk scenario modal features, and a sparse loss is determined based on the risk features; the sparse loss is used to characterize the sum of the feature values ​​of each dimension in the risk features; the risk features are reconstructed using a decoder to obtain reconstructed behavioral state data, and the reconstruction loss is determined based on the deviation between the reconstructed behavioral state data and the sample behavioral state data; the feature extraction model to be trained is updated with the goal of minimizing the bimodal alignment loss, reconstruction loss, and sparse loss until the first training termination condition is met, resulting in a trained feature extraction model.

[0006] The technical solution provided in this application brings at least the following beneficial effects: Through multi-task joint optimization, the model's feature representation capability for complex risk scenarios is effectively improved. First, by using behavioral modality encoders and risk scenario modality encoders respectively to extract the basic features of the samples and the features of the risk scenarios through dimensionality reduction, data redundancy is reduced while the core information of each modality is preserved. Second, a bimodal alignment loss is constructed to constrain the semantic consistency of the features of the two modalities, enabling the model to capture implicit cross-modal associations and solving the problem of feature fragmentation. On this basis, by constructing risk features and introducing sparse loss, redundant dimensions are automatically suppressed, and core risk features with high recognizability are selected, further improving the compactness and interpretability of the features. At the same time, the risk features are reconstructed using a decoder and the reconstruction loss is calculated, forming an information preservation constraint that competes with the sparse loss, ensuring that the model does not lose key original behavioral information during the compression of feature dimensions. Finally, the joint parameter update aims to minimize these three losses, enabling the trained feature extraction model to accurately extract risk features with deep semantic associations and high recognizability from high-dimensional sparse, multimodal airline member data, thus providing a solid data foundation for subsequent risk quantification and refined decision-making.

[0007] One possible implementation involves constructing a bimodal alignment loss based on behavioral modal features and risk scenario modal features, including: dimensional alignment of the behavioral modal features or risk scenario modal features to obtain behavioral modal features and risk scenario modal features with the same dimensions; and determining the bimodal alignment loss based on the cosine similarity between the behavioral modal features and risk scenario modal features with the same dimensions.

[0008] Secondly, embodiments of this application provide a risk assessment method, comprising: acquiring behavioral state data of an account to be assessed; the behavioral state data including basic features and risk scenario features; inputting the behavioral state data into a trained feature extraction model to obtain risk features; the feature extraction model being obtained based on the model training method provided in the first aspect; inputting the risk features into a trained risk evolution model to obtain behavioral risk potential; determining corresponding disposal measures based on the behavioral risk potential, and executing corresponding disposal measures on the account to be assessed.

[0009] The technical solution provided in this application offers at least the following benefits: First, by acquiring the basic characteristics and risk scenario characteristics of the account to be judged, it covers both user behavior profiles and risk scenarios, providing a sufficient data foundation for subsequent analysis. Then, the behavioral state data is input into a pre-trained feature extraction model, which outputs highly identifiable risk features. Based on this, the risk features are input into a trained risk evolution model, which can dynamically deduce the behavioral risk potential based on the risk features, depicting the evolution trend of risk over time, overcoming the limitation of traditional rule engines' static thresholds in failing to perceive dynamic changes in risk. Finally, based on the behavioral risk potential, corresponding handling measures are determined and executed, achieving a closed loop from risk perception to risk handling.

[0010] In one implementation, determining and executing corresponding remedial measures based on behavioral risk potential includes: determining decision information; the decision information includes behavioral risk potential, confidence level of behavioral risk potential, and severity of risk scenarios currently triggered by the account to be judged; determining target matrix units from a preset decision matrix based on the decision information; the decision matrix is ​​a three-dimensional matrix, and each matrix unit in the decision matrix corresponds to a risk level and a corresponding remedial measure; and executing the remedial measures corresponding to the target matrix unit on the account to be judged.

[0011] In one implementation, after the corresponding handling measures are executed on the account to be judged, the method further includes: generating a risk profile of the account to be judged based on behavioral status data, behavioral risk potential and handling measures; generating an index of the risk profile; the index includes the identity identifier, current timestamp and random code of the account to be judged; storing the risk profile in a risk database, and adding the index to the directory of the risk database.

[0012] In one implementation, the risk evolution model is obtained through the following steps: A second training sample set is acquired; the second training sample set includes sample risk characteristics, sample behavioral risk potentials, and sample disposal measures; the sample risk characteristics of the current sample are input into the risk evolution model to be trained to obtain the initial behavioral risk potential, and the initial disposal measures corresponding to the initial behavioral risk potential are determined; based on the initial behavioral risk potential and the sample behavioral risk potential, an evolutionary loss is constructed; the evolutionary loss characterizes the degree of difference between the initial behavioral risk potential and the sample behavioral risk potential; based on the initial disposal measures and the disposal measures, a rule loss is constructed; the rule loss characterizes the consistency between the initial disposal measures and the disposal measures; with the goal of minimizing the evolutionary loss and the rule loss, the parameters of the risk evolution model to be trained are updated until the second training termination condition is met, resulting in a trained risk evolution model.

[0013] In one implementation, the function of the risk evolution model is realized through a preset evolution equation. The evolution equation consists of risk characteristic terms and multiple influencing factor terms. The influencing factor terms include instantaneous risk intensity and drift term. Instantaneous risk intensity represents the sum of risk intensity of risk scenarios triggered by the account to be judged at the target time, and drift term represents the behavioral evolution trend of the account to be judged.

[0014] Thirdly, embodiments of this application provide a model training apparatus, comprising: The first acquisition module is used to acquire the first training sample set, which contains multiple sample behavior state data. The sample behavior state data includes sample basic features and sample risk scenario features. The sample basic features are used to characterize the basic attributes and behavioral information of the sample account, and the sample risk scenario features are used to characterize risk scenario information. The first processing module is used to input the basic features of the current sample into the behavioral modality encoder of the feature extraction model to be trained to obtain behavioral modality features, and to input the risk scenario features of the current sample into the risk scenario modality encoder of the feature extraction model to be trained to obtain risk scenario modality features; the dimension of the behavioral modality features is lower than that of the basic features of the sample, and the dimension of the risk scenario modality features is lower than that of the risk scenario features of the sample. The first processing module is also used to construct a bimodal alignment loss based on behavioral modal features and risk scenario modal features. The bimodal alignment loss characterizes the semantic consistency between behavioral modal features and risk scenario modal features. The first processing module is also used to construct risk features based on behavioral modality features and risk scenario modality features, and to determine sparse loss based on the risk features; the sparse loss is used to characterize the sum of feature values ​​of each dimension in the risk features; The first processing module is also used to reconstruct the risk features using the decoder to obtain reconstructed behavioral state data, and to determine the reconstruction loss based on the deviation between the reconstructed behavioral state data and the sample behavioral state data. The training module is used to update the feature extraction model to be trained with the goal of minimizing the bimodal alignment loss, reconstruction loss and sparsity loss until the first training termination condition is met, thus obtaining the trained feature extraction model.

[0015] Fourthly, embodiments of this application provide a risk assessment device, including: The second acquisition module is used to acquire behavioral status data of the account to be judged; the behavioral status data includes basic characteristics and risk scenario characteristics. The second processing module is used to input behavioral state data into a trained feature extraction model to obtain risk features; the feature extraction model is obtained based on the model training method provided in the first aspect. The second processing module is also used to input risk features into the trained risk evolution model to obtain behavioral risk potential; The judgment module is used to determine the corresponding handling measures based on the behavioral risk potential and to execute the corresponding handling measures on the accounts to be judged.

[0016] Fifthly, this application provides an electronic device, comprising: a processor and a memory, the processor being coupled to the memory; the memory being used to store computer instructions, which are loaded and executed by the processor to enable the computer device to implement the methods of the first or second aspect described above.

[0017] In a sixth aspect, this application provides a computer-readable storage medium comprising: computer software instructions; which, when executed in an electronic device, cause the electronic device to implement the methods described in the first or second aspect.

[0018] In a seventh aspect, this application provides a computer program product comprising a computer program; when the computer program is run in an electronic device, it causes the electronic device to implement the methods described in the first or second aspect above.

[0019] The beneficial effects of the third to seventh aspects mentioned above are described in the corresponding descriptions of the first or second aspects, and will not be repeated here. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of the structure of a risk assessment system provided in an embodiment of this application; Figure 2 A schematic flowchart illustrating a model training method provided in an embodiment of this application; Figure 3 A flowchart illustrating a risk assessment method provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a model training device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of a risk assessment device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0021] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0022] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0023] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0024] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0025] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0026] In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0027] As airlines' membership systems undergo digital upgrades, the ecosystem of services such as points redemption and mileage accumulation is booming. However, this has also given rise to new types of violations, such as unauthorized mileage trading and unauthorized logins from other locations, placing more stringent demands on airlines' risk control technologies. Currently, existing airline membership risk control technologies mainly rely on traditional rule engines and general machine learning algorithms, but both have significant limitations: on the one hand, traditional rule engines are limited by static thresholds, have weak generalization capabilities, and struggle to depict the dynamic evolution of risk, resulting in both high false positive and false negative rates; on the other hand, general machine learning algorithms heavily rely on large-scale labeled samples, which limits their performance in the face of sparse airline fraud samples, and due to the lack of rigid constraints from risk control rules, their "black box" decision-making process cannot meet compliance requirements such as financial-grade auditing.

[0028] Neither of the above two types of technologies can effectively adapt to the inherent characteristics of airline member data, which is high-dimensional, sparse, multimodal, and highly time-dependent. They generally suffer from pain points such as insufficient feature extraction, lack of end-to-end closed-loop design, and simplistic decision-making logic, which seriously restricts the precision of risk management.

[0029] Based on this, this application provides a model training method to provide a model that can extract the correlation between high-dimensional sparse data, and solves the problems of insufficient feature extraction and simple decision logic in traditional technologies.

[0030] The model trained using the method provided in this application can be applied to the identification of airline member fraud. Within the airline member ecosystem, basic account attributes and risk scenario information belong to different modalities, and the data exhibits high-dimensional and sparse characteristics. The model uses a bimodal encoder to extract these two types of features through dimensionality reduction, and then achieves cross-modal semantic fusion through bimodal alignment loss. This effectively captures cross-modal associated risk signals such as "a high-level member account initiating a large mileage transfer on an unused device," thus providing high-quality input features for downstream risk assessment models.

[0031] The embodiments provided in this application will now be described in detail with reference to the accompanying drawings.

[0032] The model training method provided in this application can be applied to electronic devices. These electronic devices can be servers, such as a server cluster consisting of multiple servers, a single server, a computer, or a processor or processing chip within a server or computer. Exemplarily, the electronic device can also be a terminal, such as a mobile phone, tablet computer, wearable device, in-vehicle device, laptop computer, or ultra-mobile personal computer. Mobile personal computers (UMPCs), netbooks, personal digital assistants (PDAs), etc. It should be noted that the embodiments of this application do not limit the specific form of the electronic device.

