A rule constraint sample generation and small sample identification model training method, system and device for long-tail financial fraud

Abstract

The application relates to the technical field of artificial intelligence, and discloses a rule constraint sample generation and small sample identification model training method, system and device for long-tail financial fraud, which has the technical scheme of obtaining sample data, removing duplicates to obtain various financial fraud types and type definition records; determining a target fraud type and a candidate sample generation quantity; reading preset model configuration items, type definition records and financial business rule records, extracting target constraint items and constructing a sample generation constraint package; calling a financial big model, taking the sample generation constraint package as a constraint, generating a fraud behavior template, and instantiating candidate generated samples; checking the candidate generated samples, calculating sample quality scores, and taking candidate generated samples that meet preset quality acceptance conditions as generated enhanced samples; determining the training weights of the generated enhanced samples according to the sample quality scores, and using the generated enhanced samples and confirmed real samples to jointly train a small sample identification model.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence, financial risk control, synthetic data, and few-shot machine learning. More specifically, it relates to a method, system, and apparatus for generating rule-constrained samples and training a few-shot identification model for long-tail financial fraud. Background Technology

[0002] Financial fraud types typically exhibit a long-tail distribution. Common fraud types accumulate a large number of historical cases, while new fraud types often have only a small number of confirmed cases in the early stages. Because supervised learning models rely on sufficient and representative labeled samples, long-tail types are prone to problems such as unstable identification boundaries, insufficient recall, and long deployment cycles.

[0003] Existing random copying, oversampling, or interpolation methods typically only modify some values ​​based on existing samples, making it difficult to generate new event sequences, account relationships, and device usage paths. When using generative adversarial networks, diffusion models, or general table generation models, if only the statistical distribution of fields is learned, samples that do not conform to financial business processes may be generated, such as loans being disbursed before applications are submitted, transfer amounts exceeding available balances, and the same device appearing in different regions at an impossible time.

[0004] Large-scale financial models can understand fraud type descriptions, business procedures, and historical cases. However, when directly asking these models to generate fraud samples, the output may be free text, or inconsistencies may arise in the entity identifiers, event times, amounts, and device relationships after different data sequences are generated separately. Simply performing format checks after generation cannot confirm whether the samples conform to business rules, possess sufficient type characteristics, or excessively resemble real cases.

[0005] On the other hand, existing few-shot learning methods typically assume that the quality of training samples is similar. If unverified or poorly quality generated samples are trained with equal weights to real samples, the generated noise will alter the type representation and classification boundary. Therefore, it is necessary to establish a continuous data chain from business rule constraint generation and candidate sample verification to training weight determination, so that the generated samples can be safely used by the few-shot recognition model. Summary of the Invention

[0006] This invention provides a method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud, comprising the following steps: S101. In response to the training instruction, obtain sample data of financial fraud, perform deduplication and sorting, and obtain confirmed real samples, various types of financial fraud and corresponding type definition records. S102. Based on the type definition records and preset configuration parameters corresponding to each type of financial fraud, determine the target fraud type and the number of corresponding candidate samples generated. S103. Read the preset model configuration items, the type definition record of the target fraud type, and the associated financial business rule record, extract the target constraint items, and construct the sample generation constraint package; S104. Call the financial big model, use the sample generation constraint package as a constraint to generate a fraud behavior template, and instantiate candidate generation samples based on the fraud behavior template. S105. Verify the multiple candidate generated samples, calculate the sample quality score for the candidate generated samples that pass the verification, and use the candidate generated samples that meet the preset quality acceptance conditions as the generated enhancement samples. S106. Determine the training weights for generating enhanced samples based on the sample quality scores, and use the generated enhanced samples and the confirmed real samples to jointly train the small sample recognition model.

[0007] As a preferred technical solution of the present invention, the sample data of financial fraud includes: a directory of fraud type labels