[0033] Figure 1 This is a schematic diagram of a risk assessment system provided in an embodiment of this application. The risk assessment system can be deployed on a cloud server. The system can call a pre-trained model on the aforementioned electronic device via an interface, or the model can be migrated to the cloud server. Figure 1 As shown, the risk assessment system 100 includes: Input layer 110 includes a data acquisition module and a preprocessing module. The input end of this layer connects to the airline's customer loyalty management (CLM) and behavior log system via a Kafka message queue, collecting basic member account information and behavior logs in real time, and monitoring the trigger status of 16 types of fraud scenarios. After preprocessing, a standardized member account behavior state space is constructed. The output end transmits this state space data to the risk scenario-bimodal autoencoder (RS-BAE) feature extraction module of the core algorithm layer 120 via a remote procedure call (RPC) interface.

[0034] The core algorithm layer 120 includes the RS-BAE feature extraction module / model, which connects to the industry prior feature library of the data support layer 140 via an application programming interface (API) to achieve cold start. This module extracts low-dimensional core risk features (CRFs) and pushes them via a memory queue to the Scene Evolution Partial Differential Equation (SEPDE) risk potential modeling module / risk evolution model. The SEPDE module solves the behavioral risk potential (BRP) evolution sequence and outputs the final BRP to the dual-constraint collaboration module. The dual-constraint collaboration module loads rules from the risk control rule base of the data support layer via the API, verifies and corrects the BRP, and outputs the Compliant Behavioral Risk Potential (C-BRP), which is then transmitted to the three-dimensional decision module via a distributed message bus. The three-dimensional decision module combines relevant parameters to generate graded disposal actions (GDAs) and their decision-making basis, which are simultaneously transmitted to the output layer via a message queue. The model iteration module periodically extracts end-to-end traceability log data through the application programming interface, calibrates the parameters of each module, and realizes iterative upgrades of the model.

[0035] Output layer 130 includes a tiered handling execution module and a full-link traceability audit module: The tiered handling execution module converts tiered handling measures into executable instructions for the airline member management system, interfaces with the CLM through an application programming interface, executes the instructions and receives execution result feedback, and pushes the feedback results to the traceability audit module through a message queue; The traceability audit module collects core data at each level, generates encrypted full-link trace data (FLTD), stores it in the traceability log library of the data support layer through its interface, and provides an audit query interface to connect with the airline's compliance audit system to support auditors in querying traceability data from multiple dimensions.

[0036] The data support layer 140 comprises three modules, all of which achieve bidirectional real-time data interaction with their corresponding core algorithm layer modules through interfaces: First, the prior feature library provides pre-training parameters for the RS-BAE feature extraction module and receives model fine-tuning parameters from the module to update itself; Second, the risk control rule library provides core risk control rule data support for the dual-constraint collaboration module and the three-dimensional decision-making module, while also receiving rule parameters adjusted by risk control personnel through the backend interface; Third, the traceability log library uses a distributed file system to store encrypted end-to-end traceability data, meeting compliance storage requirements for at least three years, and supports rapid retrieval and export of logs through a query interface, while also providing historical traceability data to the model iteration and optimization module for parameter calibration.

[0037] Figure 2 This is a flowchart illustrating a model training method provided in an embodiment of this application, as shown below. Figure 2 As shown, the model training method includes S201-S206: S201. Obtain the first training sample set.

[0038] By constructing a complete, standardized, and high-quality first training sample set, a reliable data foundation can be provided for subsequent feature extraction and risk evolution.

[0039] The first training sample set contains multiple sample behavioral state data, which includes basic sample features and risk scenario features. Basic sample features characterize the basic attributes and behavioral information of the sample accounts, while risk scenario features characterize risk scenario information. The sample accounts can be any account selected from the current airline's system.

[0040] Specifically, the behavioral state space of the sample accounts is constructed based on the first training sample set. .

[0041] Based on the basic features of the collected samples, a basic feature subspace is constructed. Used to describe the basic attributes and historical behavior of sample accounts, providing a reference for risk assessment. ,in, This represents a 15-dimensional real space. This subspace contains the following main features: account level, points balance, flight frequency in the past 12 months, average flight distance, membership time, account location, consumption preferences, document type, remaining validity period of document, security authentication status, number of assignees, number of sub-programs participated in, number of achievement badges (reflecting activity and loyalty), number of historical violations (including illegal redemption of points, false travel declarations, etc.), and account status (discrete type, with values ​​of 0=normal, 1=abnormal, 2=frozen).

[0042] Furthermore, based on the collected risk scenario features, a risk scenario feature subspace is constructed. By using binary encoding, the risk scenarios triggered by sample accounts are transformed into a machine-computable vector form, which is used to quantify the risk intensity (the more triggering scenarios and the more high-weighted scenarios, the higher the risk). .in, This represents a 16-dimensional binary space, where each value is either 0 (not triggered) or 1 (triggered), corresponding to 16 high-frequency airline violation scenarios: mileage trading, login from a different location, non-personalized payments, bulk points redemption, multiple short-term changes and cancellations, false itinerary declarations, misuse of identification information, abnormal IP logins, spending in uncommon overseas regions, abnormal points transfers, account sharing, unauthorized check-in, fake membership registration, points cash-out, malicious complaints, and unauthorized use of coupons. Let i be the trigger state for the i-th type of risk scenario, where i = 1, 2, ..., 16. Indicates triggering, This indicates that it has not been triggered.

[0043] In addition, a temporal feature subspace needs to be established. Used to characterize the distribution characteristics and evolution patterns of account behavior over time, in order to reflect the dynamic trend of risk changes (such as "short-term high-frequency behavior" and "extremely short intervals between logins from different locations" are all high-risk signals). .in, Representing a 5-dimensional real space, containing the following continuous-time characteristics: observation window (Unit: days, default 90 days, adjustable to 30 / 60 days; the longer the window, the more comprehensive the behavior description), Behavior interval (Unit: hours, refers to the time difference between two consecutive behaviors, ranging from 0.5 to 720; the shorter the interval, the higher the probability of an anomaly), behavior frequency (unit: times / day, ranging from 0.1 to 10), first risk scenario trigger time (unit: hours, refers to the number of hours since the current time, ranging from 0 to 2160), duration of consecutive behaviors (unit: hours, ranging from 0.5 to 72).

[0044] Finally, the above basic feature subspaces are... Risk scenario feature subspace With temporal feature subspace The combination forms a 36-dimensional eigenvector space, which can be mathematically represented as: .

[0045] The sample account behavior state space is formed by concatenating the feature vectors of three subspaces, which can be formally viewed as a vectorized representation of the Cartesian product of the three. That is, the state of the sample account is uniquely determined by 15-dimensional basic features, 16-dimensional risk scenario features, and 5-dimensional time features, for a total feature dimension of 36. This space covers the three dimensions of "basic attributes—risk scenario—time features," thus providing complete input features for subsequent algorithm modules.

[0046] To address issues such as outliers, missing values, and dimensional discrepancies in airline data, the following processing strategies are adopted: Outlier identification and replacement: Using the 3σ principle, with the feature mean as μ and the standard deviation as σ, data that exceeds the range of μ±3σ (i.e., not within the interval of μ-3σ to μ+3σ) are considered outliers, thus effectively filtering out extreme outliers (such as a single-day flight frequency exceeding 100 times, negative points balance, etc.). Then, the 99th percentile value of the feature is used to replace the outliers to reduce the impact of extreme values ​​on the data distribution while maintaining the rationality of the data.

[0047] Format feature validation: Regular expression validation is performed on fields such as ID number and mobile phone number to ensure that their format is valid.

[0048] Missing value imputation: Numerical features: imputed by the median (which is more resistant to outliers than the mean), suitable for flight frequency, points balance, etc.; Categorical features: imputed by the mode, suitable for consumption preferences, document types, etc.; Risk scenario features: imputed by 0, that is, scenarios that have not been triggered are considered to be risk-free.

[0049] Numerical feature standardization: using the Z-score standardization formula. .in, These are the original eigenvalues. The mean of all samples for this feature. Let be the standard deviation of all samples for this feature. After standardization, all numerical features are transformed into a distribution with a mean of 0 and a standard deviation of 1; subsequently, they are adjusted to using a min-max mapping. The interval is set to avoid negative values ​​from adversely affecting the subsequent feature fusion process, so that features of different dimensions (such as "flight distance (kilometers)" and "membership time (months)") can be directly calculated and compared numerically.

[0050] Tensor format conversion: This process converts all features into a tensor format, which takes the following form: .in, (Batch size) represents the number of samples input to the model for training or inference each time. The default value is 32, which can be adjusted to 16 or 64 depending on computing resources (to balance computational speed and model accuracy); 36 is the sum of the feature dimensions. This tensor format matches the input requirements of subsequent deep learning algorithms.

[0051] S202. Input the basic features of the current sample into the behavioral modal encoder of the feature extraction model to be trained to obtain behavioral modal features, and input the risk scenario features of the current sample into the risk scenario modal encoder of the feature extraction model to be trained to obtain risk scenario modal features.

[0052] To address the high-dimensional, sparse, and multimodal characteristics of airline data (a total of 36 features, where risk scenario features are binarized and basic features are continuous values), unsupervised learning is used to uncover implicit risk associations within the data, such as the combined risk of "login from a different location + bulk points redemption," and to extract low-dimensional, highly identifiable core risk features. This approach eliminates the need for training with labeled samples, meeting the challenges of scarce airline samples and high labeling costs, while preserving the core correlation between risk and behavior, thus providing high-quality input features for subsequent risk potential modeling.

[0053] The dimensionality of behavioral modal features is lower than that of the sample's basic features, and the dimensionality of risk scenario modal features is lower than that of the sample's risk scenario features. Among them, the behavioral modal encoder and the risk scenario modal encoder together constitute a risk scenario-behavioral bimodal autoencoder (the model also includes a decoder during training). Through the cooperation of the three, implicit risk correlations can be discovered and low-dimensional features with strong discriminative power can be generated.

[0054] In one implementation, a single-modal autoencoder combined with a cross-attention mechanism can be used to replace RS-BAE. Its structure is simplified compared to the original scheme, but it is still based on the core idea of ​​unsupervised feature extraction.

[0055] First, the feature extraction model to be trained is initialized using Xavier, with its weights initialized uniformly. ]in, For input dimensions, This is the output dimension. This initialization method avoids gradient vanishing or exploding during training, thus ensuring stable model convergence.

[0056] When the number of samples is insufficient (less than 10,000, such as in the case of a newly launched membership system or a scarcity of fraud samples), direct model training is not feasible. In this case, pre-trained parameters need to be loaded from an industry-specific feature library, and then the model is fine-tuned using a small amount of historical data from the airline (the fine-tuning ratio is approximately 20%), so that the model can be adapted to the behavioral characteristics of the airline's own membership accounts.

[0057] The behavioral modality coding process is represented as follows: This is the encoding function of the behavioral modality encoder, with samples from the basic feature subspace as input. (15-dimensional vector), output as behavioral modality embedding (10-dimensional vector). To modify the activation function of the rectified linear unit (ReLU), the function expression is as follows: This function can prevent gradient vanishing during model training while preserving positively correlated feature information. This is the weight matrix of the behavioral modal encoder (10×15 dimensions, with rows corresponding to the output dimension and columns corresponding to the input dimension). The bias vector (10-dimensional) is the behavior modality encoder; both are parameters that need to be optimized during model training.

[0058] The risk modality coding process is represented as follows: This is the encoding function of the risk modality encoder, whose input is samples from the feature subspace of the risk scenario. (16-dimensional vector), output as risk mode embedding (8-dimensional vector); tanh function (hyperbolic tangent function), with an output range of [-1,1], is suitable for binarizing risk scenario features and can effectively capture the combined strength of risk scenarios. For example, the embedding vector value corresponding to the combination of "login from another location + points cash-out" is closer to 1. This is the weight matrix (8×16 dimensions) of the risk modality encoder. The bias vector (8-dimensional) of the risk modality encoder consists of model-optimizable parameters.

[0059] The behavioral modal encoder (which primarily processes continuous basic features, such as flight frequency and integral balance) receives the following input: basic feature subspace. The output is: behavioral modality features. , It is a low-dimensional representation of the basic features of the sample, with each dimension corresponding to a "behavioral pattern" (such as "high frequency of flight + high points balance" corresponding to a higher dimension value).

[0060] The risk modality encoder (primarily processes binarized risk scene features) takes as input: the sample risk scene feature subspace. The output is: risk modal features. , It is a low-dimensional representation of the risk scenario characteristics of the sample, used to capture the combination patterns and trigger intensity of risk scenarios.

[0061] All weights are initialized using Xavier. When the number of samples is insufficient, pre-trained parameters are loaded from an industry prior feature library to complete the cold start, and historical data is used to fine-tune the pre-trained parameters to ensure the feature extraction accuracy during the cold start phase.

[0062] S203. Construct a bimodal alignment loss based on behavioral modal features and risk scenario modal features. The bimodal alignment loss characterizes the semantic consistency between behavioral modal features and risk scenario modal features.

[0063] Although the behavioral characteristics of airline member accounts and the characteristics of risk scenarios originate from different sources, they describe the state of the same account, and the two should be highly related semantically. By using alignment loss, the model is forced to learn implicit cross-modal relationships, avoiding semantic disconnect between the two modalities.

[0064] First, the behavioral modality features and risk scenario modality features are dimensionally aligned (e.g., by mapping them to the same dimension through a linear projection layer). Then, the cosine similarity is calculated. The higher the cosine similarity, the stronger the correlation between the two modalities.

[0065] In one implementation, S203 can be achieved through S2031-S2032: S2031. Align the behavioral modality features or risk scenario modality features with the same dimensions to obtain behavioral modality features and risk scenario modality features with the same dimensions.

[0066] Dual-mode alignment loss This is used to constrain the correlation between behavioral modal features and risk modal features, in order to prevent the two modal features from becoming disconnected.

[0067] Due to behavioral modality characteristics Risk modal characteristics Since the dimensions are different, it is necessary to align them. In this embodiment, the lower-dimensional risk modality feature is aligned with the higher-dimensional behavioral modality feature by padding with zeros. Alternatively, the dimensions can be aligned in other ways, such as aligning them both to a different dimension. Specifically, for... Perform zero-padding to make its dimensions the same as the original dimensions. Consistency, i.e., d=10, yields dimension-aligned risk modality features. ,in, It is a zero vector.

[0068] S2032. Determine the bimodal alignment loss based on the cosine similarity of behavioral modal features and risk scenario modal features with the same dimension.

[0069] In one implementation, the bimodal alignment loss is designed based on the cosine similarity of vectors, and is expressed as: This loss is used to maintain the consistency of the correlation between behavioral modality features and risk modality features to prevent the two from becoming disconnected (e.g., "high-frequency risk scenario triggering" should correspond to "abnormal behavior pattern"). The smaller the loss value, the higher the correlation between the two modalities.

[0070] Based on the implementation methods of S2031-S2032 described above, by aligning the dimensions of behavioral modality features or risk scenario modality features, the problem of inconsistent output dimensions caused by differences in network structure or design requirements in bimodal encoders is solved, providing a computable mathematical basis for subsequent cross-modal semantic comparison. Furthermore, cosine similarity is adopted as the alignment metric. Compared to metrics such as Euclidean distance that rely on absolute numerical differences, cosine similarity only focuses on the directional consistency of feature vectors in the semantic space, unaffected by the magnitude of feature amplitudes. This ensures that the model is not misled by biases introduced by different numerical scales between the two modalities during training, but rather focuses on learning the intrinsic semantic correlation between behavioral features and risk scenario features. The combination of dimensional alignment and cosine similarity enables the bimodal alignment loss to accurately and stably quantify the semantic consistency between the two modalities, thereby effectively guiding the model to learn implicit cross-modal correlations and improving the feature extraction model's ability to fuse and represent multimodal data in the airline member account risk control scenario.

[0071] S204. Construct risk features based on behavioral modal features and risk scenario modal features, and determine sparse loss based on risk features.

[0072] By dynamically allocating weights through an attention mechanism and integrating behavioral modality features and risk scenario modality features, the problem of the disconnect between behavioral modality features and risk modality features can be solved, and the feature combination of high-risk associations can be strengthened.

[0073] The above steps have already been performed. Perform zero-padding to obtain Next, we define the inner product (dot product) after padding with zeros as: ,in, As a scalar, a larger value indicates a higher correlation between the two modalities (e.g., a larger dot product value when "risk scenarios are frequently triggered and behaviors are abnormal"). Behavioral modality feature weights. Weights of risk modal features The calculation formula is expressed as follows: , . Representing behavioral modal features The weighting percentage during fusion, with a value range of [0,1]. Represents risk modal features after dimension alignment. The weight ratio during fusion has a value range of [0,1], and the sum of the two is 1 to avoid weight imbalance. This is an exponential function, used to amplify the difference in correlation between two modes, making the weight allocation more discriminative; , The L2 norm is used to measure the magnitude of a vector, avoiding distortion in weight calculations due to excessively large vector magnitudes; when Much larger hour, →1, behavioral modality is dominant; when much smaller hour, →0, the risk mode is dominant.

[0074] After determining the weights of the two modalities, the features from the two modalities are fused. The behavioral modality is then embedded. Risk mode embedding after zero padding Mapped to 15-dimensional space through linear transformations respectively: , ,in, , This is a learnable or pre-defined mapping matrix. The CRF fusion formula for risk features is: .in, The weights are dynamic and satisfy the following conditions: ; That is, CRF. This fusion process maps and merges the 10-dimensional behavioral modal features with the zero-padding-up 10-dimensional risk modal features through weighted summation into 15-dimensional risk features. This reduces subsequent computational complexity while preserving the core features of both behavioral and risk modalities, ensuring that the CRF comprehensively reflects the account's overall "behavior + risk" status. (Weights) , The correlation between the two modes is dynamically adjusted: the higher the correlation, the greater the corresponding mode weight, thereby highlighting the characteristic combination of high-risk correlation.

[0075] After obtaining the risk characteristics, it is necessary to further construct a sparse loss function based on these characteristics. The sparse loss uses L1 regularization to suppress feature redundancy in the CRF. During derivation, penalties are applied to the feature values ​​of each dimension of the CRF to filter high-discrimination features. Finally, the total loss function is obtained through weight fusion. L1 regularization is used to suppress feature redundancy in the CRF.

[0076] Using L1 regularization, the formula is expressed as: ,in, The risk feature CRF is the first Each dimension has a feature value. This loss represents the sum of the feature values ​​of each dimension in the risk feature, used to avoid feature redundancy in the CRF, thereby selecting feature dimensions with high discriminative power.

[0077] S205. Use the decoder to reconstruct the risk characteristics to obtain reconstructed behavioral state data, and determine the reconstruction loss based on the deviation between the reconstructed behavioral state data and the sample behavioral state data.

[0078] The reconstruction mechanism creates an "information retention constraint" on the feature extraction process. Sparse loss tends to compress features to the extreme, which may lead to the loss of key information; while reconstruction loss requires that risk features can restore the original input, thus forming a game balance with sparse loss, ensuring that the model does not lose key behavioral information while compressing features.

[0079] The input to the decoder is: core risk features (risk features, i.e., CRF, a 15-dimensional vector generated by cross-modal attention fusion). The output is: reconstructed features (i.e., reconstructed behavioral state data). (corresponding to the original input) , , (A concatenated 36-dimensional vector).

[0080] (Reconstruction Loss) The mean squared error (MSE) loss is used, and its formula is as follows: ,in, For sample behavior state data in the first Dimension value, Features reconstructed by the decoder The feature dimension is 36 dimensions in this model. The smaller the error, the more completely the CRF preserves the original information.

[0081] S206. With the goal of minimizing the bimodal alignment loss, reconstruction loss, and sparsity loss, update the feature extraction model to be trained until the first training termination condition is met, and obtain the trained feature extraction model.

[0082] Through multi-task joint optimization, the feature extraction model achieves an optimal balance among the three objectives of semantic alignment, information preservation, and feature sparsity, ultimately resulting in a feature extraction model that can fully exploit the deep correlations in multimodal data.

[0083] Construct a total loss function based on the three loss functions mentioned above. Among them, loss weight , The model is calibrated using 5-fold cross-validation. By adjusting the weight coefficients, the total loss of the model is minimized while the feature extraction accuracy is optimized. This balances the impact of the three losses and prevents a single loss from dominating the training process. If a certain weight is too large, the model may over-optimize that loss and neglect other core objectives.

[0084] Furthermore, an adaptive moment estimation optimizer (Adam) is employed during model iteration. The learning rate is set... The learning rate is used to control the step size for updating model parameters; an excessively large learning rate can cause oscillations during model training, while an excessively small learning rate will result in slow convergence. Momentum parameter: , This is used to smooth parameter updates, thereby improving the stability of the training process. Weight decay is... As an L2 regularization term, it is applied to all learnable weight matrices of the model (including the weights of the behavioral modal encoder, risk modal encoder, cross-modal mapping layer, and decoder) to prevent overfitting and improve the generalization performance of the model by suppressing excessive weight magnitudes; the bias parameter does not participate in weight decay.

[0085] The first training termination condition is limited by the number of iterations and the amount of loss reduction. Specifically, the maximum number of iterations is set to 1000; the training terminates when the relative decrease in the validation set loss over 10 consecutive iterations is less than... If the model fails to adapt, training should be stopped immediately to prevent overfitting. The training process involves using Core Risk Features (CRF). Input to the decoder to reconstruct the original features The model parameters are optimized based on a triple self-supervised loss function. Iterative training is performed using the Adam optimizer until the first training termination condition is met, at which point training ends and the CRF (Constant Ranking Form) is output. ), which serve as input features for subsequent risk evolution models.

[0086] Based on the above implementation, multi-task joint optimization effectively improves the model's feature representation capability for complex risk scenarios. First, by utilizing both behavioral modality encoders and risk scenario modality encoders to extract dimensionality reduction from basic sample features and risk scenario features, data redundancy is reduced while retaining the core information of each modality. Second, a bimodal alignment loss is constructed to constrain the semantic consistency of the two modal features, enabling the model to capture implicit cross-modal associations and solving the feature fragmentation problem. Building on this, by constructing risk features and introducing sparse loss, redundant dimensions are automatically suppressed, and highly identifiable core risk features are selected, further improving feature compactness and interpretability. Simultaneously, a decoder is used to reconstruct the risk features and calculate the reconstruction loss, forming an information preservation constraint that interacts with the sparse loss, ensuring that the model does not lose crucial original behavioral information during feature dimensionality compression. Finally, the joint parameter update aims to minimize these three losses, enabling the trained feature extraction model to accurately extract risk features with deep semantic associations and high recognizability from high-dimensional sparse, multimodal airline member account data, thus providing a solid data foundation for subsequent risk quantification and refined decision-making.

[0087] After obtaining the feature extraction model based on the above embodiments, this application also provides a risk assessment method, which can be implemented by the risk assessment system deployed on the cloud server. Figure 3 This is a flowchart illustrating a risk assessment method provided in an embodiment of this application, such as... Figure 3 As shown, this risk assessment method includes S301-S304: S301. Obtain the behavioral status data of the account to be judged.

[0088] The premise of judging account behavior is to obtain the behavior status data of the account to be judged. The specific data acquisition method and handling measures can be referred to the specific implementation method in S201 above, which will not be repeated here.

[0089] The account to be judged can be any member account (or directly correspond to any member).

[0090] The data collection process employs a combination of full updates and incremental streaming to ensure data real-time performance and integrity, adapting to dynamic changes in airline member account behavior. Basic characteristics are fully updated every 24 hours (e.g., points balance, member account level, etc., which change slowly); incremental updates are performed immediately when information changes (e.g., security authentication status, number of assignees, etc.). Behavior logs are streamed via a Kafka message queue, with a data latency of no more than 100ms, capturing member account operations in real time (e.g., login, redemption, booking, etc.). Risk scenario triggering status: determined in real-time by the rule engine, with a determination latency of no more than 500ms; the rule engine has pre-defined conditions for 16 types of fraud scenarios, such as "login from a different location" defined as "the current login Internet Protocol (IP) address is different from the commonly used IP address, and the time interval is less than 2 hours."

[0091] S302. Input the behavioral state data into the trained feature extraction model to obtain risk features.

[0092] This process transforms high-dimensional, multimodal raw behavioral state data into low-dimensional, highly discriminative risk features. Raw behavioral state data is high-dimensional and contains a large amount of redundant information; directly using it for risk assessment leads to high computational costs and severe noise interference. The trained feature extraction model can perform deep semantic fusion and noise reduction on multimodal data, outputting compact and information-rich risk features, providing high-quality input for subsequent risk evolution analysis.

[0093] The specific processing method of the input behavioral state data by the feature extraction model can be referred to the processing method of each encoder during the model training process in the above embodiments, which will not be repeated here. Finally, the risk features output by the feature extraction model are obtained as the input of the subsequent risk evolution model.

[0094] S303. Input the risk characteristics into the trained risk evolution model to obtain the behavioral risk potential.

[0095] To address the limitations of traditional static risk scoring (i.e., it only reflects the risk level at a single moment and cannot capture the evolution of risk over time, such as a member's risk dynamically increasing after logging in from a different location and then redeeming points in bulk), this application introduces a risk evolution model. In this embodiment, scene evolution partial differential equations (SEPDEs) are used. This model mathematically describes the continuous evolution of risk over time using partial differential equations, while coupling the natural evolution of behavior with the risk scene-driven effect, thereby achieving a dynamic quantitative representation of risk. The output of the risk evolution model is the behavioral risk potential (BRP).

[0096] Among them, Behavioral Risk Potential (BRP) is a quantitative indicator characterizing the cumulative deviation of an airline member's account behavior pattern from the normal baseline within a specific time window. It is calculated by fusing information on behavioral evolution trends and the intensity of risk scenario triggers. The BRP value ranges from [0, 100], reflecting both the accumulation and decline of risk and tracking the changing trend of member account risk in real time; the higher the value, the higher the risk level. BRP will serve as a core input feature for subsequent compliance verification and three-dimensional decision-making.

[0097] In one implementation, the risk evolution model is obtained through S401-S405: S401. Obtain the second training sample set.

[0098] The second training sample set includes sample risk characteristics, sample behavioral risk potential, and sample handling measures.

[0099] Unlike the unsupervised / self-supervised training of feature extraction models, risk evolution models require explicit labels to learn the complete mapping relationship between risk features and risk potential. Therefore, a supervised sample set containing three elements is needed: risk features, behavioral risk potential, and remedial measures.

[0100] Specifically, decision records within a certain period can be extracted from the airline's historical risk control decision logs. For each record, its corresponding risk characteristics can be extracted (obtained through forward inference using a pre-trained feature extraction model). Combined with manual annotation or historical decision results, the corresponding behavioral risk potential and disposal measure labels can be obtained, forming a triplet sample, which is then summarized into the second training sample set.

[0101] S402. Input the sample risk characteristics of the current sample into the risk evolution model to be trained to obtain the initial behavioral risk potential and determine the initial treatment measures corresponding to the initial behavioral risk potential.

[0102] The formula for behavioral risk potential is expressed as: (z,t)∈[0,100], where z is the risk characteristic and t is time (in hours). (z,t) represents the risk quantification value at time t and risk characteristic z. The higher the value, the greater the risk. 0 represents a risk-free state and 100 represents an extremely high-risk state, which makes it easier for airlines to intuitively assess the risk level.

[0103] The initial handling measures are determined by preset risk control rules, which have multiple rule thresholds a (e.g., 30, 70, 90, determined by ROC curve and Youden index calculations on approximately 100,000 labeled samples from airlines over the past 3 years, taking into account both risk control recall rate and accuracy).

[0104] Specifically, when (High Risk): The actions of "normal release" and "unblocking" are prohibited; when (Low Risk): The actions of "account suspension" and "account freeze" are prohibited; when (Medium-high risk): Only the "account suspension" action is allowed; the "account freeze" action is prohibited. when (Extremely high risk): The account will be frozen, and other measures will be prohibited.

[0105] In one implementation, the risk evolution model's functionality is achieved through the SEPDE core equations. The SEPDE core equations and boundary conditions are described below. The SEPDE core evolution equations are expressed as follows: The three terms on the left describe the reasons for the changes in the behavioral risk potential; the term on the right describes the driving effect of the risk scenario on the behavioral risk potential. The overall equation represents "the rate of change of risk potential = the driving effect of the risk scenario", which is consistent with the physical logic of risk evolution.

[0106] The core equation of SEPDE is based on risk characteristic terms and multiple influencing factor terms. The influencing factor terms include instantaneous risk intensity and drift term. Instantaneous risk intensity represents the sum of risk intensity of risk scenarios triggered by the account to be judged at the target time, and drift term represents the behavioral evolution trend of the account to be judged. The following is an introduction to each part of SEPDE.

[0107] The rate of change of behavioral risk potential over time refers to the risk changes caused by behavioral evolution, random fluctuations, and risk scenarios. It represents the speed at which behavioral risk potential changes over time. A positive value indicates that the behavioral risk potential is increasing (risk increases); a negative value indicates that the behavioral risk potential is decreasing (risk decreases); and a value of 0 indicates that the risk potential is stable.

[0108] The gradient of the behavioral risk potential is a 15-dimensional vector, corresponding to the 15 dimensions of the CRF. Each dimension represents the rate of change of the risk potential in the direction of the CRF feature, which is used to measure the impact of the CRF feature on the behavioral risk potential. .

[0109] This is the dot product of the gradient and the drift term, representing the impact of natural behavioral evolution on the behavioral risk potential. For example, when risk-free behavior dominates, this term is negative, indicating a decrease in the behavioral risk potential. The drift term... .

[0110] In SEPDE, the drift term is a deterministic evolutionary component. Among them, the behavioral evolution matrix... Describe the natural evolution trend of member account behavior (e.g., "If a member account has no abnormal behavior for a long period of time, the risk will naturally subside"), each element This represents the evolutionary impact of the j-th CRF feature on the i-th feature (e.g., the impact coefficient of "abnormal points balance" on "risk scenario triggering"). The offset term is used to correct the underlying evolution trend of the core risk feature (CRF) and avoid model bias.

[0111] Example parameters are as follows: (Self-evolution coefficient of member account level characteristics); (Evolution coefficient of membership time characteristics); (Evolution coefficient of historical violation records, with the highest weight); Offset vector Initialize as a vector of all zeros and fine-tune it during the training phase.

[0112] It is the second-order partial derivative of the risk potential, the Hessian matrix, which is a 15×15 matrix used to measure the convexity of the rate of change of the behavioral risk potential. The trace of a matrix is ​​the sum of the elements on its main diagonal. This term represents the impact of random fluctuations in behavior on the risk potential. The smaller the fluctuation, the closer this term is to 0, and the more stable the risk potential. .

[0113] The risk scenario driver term represents the impact of risk scenario drivers on the behavioral risk potential, expressed through the risk intensity coefficient. With instantaneous risk intensity The product representation ( This indicates the driving effect of the current risk scenario on the behavioral risk potential; the more risk scenarios are triggered, the greater the harm. The larger the value, the faster the risk increases. This includes instantaneous risk intensity. This quantifies the overall intensity of a member's account triggering a risk scenario at a given moment. It is calculated by weighting 16 risk scenario categories; a higher value indicates a more severe risk. Risk Scenario Weights The value of i ranges from 1 to 16, corresponding to 16 risk scenarios, and satisfies... The weights are summed to 1 to ensure that the risk intensity value falls within the range [0,1]. The weights are calibrated using case studies, with higher weights applied to high-risk scenarios (such as "mileage trading"). "Misuse of ID information" Low-harm scenarios have lower weighting (e.g., "improper use of coupons"). Risk intensity coefficient The intensity coefficient was calibrated using historical airline data and a grid search of fraud cases. It iterated through integers and floating-point numbers with a step size of 0.5 within the range of 1 to 10. Combined with receiver operating characteristic (ROC) curves and Youden's index analysis of 100,000 labeled samples (including 30,000 fraudulent samples and 70,000 normal samples), the optimal value of 5 was determined (at which point the recall rate reaches 92%, the precision rate reaches 88%, and the overall effect is optimal). This value is used to control the driving strength of risk scenarios on behavioral risk potential. If the risk level is too high, the behavioral risk will rise too quickly, making it easy to misjudge; if it is too low, the behavioral risk will react too slowly, which may lead to underreporting.

[0114] diffusion term , representing the random fluctuation component in SEPDE, describes the intensity of random fluctuations in member account behavior (e.g., "an occasional abnormal behavior of a member account will not lead to a sharp increase in risk"); this matrix is ​​a 15-dimensional diagonal matrix (corresponding to the 15-dimensional CRF), with elements on the diagonal being... , (To avoid excessive volatility and ensure the stability of risk evolution), the off-diagonal elements are 0, indicating that the volatility of each CRF feature is independent of each other.

[0115] The boundary conditions of SEPDE are used to ensure the rationality of the solution to the above SEPDE equation and avoid behavioral risk anomalies. The initial conditions are as follows: Where z(0) represents the CRF feature at the initial time (t=0), This represents the triggering state of the i-th type of risk scenario at the initial moment. The formula indicates that the behavioral risk potential is determined by the risk scenario intensity at the initial moment. Multiplying by 100 converts the risk intensity ([0,1]) into a behavioral risk potential ([0,100]), ensuring the initial risk potential is within the range [0,100]. The termination condition is: ,in, For observation window (90 days). This represents the risk potential at the instant before the termination time. The min function prevents the risk potential from exceeding the upper limit of 100, ensuring a consistent quantification standard. The zero-risk decay condition is... hour, When no risk scenarios are triggered in a member's account, the risk will naturally decrease at a rate of 1% per day (approximately 0.04% per hour), which is consistent with the actual risk control logic (if a member's account has no abnormal behavior for a long period of time, the risk will gradually decrease).

[0116] After completing the above preparations, the SEPDE equations need to be solved to convert the continuous partial differential equations into a discrete form that can be computed by a computer, ensuring the feasibility of engineering applications while guaranteeing the accuracy of the solution.

[0117] First, define the discretization parameters involved in the discretization solution, including time discretization: Day (observation window), time step After discretization, 2160 time steps are obtained (hours). (90 days × 24 hours / day = 2160), with a time step of 1 hour to balance real-time performance and computational load (capturing risk changes in real time without excessive computational pressure due to overly fine time steps). The time nodes are: Spatial discretization: For each dimension (15 dimensions) in the CRF, according to... The interval is discretized into 100 grid points (error ≤ 1%). The spatial derivative is discretized using the finite difference method (FDM). The more grid points there are, the higher the solution accuracy, but the greater the computational cost.

[0118] The continuous spatial derivative is converted into a discrete numerical calculation using the finite difference method. The first derivative is calculated using forward difference, as shown in the formula: ,in, The grid step size is used to adapt to the real-time nature of risk evolution, calculating the impact of the current moment on the next moment; the second derivative is calculated using the central difference formula, which is: This is used to improve solution accuracy and reduce discretization errors. The discretized equation is expressed as: ,in, This represents the behavioral risk potential at the k-th time step (corresponding to time t = k × Δt); This represents the risk potential at the (k+1)th time step, i.e., the behavioral risk potential at the next moment. This represents the CRF at the k-th time step. Each iteration is based on the behavioral risk potential of the previous step and the current CRF and risk scenario, ensuring that the evolution of the behavioral risk potential is synchronized with the behavior of member accounts.

[0119] The above formula can be understood as: the behavioral risk potential at the next moment = the behavioral risk potential at the current moment + the time step × (risk scenario driving effect - the influence of natural behavioral evolution - the influence of random behavioral fluctuations). Essentially, it achieves dynamic evolution of the risk potential by iteratively updating the risk potential at each time step through calculation. The BRP evolution sequence is obtained by iteratively solving 2160 time steps using the discretized equation. ( After each iteration, a range check is performed (to ensure...). Avoid outliers (such as a negative risk value or a risk value exceeding 100).

[0120] In one implementation, a long short-term memory (LSTM) network and a gated recurrent unit (GRU) can be used to learn temporal patterns in order to replace the numerical solution of SEPDE.

[0121] After the solution is completed, the output structure needs to be verified. This application uses triple verification to ensure the rationality of BRP and avoid the distortion of risk potential due to solution error or data abnormality.

[0122] First, the range of behavioral risk potential output is verified to ensure... Outliers outside the range are corrected using linear interpolation, such as... Revised to 100 Corrected to 0.

[0123] Then, its trend is verified, and if there is no risk, such as... At that time, check , It should gradually decrease, showing a decaying trend. If it appears... Then it is corrected to (Forced attenuation); In high-risk situations, such as hour, It should gradually rise or stabilize at a high level; if the trend is abnormal, a new solution should be found.

[0124] Finally, the stability of the output is verified, including adjacent differences. To avoid abrupt changes in behavioral risk potential, such as a sudden increase from 20 to 80, which is considered abnormal, the CRF characteristics and solution process need to be re-verified, and the diffusion term adjusted. After increasing the parameter by 0.01, the solution is recalculated; once the verification passes, the final time step is taken. As the ultimate behavioral risk potential BRP.

[0125] In one implementation, the output behavioral risk potential needs to be modified in conjunction with risk control rules. For example, this application provides a rule barrier function (RBF) formula, expressed as follows: To smooth out rule constraints and avoid threshold jumps, This is an RBF hard constraint function; the larger the output value, the more the behavioral risk potential conforms to the corresponding rule. The constraint conditions are: (Because the value of the exponential function is always greater than 0, the actual constraint is "when the risk potential satisfies the rule, The value is relatively large; if the condition is not met, (When the value approaches 0, a correction is triggered). For rule threshold parameters (such as rule " In the phrase "No normal release", ), which corresponds to the critical value of the risk control rules; (The smoothing parameter was determined through comparative experiments, by testing values ​​within the range of 3-7.) Optimal constraint smoothness, avoiding abrupt changes near the threshold: Used to ensure constraint smoothness and avoid abrupt changes near the threshold (e.g., ... and The constraint strength changes gradually, rather than abruptly, to avoid sudden changes in response measures due to minor fluctuations in risk potential; (Square Distance): Represents the degree of deviation between the current risk potential and the rule threshold. The greater the deviation, the smaller the value of the hard constraint function, indicating that it is less in line with the rule.

[0126] In practical applications, to reduce computational load, it is simplified to the following piecewise function: .

[0127] Each candidate disposal measure (normal release, light monitoring, moderate warning, manual review, account suspension, account freezing) is verified and calculated. Filter out those that meet the requirements Legitimate actions; When there is no legal action (such as risk) However, the candidate action is to suspend the account, which violates the " (Prohibit account suspension rule), correct BRP to the most recent compliant range (correction range ≤ 5, to avoid excessive correction causing distortion of risk, such as...) (The value is adjusted to 30 instead of directly to 50) until a set of legal actions is selected.

[0128] The revised behavioral risk potential is defined as the compliant behavioral risk potential (C-BRP): its value ranges from [0, 100]. It aligns with the evolution of member account behavior while also meeting risk control rules, providing a reasonable and compliant basis for subsequent three-dimensional decision-making. Its significance lies in ensuring that the risk potential both reflects actual risk changes and complies with airline rules, avoiding situations that are "reasonable but not compliant" or "compliant but not in line with actual risk."

[0129] S403. Based on the initial behavioral risk potential and the sample behavioral risk potential, construct the evolutionary loss.

[0130] The behavioral risk potential output by the risk evolution model needs to be ensured to conform to both the natural evolution of airline member account behavior (soft constraint, to avoid the risk potential from being out of touch with actual behavior) and strictly adhere to the airline's core risk control rules (hard constraint, to ensure compliance in risk handling). Therefore, the above requirements can be achieved through the synergistic constraint of S403's SEPDE soft constraint (loss) and S404's RBF hard constraint (rule loss).

[0131] Specifically, the formula for evolution loss can be expressed as: ,in, The SEPDE residual formula, in its complete form, is as follows: ,in, , This represents the residual at the k-th time step, and is a non-negative value. It is used to measure whether the risk potential evolution at the k-th time step conforms to the core equation of SEPDE. The smaller the residual, the more the risk potential evolution conforms to the behavioral evolution law and the closer it is to the actual behavior of member accounts. This indicates a perfect fit to the evolutionary pattern; the actual meaning of the residual formula is, residual = |(actual rate of change of behavioral risk potential) - (theoretical rate of change of behavioral risk potential)|, where " "This is the actual rate of change of the behavioral risk potential (obtained through iterative calculation)," " is the theoretical rate of change of risk potential (derived from the SEPDE core equation), and the absolute value of the difference between the two is the residual.

[0132] It is the squared average of the residuals at all time steps, which can amplify the influence of larger residuals (the larger the residual, the more obvious the effect after squaring), making it easier to discover cases that seriously deviate from the evolutionary pattern; (Total number of time steps), this formula is used to comprehensively measure the rationality of the risk potential evolution within the entire observation window; The smaller the BRP, the more it conforms to the natural evolution of airline member account behavior.

[0133] S404. Based on the initial treatment measures and treatment measures, construct the rule-based loss.

[0134] Cross-entropy loss is used to measure the fit between behavioral risk potential and risk control rules. The smaller the loss, the higher the fit. The formula is as follows: Where m is the number of rules. For rule labels (1 = conforms to the rule, 0 = does not conform to the rule). This is the output value of the RBF hard constraint (rule loss) function.

[0135] S405. With the goal of minimizing evolutionary loss and rule loss, update the parameters of the risk evolution model to be trained until the second training termination condition is met, and obtain the trained risk evolution model.

[0136] A dual-constraint fusion loss is constructed based on evolutionary loss and rule-based loss. This loss is used to measure the degree to which behavioral risk potential is both compliant and consistent with evolutionary patterns; the smaller the loss value, the higher the rationality of BRP. Among these, (Evolutionary loss weights) (Rule loss weights), the sum of the two is 1 ( ); early training , Prioritize compliance with risk control rules to avoid compliance risks caused by immature initial models; mid-term linear adjustments (0.05 per week): It increased linearly from 0.3 to 0.7. The weighting gradually decreases from 0.7 to 0.3, increasing the weighting for fitting the evolutionary pattern to balance generalization ability and rule rigidity; in the later stages... , Prioritize alignment with the evolution of risks, improve the accuracy of risk assessment, and enhance adaptability to new fraud scenarios.

[0137] The model is iterated using gradient descent, with an iteration step size of [missing information]. (Calibration is performed to avoid oscillations caused by excessively rapid correction); the correction range is ≤5 to ensure that the risk potential is not distorted (e.g., if the original BRP value is 68, the corrected value should not exceed 73 or be lower than 63); final output: the compliance behavior risk potential is obtained by fine-tuning BRP using the gradient descent method. (C-BRP) ensures both compliance and alignment with actual risks.

[0138] The second training termination condition can be the same as the first training termination condition, or it can be set according to actual needs.

[0139] During training, the verification process and results are recorded to provide a basis for subsequent tracking and optimization. This includes recording the rule loss verification results (which rules passed, which rules triggered corrections, and the BRP values ​​before and after correction), and the evolutionary loss (…). The system generates a constraint verification report, which includes core information such as "verification time, member card number, CRF feature, original BRP value, correction value, verification result, and anomaly description". The report also includes the specific numerical value, whether it meets the threshold requirements, and the changes before and after BRP correction (correction range and reason).

[0140] S304. Determine the corresponding handling measures based on the behavioral risk potential, and implement the corresponding handling measures for the accounts to be judged.

[0141] Transforming quantified risk results into concrete risk control actions creates a closed loop from risk perception to risk management. Risk scoring alone, without corresponding management strategies, fails to generate real business value. By mapping behavioral risk potential to different management measures, we achieve refined and automated risk control, ensuring the safety of member assets while avoiding unnecessary interference with low-risk accounts.

[0142] Specifically, a mapping rule between pre-defined behavioral risk potential and handling measures is established (e.g., a risk potential in the range [0, θ1) corresponds to release, [θ1, θ2) corresponds to enhanced verification, and [θ2, +∞) corresponds to account freezing). The corresponding handling measures are determined based on the current value of the behavioral risk potential. Then, the risk control decision engine calls the interface of the airline's business system to automatically execute the corresponding handling measures. The complete decision-making chain of this judgment (input features, risk features, risk potential, and handling measures) is recorded in the audit log to meet the compliance requirements of financial-grade audits.

[0143] It should be noted that if the risk evolution model meets the requirements in the initial state, the behavioral risk potential is directly used to determine the remedial measures. If it has undergone iteration or modification, the compliance behavioral risk potential output by the iterated model is used. (C-BRP) determines the appropriate measures to be taken.

[0144] Based on the implementation methods of S301-S304 described above, firstly, by acquiring the basic characteristics and risk scenario characteristics of the account to be judged, the system covers both user behavior profiles and risk scenarios, providing a sufficient data foundation for subsequent analysis. Then, the behavioral state data is input into a pre-trained feature extraction model, which outputs highly identifiable risk features. On this basis, the risk features are input into a trained risk evolution model. This model can dynamically deduce the behavioral risk potential based on the risk features, depicting the evolution trend of risk over time, overcoming the limitation of traditional rule engines' static thresholds in failing to perceive dynamic changes in risk. Finally, based on the behavioral risk potential, corresponding response measures are determined and executed, achieving a closed loop from risk perception to risk response.

[0145] In one implementation, S304 can be implemented using S3041-S3042: S3041 Determine decision information; the decision information includes the behavioral risk potential, the confidence level of the behavioral risk potential, and the severity of the risk scenario currently triggered by the account to be judged.

[0146] Based on compliance behavior risk Or behavioral risk potential, confidence level (Prediction reliability), scenario severity (Situational Harm Level) Three Dimensions, Compliance Behavior Risks : Characterizes the magnitude of risk; confidence level : Whether the risk profile of compliance behavior is reliable; the severity of the scenario. : Represents the level of risk and hazard; the three form a complementary and interlocking decision-making logic, solving the problems of easy misjudgment in single-dimensional decision-making and inability to distinguish different hazards with the same score, realizing refined and interpretable graded decision-making, matching differentiated disposal measures, reducing the misjudgment rate and the probability of over-disposal (avoiding a "one-size-fits-all" disposal approach, such as different disposal measures for member accounts with the same behavioral risk potential but different confidence levels).

[0147] in, The value range [0, 100] is the core dimension of three-dimensional decision-making; (Confidence level): Measures the reliability of the prediction results of behavioral risk potential. The value ranges from [0,1]. The higher the value, the more reliable the prediction. (Scenario Severity): Measures the degree of harm caused by a member triggering a risk scenario. The value ranges from [0,1]. The higher the value, the greater the harm of the scenario. Differentiated handling measures refer to differentiated handling methods based on three-dimensional matching, including 6 categories such as normal release and light monitoring, to ensure accurate handling.

[0148] Specifically, the confidence level needs to be calculated first by sampling the output of the risk evolution model multiple times, with each sampling set to 100 times, and a dropout rate of 0.1 (randomly discarding 10% of neurons during training to improve generalization ability). The confidence level formula is expressed as: The value ranges from [0,1]. The closer the value is to 1, the more reliable the prediction result is; the closer it is to 0, the greater the dispersion of the prediction result and the lower the reliability. : 100 BRP prediction values ​​obtained after sampling the same member account features 100 times; (Standard deviation): Measures the dispersion of 100 predicted values. The smaller the dispersion, the smaller the standard deviation, indicating that the prediction results are more stable. (Mean): The average of 100 predicted values, reflecting the average level of the predictions. If... (The predicted mean is too low, so calculating the dispersion is meaningless), so set it directly. (In low-risk scenarios, the prediction reliability is assumed to be relatively high); if (If the prediction confidence is too low and the reliability is insufficient), mark it as "low confidence risk" and increase the monitoring level in subsequent decision-making to avoid misjudgment.

[0149] Then, the severity of the scenario is calculated, and the formula is expressed as: Risk scenario weight Triggering scenario set ,in Scenario hazard coefficient The inherent severity of the risk corresponds to 16 risk scenarios, with a value range of [1,5]. High-risk scenarios (such as mileage trading and identity theft) have a value of 5, while low-risk scenarios (such as the misuse of coupons) have a value of 1. These values ​​are calibrated by airline risk control experts and are weighted accordingly. Collaborative efforts to improve the differentiation of scenario severity; To smooth out the terms, avoid having a denominator of 0.

[0150] For example, a member's account triggers "mileage trading" ( , ) and "abnormal login from another location" , ),but , Severity of the scene After normalization (Normalized to the [0,1] interval).

[0151] S3042. Based on decision information, determine the target matrix unit from the preset decision matrix.

[0152] By constructing a three-dimensional decision matrix, collaborative decision-making based on "risk intensity + prediction reliability + scenario hazard" can be achieved.

[0153] The decision matrix is ​​a three-dimensional matrix, where each matrix element corresponds to a risk level and a corresponding response measure. Specifically, the vertical axis of the decision matrix is ​​C-BRP / BRP, ranging from 0 to 100, divided into 5 intervals; the horizontal axis... (Confidence level), ranging from 0 to 1, divided into 3 intervals; third dimension (Scenario severity), ranging from 0 to 1, divided into 2 intervals; construct a 5×3×2 three-dimensional decision matrix, with each matrix unit corresponding to a unique risk level and response measures.

[0154] For example, the following risk levels may be included: Risk Level 1 (Extremely Low Risk): , , ; Risk Level 2 (Low Risk): , , ;or , , ; Risk Level 3 (Medium Risk): , , any ;or , , ; Risk Level 4 (High Risk): , any , any ;or , , any ; Risk Level 5 (Extremely High Risk): , any , any .

[0155] S3043, The corresponding handling measures for the target matrix unit of the account to be judged.

[0156] Based on the three-dimensional hierarchical decision-making output, the disposal measures can be automated and precise, ensuring timely and effective disposal. At the same time, it supports manual intervention and anomaly handling, balancing risk control effectiveness and member experience (avoiding excessive disposal from affecting normal member use), and ultimately achieving the risk control goal of "controllable risk, efficient disposal, and user-friendly experience".

[0157] Based on the risk level identified in S3042, corresponding response measures are determined, including: Risk Level 1: Normal access, no additional monitoring required, only basic behavior logs recorded; Execution content: Allow members to use all account functions normally (points redemption, reservation, login, etc.) without imposing any additional restrictions; Execution method: Automated execution, access is granted immediately upon receiving the instruction, and execution logs (access time, member information) are recorded synchronously; Linkage logic: Only the log system is linked to retain basic behavior records, no linkage to the monitoring system is required.

[0158] Risk Level 2: Light monitoring, daily statistical behavior logs, monitoring is automatically lifted if no abnormalities are found; Execution content: Daily statistical analysis of member behavior logs (login, operation, risk scenario triggering), monitoring is automatically lifted daily if no abnormalities are found, monitoring is upgraded to medium level if abnormalities are found (such as triggering low-risk scenarios); Execution method: Automated execution, the monitoring system statistically analyzes the previous day's behavior at 0:00 every day and generates a simple monitoring report; Linkage logic: Links the monitoring system and the log system to synchronously record monitoring results and behavior logs.

[0159] Risk Level 3: Moderate monitoring. Real-time monitoring of risk scenario triggers, generating a monitoring report every 3 hours, and triggering alerts when anomalies occur; Execution content: Real-time monitoring of member risk scenario triggers, generating detailed monitoring reports every 3 hours (including behavior details, risk scenario triggers, and C-BRP change trends), and immediately sending alerts to risk control personnel when new high-risk scenarios are triggered; Execution method: Automated execution + manual inspection, with the monitoring system monitoring in real time and risk control personnel inspecting monitoring reports daily; Linkage logic: Linking the monitoring system, log system, and alert system to synchronously push alert information and monitoring reports.

[0160] Risk Level 4: Heavy monitoring + manual review. High-risk operations (such as bulk points redemption) are blocked in real time, and risk control personnel complete manual review within 2 hours. Execution content: Block high-risk member operations in real time (bulk points redemption, points transfer, payment operations after logging in from a different location, etc.). Risk control personnel complete manual review within 2 hours, and determine whether to lift the block or adjust the risk level after review. Execution method: Automated blocking + manual review. The automated module blocks high-risk operations in real time, and the manual intervention module receives review tasks and provides feedback on the review results. Linkage logic: Links the member system (blocking operations), monitoring system (real-time monitoring), log system (recording blocking and review status), and early warning system (pushing review reminders).

[0161] Risk Level 5: Temporary Account Freeze + Full Investigation. Immediately freeze all operational permissions of the member account. The risk control team will complete a full investigation within 24 hours, determine the nature of the risk, and decide on subsequent actions (unfreeze or permanent freeze). Execution Content: Immediately freeze all operational permissions of the member account (login, redemption, reservation, payment, etc.), prohibiting any account operations. The risk control team will complete a full investigation within 24 hours (combining full-chain traceability logs, member historical behavior, and risk scenario triggering). After investigation, the decision on the handling result will be made (normal unfreeze, unfreeze after risk level reduction, or permanent freeze). Execution Method: Automated freezing + manual full investigation. The automated module immediately freezes the account, while the manual intervention module assigns investigation tasks and records the investigation process and results. Linkage Logic: Links the member system (freezing accounts), monitoring system (comprehensively monitoring account dynamics), log system (recording freezing and investigation status), and early warning system (pushing emergency investigation reminders).

[0162] For example, to execute disposal measures, a disposal execution engine (DEE) is defined. This engine is used to execute disposal measures based on hierarchical decision outputs and supports both automated execution and manual intervention. The engine includes the following core modules: Instruction receiving module: Receives disposal instructions (risk level, disposal measures, traceability ID, member information) output by the three-dimensional hierarchical decision module, verifies the legality of the instructions (such as "whether the disposal measures match the risk level" and "whether the member account status is normal"), and returns invalid instructions to the decision module for re-determination; Automated execution module: Responsible for executing handling measures that do not require human intervention (such as normal release, light monitoring, and medium monitoring), and linking with the airline's membership system, log system, and monitoring system to automatically complete operations and record execution status; Manual intervention module: responsible for handling measures that require manual review and execution (such as heavy monitoring, account freezing, and comprehensive verification), receiving manual operation instructions, providing feedback on execution results, and recording the manual intervention process.

[0163] If the handling measures fail to be executed (e.g., "Account freezing failed, reason: member account has been cancelled" or "Blocking operation failed, reason: system interface abnormal"), the execution engine will immediately retry (retry ≤ 3 times, with an interval of 10 seconds between each retry). If the retry fails, the abnormal information will be recorded and an alert will be sent to the risk control personnel for manual intervention to complete the handling. If manual review reveals decision-making biases (such as misjudging high risk), the handling measures can be manually adjusted (such as unfreezing accounts or reducing monitoring levels), and feedback can be sent to the dual-constraint collaborative verification module and the three-dimensional decision-making module to optimize parameters and decision matrices. If changes in member risk are detected during monitoring (e.g., "a low-risk member triggers a high-risk scenario, and C-BRP rises to 70"), the three-dimensional values ​​will be automatically recalculated, the risk level will be reassessed, and the handling measures will be adjusted (e.g., from light monitoring to heavy monitoring). If a member's account has objections to the handling measures (such as "account was mistakenly frozen"), an appeal will be received. Risk control personnel will review the appeal in conjunction with the full-chain traceability logs. If the review is correct, the handling measures will be maintained. If the review is incorrect, the measures will be adjusted immediately, and the appeal handling process will be recorded.

[0164] Furthermore, after implementing the corresponding response measures, the decision results are output and fed back synchronously to ensure that the response measures are executable and traceable. For example, the risk level, matching response measures, and specific numerical values ​​across three dimensions are output. , , The decision-making basis (e.g., "Triggered XX risk scenario, scenario severity S=0.86, prediction confidence C=0.92, C-BRP=75, judged as high risk, execute heavy monitoring + manual review") is synchronized to the "Disposal Measures Execution Module" (execute specific disposal) and the "Full-Link Traceability Record Module" (record the decision-making process); if a decision deviation is found after manual review (e.g., misjudgment of high risk), it is fed back to the dual-constraint collaborative verification module, the parameters are adjusted and C-BRP is recalculated, the decision matrix is ​​optimized, and the accuracy of subsequent decisions is improved.

[0165] Based on the implementation methods of S3041-S3043 described above, by introducing three-dimensional decision information including behavioral risk potential, confidence level, and risk scenario severity, and determining the appropriate response measures based on a preset three-dimensional decision matrix, a leap from single-dimensional risk scoring to multi-dimensional refined decision-making is achieved. Traditional rule engines rely solely on a single risk score for response, failing to distinguish between the two drastically different scenarios of "high-risk score but low confidence" and "high-risk score and high confidence." However, by comprehensively considering the multi-dimensional aspects of three-dimensional decision information, this problem can be effectively avoided. Specifically, behavioral risk potential quantifies the overall risk level of the account, confidence level reflects the credibility of the risk assessment result, and risk scenario severity characterizes the harmfulness of the current triggering scenario itself. These three elements together constitute a complete risk decision context. Based on this, the three-dimensional decision matrix combines these three dimensions, with each matrix unit corresponding to a specific risk level and response measure, enabling the output of differentiated response strategies for different dimensional combinations. This three-dimensional refined decision-making mechanism overcomes the limitations of traditional rule engines, which have a single decision-making logic and cannot comprehensively consider multiple dimensions. It also makes up for the shortcomings of general machine learning models, which lack rigid rule constraints and have uncontrollable decisions. While ensuring the accuracy of risk control decisions, it also takes into account interpretability and compliance, meeting the dual needs of refined management and financial-grade auditing in the risk control scenario of airline members.

[0166] In one implementation, following S304, the method further includes S305-S306: S305 generates a risk profile for the account to be assessed based on behavioral status data, behavioral risk potential, and remedial measures.

[0167] By establishing risk profiles, the entire process of risk management for member accounts can be made traceable, auditable, and reviewable, covering all stages from "data collection to feature extraction, risk modeling, compliance verification, hierarchical decision-making, and disposal execution." Core data and operation records for each step are retained to meet regulatory compliance requirements. At the same time, it provides data support for risk control model optimization and risk event review, avoiding the problems of "risk events being untraceable and problems being unlocatable."

[0168] In addition to behavioral status data, behavioral risk potential, and handling measures, risk profiles can also include input data, output results, operation time, parameter settings, and anomaly information for each stage. Furthermore, they can integrate end-to-end traceability logs to form an analytical dataset. This dataset covers complete records of both legitimate and fraudulent member accounts, used for model optimization and risk event review, and annotates risk types and decision-making biases.

[0169] Specifically, record the data collection time, collection method (full / incremental), raw data details (core feature values), preprocessing operations (outlier replacement, missing value filling, standardized results), comparison of data before and after preprocessing, and description of abnormal data (e.g., "the integral balance is -100, which is identified as an anomaly according to the 3σ principle and replaced with the 99th percentile of 10000"). Logs for the unsupervised core feature extraction process: Record RS-BAE model parameters (weight initialization method, cold start state, number of training epochs), CRF extraction results (specific values ​​of the 15-dimensional core features), and model loss value. ), feature extraction time, and abnormal situations (such as "insufficient samples, enable cold start, load pre-training parameters and fine-tune"). Logs for the risk evolution modeling process: Record SEPDE model parameters ( , , The BRP evolution sequence (BRP values ​​at key time steps), the solution process (discretization parameters, number of iterations), the result verification (range, trend, and stability verification results), and the final BRP value; For the dual-constraint collaborative verification process log: record the original BRP value, the corrected C-BRP value, the correction magnitude and reason, the hard constraint verification results (rule pass status, RBF barrier function value), and the soft constraint residual loss (…). ), core content of the verification report, and verification time; Logs for the three-dimensional hierarchical decision-making process: Record the values ​​of the three dimensions ( , , ), decision matrix matching process, risk level determination basis, handling measures, decision time, and manual review records (if any); For the log of the disposal measures execution process: record the execution time, the executing entity (automatic / manual), the execution result (such as "account temporarily frozen successfully" or "manual review passed, monitoring lifted"), and the explanation of execution anomalies (such as "disposal failed, reason: member account has been cancelled").

[0170] S306. Generate an index for the risk profile.

[0171] After establishing the risk profile, a corresponding index needs to be created to meet the needs of rapid retrieval in the future.

[0172] The index includes the identity identifier of the account to be judged, the current timestamp, and the random code.

[0173] For example, it includes a combination of "identity identifier + timestamp + random code", in the format "XXX (identity identifier)_YYYYMMDDHHMMSS (timestamp, year-month-day-hour-minute-second)_XXX (3-digit random code)" to ensure uniqueness (avoid confusion of risk control process logs from different member accounts and different times).

[0174] S307. Store the risk profile in the risk database and add the index to the risk database directory.

[0175] The system adopts a combination of "distributed database + file storage". Structured logs (such as parameters, results, and time) are stored in the distributed database (supporting high-concurrency queries with a response time of ≤100ms), while unstructured logs (such as verification reports and exception screenshots) are stored in the file system and archived according to "traceability identifier + step". Core logs (decision results, handling records, and abnormal information) are stored for ≥3 years, while ordinary logs (such as normal data collection records) are stored for 1 year, and are automatically archived and backed up upon expiration. It supports multi-dimensional queries, including traceability identifier queries, identity identifier queries, time range queries, risk level queries, and disposal measure queries. Query results can be exported to PDF / Excel format for easy auditing and review. At the same time, it provides log retrieval function, supporting keyword search (such as "points cash-out" and "account freezing") to quickly locate relevant risk events.

[0176] In addition, the entire traceability log is regularly (monthly) integrated, and the complete records of normal members and fraudulent members' accounts are filtered out. The types of risk events (such as points cashing out and document misuse) and decision-making biases (such as misjudgment and omission) are marked, and a review dataset is built for model parameter calibration and optimization.

[0177] The aforementioned regularly integrated logs can be applied to risk event debriefing. When a fraud incident occurs, the complete process can be queried through traceability markers to pinpoint problematic links (such as "feature extraction bias leading to missed judgment" or "unreasonable decision matrix threshold leading to misjudgment") and formulate optimization plans. It can also be applied to model optimization, inputting the debriefing dataset into RS-BAE and SEPDE models to retrain and calibrate parameters, thereby improving the accuracy of risk identification and decision-making. Thirdly, it can be used for regulatory audits, providing regulatory authorities with complete traceability logs to prove that the risk control process is compliant and traceable.

[0178] Based on the implementation methods of S305-S307 described above, a risk profile containing behavioral status data, behavioral risk potential, and handling measures is constructed, achieving complete retention of information across the entire risk control decision-making process. This provides a traceable data foundation for post-audit, manual review, and model iteration. The risk profile links the input (behavioral status data), intermediate results (behavioral risk potential), and final output (handling measures) of a risk control decision into a complete decision chain, enabling any risk control judgment to be reconstructed and verified, meeting the compliance requirements of financial-grade audits in airline member risk control scenarios. Furthermore, by generating an index containing an identity identifier, timestamp, and random code, the identity identifier allows for quick location of all historical risk records for an account at the account level, facilitating the analysis of the risk evolution trajectory of the same account; the timestamp supports retrieval at the time-series level, facilitating the tracing of risk control decisions within a specific time period; and the random code ensures the uniqueness of the profile, preventing duplicate profiles from being generated by concurrent operations for the same account at the same time, while also enhancing the profile's tamper-proof capabilities.

[0179] Alternatively, a complete alternative can be adopted: "supervised feature extraction + temporal risk modeling + dual-constraint decision making": risk features are extracted using a convolutional neural network (CNN), with the input of the CNN being a preprocessed 36-dimensional member behavior state space. The output is risk features, which are consistent with the output dimensions of RS-BAE (15 dimensions). GRU is used to model the temporal evolution of risk. The other modules (dual constraint collaboration, full-link traceability) remain unchanged. The core difference is that the feature extraction method is changed from unsupervised to supervised. It is suitable for scenarios with large-scale labeled samples and can still achieve the core purpose of dynamic risk management.

[0180] In risk control scenarios involving multiple institutions and data not leaving the domain, the RS-BAE feature extraction step of this application can be implemented using horizontal federated learning. Each participant trains locally, transmitting only model parameters and gradients without leaking the original data, thus achieving global risk modeling.

[0181] All alternative solutions can achieve the core objective of this invention, differing only in their module implementation methods, and do not deviate from the core technical concept of "dynamic risk quantification, dual-constraint collaboration, hierarchical decision-making, and full-link traceability".

[0182] This application embodiment can divide the following device into functional modules based on the above method example. For example, each function can be divided into its own functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. Optionally, the module division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0183] In some embodiments, this application also provides a model training apparatus. The model training apparatus may include one or more functional modules for implementing the methods described in the above embodiments. For example, Figure 4 This is a schematic diagram of the structure of a model training device 400 provided in an embodiment of this application. Figure 4 As shown, the model training device 400 includes: The first acquisition module 410 is used to acquire a first training sample set, which contains multiple sample behavior state data. The sample behavior state data includes sample basic features and sample risk scenario features. The sample basic features are used to characterize the basic attributes and behavioral information of the sample account, and the sample risk scenario features are used to characterize risk scenario information. The first processing module 420 is used to input the basic features of the current sample into the behavioral modality encoder of the feature extraction model to be trained to obtain behavioral modality features, and input the risk scenario features of the current sample into the risk scenario modality encoder of the feature extraction model to be trained to obtain risk scenario modality features; the dimension of the behavioral modality features is lower than that of the basic features of the sample, and the dimension of the risk scenario modality features is lower than that of the risk scenario features of the sample. The first processing module 420 is also used to construct a bimodal alignment loss based on behavioral modal features and risk scenario modal features. The bimodal alignment loss characterizes the semantic consistency between behavioral modal features and risk scenario modal features. The first processing module 420 is also used to construct risk features based on behavioral modal features and risk scenario modal features, and to determine sparse loss based on the risk features; the sparse loss is used to characterize the sum of feature values ​​of each dimension in the risk features; The first processing module 420 is also used to reconstruct the risk features using the decoder to obtain reconstructed behavioral state data, and to determine the reconstruction loss based on the deviation between the reconstructed behavioral state data and the sample behavioral state data. Training module 430 is used to update the feature extraction model to be trained with the goal of minimizing the bimodal alignment loss, reconstruction loss and sparsity loss until the first training termination condition is met, so as to obtain the trained feature extraction model.

[0184] In some embodiments, this application also provides a risk assessment device. This risk assessment device may include one or more functional modules for implementing the methods described in the above embodiments. For example, Figure 5 This is a schematic diagram of the structure of a risk assessment device 500 provided in an embodiment of this application. Figure 5 As shown, the risk assessment device 500 includes: The second acquisition module 510 is used to acquire behavioral status data of the account to be judged; the behavioral status data includes basic characteristics and risk scenario characteristics. The second processing module 520 is used to input behavioral state data into a trained feature extraction model to obtain risk features; the feature extraction model is obtained based on the model training method provided in the first aspect. The second processing module 520 is also used to input risk features into the trained risk evolution model to obtain behavioral risk potential; The judgment module 530 is used to determine the corresponding handling measures based on the behavioral risk potential and to execute the corresponding handling measures on the account to be judged.

[0185] In one implementation, the judgment module 530 is further configured to: determine decision information; the decision information includes behavioral risk potential, confidence level of behavioral risk potential, and severity of risk scenario currently triggered by the account to be judged; based on the decision information, determine target matrix units from a preset decision matrix; the decision matrix is ​​a three-dimensional matrix, and each matrix unit in the decision matrix corresponds to a risk level and a corresponding handling measure; and execute the handling measures corresponding to the target matrix unit for the account to be judged.

[0186] In one implementation, the processing module 520 is further configured to: generate a risk profile of the account to be judged based on behavioral status data, behavioral risk potential, and handling measures; generate an index of the risk profile; the index includes the identity identifier, current timestamp, and random code of the account to be judged; store the risk profile in a risk database; and add the index to the directory of the risk database.

[0187] In one implementation, the risk evolution model is obtained through the following steps: acquiring a second training sample set; the second training sample set includes sample risk characteristics, sample behavioral risk potentials, and sample disposal measures; inputting the sample risk characteristics of the current sample into the risk evolution model to be trained to obtain the initial behavioral risk potential, and determining the initial disposal measures corresponding to the initial behavioral risk potential; constructing an evolutionary loss based on the initial behavioral risk potential and the sample behavioral risk potential; the evolutionary loss characterizes the degree of difference between the initial behavioral risk potential and the sample behavioral risk potential; constructing a rule loss based on the initial disposal measures and the disposal measures; the rule loss characterizes the consistency between the initial disposal measures and the disposal measures; updating the parameters of the risk evolution model to be trained with the goal of minimizing the evolutionary loss and maximizing the rule loss, until the second training termination condition is met, thus obtaining the trained risk evolution model.

[0188] In one implementation, the function of the risk evolution model is realized through a preset evolution equation. The evolution equation consists of risk characteristic terms and multiple influencing factor terms. The influencing factor terms include instantaneous risk intensity and drift term. Instantaneous risk intensity represents the sum of risk intensity of risk scenarios triggered by the account to be judged at the target time, and drift term represents the behavioral evolution trend of the account to be judged.

[0189] When the methods of the above embodiments are implemented in hardware, this embodiment of the invention provides a possible structural schematic diagram of the electronic device involved in the above embodiments. For example... Figure 6 As shown, the electronic device 600 includes: a processor 602, a communication interface 603, and a bus 604. Optionally, the electronic device 600 may also include a memory 601.

[0190] Processor 602 may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 602 may be a central processing unit, a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It may implement or execute various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of this application. Processor 602 may also be a combination that implements computing functions, such as including one or more microprocessor combinations, a combination of a DSP and a microprocessor, etc.

[0191] Communication interface 603 is used to connect with other devices via a communication network. This communication network can be Ethernet, wireless access network, wireless local area network (WLAN), etc.

[0192] The memory 601 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto.

[0193] In one possible implementation, the memory 601 can exist independently of the processor 602. The memory 601 can be connected to the processor 602 via a bus 604 and is used to store instructions or program code. When the processor 602 calls and executes the instructions or program code stored in the memory 601, it can implement the method provided in the embodiments of the present invention.

[0194] In another possible implementation, the memory 601 can also be integrated with the processor 602.

[0195] Bus 604 can be an Extended Industry Standard Architecture (EISA) bus, etc. Bus 604 can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The symbol is represented by only one line, but this does not mean that there is only one bus or one type of bus.

[0196] Through the above description of the implementation methods, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the service calling device can be divided into different functional modules to complete all or part of the functions described above.

[0197] This application also provides a computer-readable storage medium. All or part of the processes in the above method embodiments can be executed by computer instructions instructing related hardware. The program can be stored in the aforementioned computer-readable storage medium, and when executed, it can include the processes of the above method embodiments. The computer-readable storage medium can be any of the foregoing embodiments or memory. The aforementioned computer-readable storage medium can also be an external storage device of the aforementioned device, such as a plug-in hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the aforementioned device. Further, the aforementioned computer-readable storage medium can include both internal storage units of the aforementioned service call device and external storage devices. The aforementioned computer-readable storage medium is used to store the aforementioned computer program and other programs and data required by the aforementioned device. The aforementioned computer-readable storage medium can also be used to temporarily store data that has been output or will be output.

[0198] This application also provides a computer program product comprising a computer program that, when run on a computer, causes the computer to perform the methods provided in the above embodiments.

[0199] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A model training method, characterized in that, The method includes: Obtain a first training sample set, which contains multiple sample behavior state data; the sample behavior state data includes sample basic features and sample risk scenario features, the sample basic features are used to characterize the basic attributes and behavioral information of the sample account, and the sample risk scenario features are used to characterize risk scenario information; The basic features of the current sample are input into the behavioral modality encoder of the feature extraction model to be trained to obtain behavioral modality features, and the risk scenario features of the current sample are input into the risk scenario modality encoder of the feature extraction model to be trained to obtain risk scenario modality features; the dimension of the behavioral modality features is lower than that of the basic features of the sample, and the dimension of the risk scenario modality features is lower than that of the risk scenario features of the sample. A bimodal alignment loss is constructed based on the behavioral modal features and the risk scenario modal features, wherein the bimodal alignment loss characterizes the semantic consistency between the behavioral modal features and the risk scenario modal features; Risk features are constructed based on the behavioral modal features and the risk scenario modal features, and sparse loss is determined based on the risk features; the sparse loss is used to characterize the sum of feature values ​​of each dimension in the risk features; The risk features are reconstructed using a decoder to obtain reconstructed behavioral state data, and the reconstruction loss is determined based on the deviation between the reconstructed behavioral state data and the sample behavioral state data. With the goal of minimizing the bimodal alignment loss, the reconstruction loss, and the sparsity loss, the feature extraction model to be trained is updated until the first training termination condition is met, thus obtaining a trained feature extraction model.

2. The method according to claim 1, characterized in that, The construction of the bimodal alignment loss based on the behavioral modal features and the risk scenario modal features includes: The behavioral modality features or the risk scenario modality features are dimensionally aligned to obtain behavioral modality features and risk scenario modality features with the same dimensions; The bimodal alignment loss is determined based on the cosine similarity between behavioral modal features and risk scenario modal features of the same dimension.

3. A risk assessment method, characterized in that, The method includes: Obtain behavioral status data of the account to be judged; the behavioral status data includes basic characteristics and risk scenario characteristics. The behavioral state data is input into a trained feature extraction model to obtain risk features; the feature extraction model is obtained based on the model training method described in any one of claims 1-2. The risk characteristics are input into the trained risk evolution model to obtain the behavioral risk potential; Based on the behavioral risk potential, corresponding handling measures are determined, and the corresponding handling measures are implemented on the account to be judged.

4. The method according to claim 3, characterized in that, The determination and execution of corresponding remedial measures based on the behavioral risk potential includes: Determine decision information; the decision information includes the behavioral risk potential, the confidence level of the behavioral risk potential, and the severity of the risk scenario currently triggered by the account to be judged; Based on the decision information, target matrix units are determined from a preset decision matrix; the decision matrix is ​​a three-dimensional matrix, and each matrix unit in the decision matrix corresponds to a risk level and a corresponding response measure; The corresponding handling measures of the target matrix unit are executed on the account to be judged.

5. The method according to claim 3, characterized in that, After implementing the corresponding handling measures on the account to be judged, the method further includes: Based on the behavioral status data, the behavioral risk potential, and the handling measures, a risk profile for the account to be assessed is generated; Generate an index for the risk profile; the index includes the identity identifier, current timestamp, and random code of the account to be assessed; The risk profile is stored in the risk database, and the index is added to the directory of the risk database.

6. The method according to claim 3, characterized in that, The risk evolution model is obtained in the following way: Obtain a second training sample set; the second training sample set includes sample risk characteristics, sample behavioral risk potential, and sample handling measures. The sample risk characteristics of the current sample are input into the risk evolution model to be trained to obtain the initial behavioral risk potential, and the initial treatment measures corresponding to the initial behavioral risk potential are determined. An evolutionary loss is constructed based on the initial behavioral risk potential and the sample behavioral risk potential; the evolutionary loss characterizes the degree of difference between the initial behavioral risk potential and the sample behavioral risk potential. Based on the initial treatment measures and the treatment measures, a rule loss is constructed; the rule loss characterizes the consistency between the initial treatment measures and the treatment measures. With the goal of minimizing the evolutionary loss and the rule loss, the parameters of the risk evolution model to be trained are updated until the second training termination condition is met, thus obtaining the trained risk evolution model.

7. The method according to claim 6, characterized in that, The function of the risk evolution model is realized through a preset evolution equation, which consists of risk characteristic terms and multiple influencing factor terms. The influencing factor terms include instantaneous risk intensity and drift term. The instantaneous risk intensity represents the sum of risk intensity of the risk scenarios triggered by the account to be judged at the target time, and the drift term represents the behavioral evolution trend of the account to be judged.

8. An electronic device, characterized in that, It includes a processor and a memory, the processor being coupled to the memory; the memory is used to store computer instructions, which are loaded and executed by the processor to enable the computer device to perform the method as described in any one of claims 1 to 2 or 3-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes computer-executable instructions that, when executed on a computer, cause the computer to perform the method of any one of claims 1 to 2 or 3-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when run on an electronic device, causes the electronic device to perform the method as described in any one of claims 1 to 2 or 3-7.

Images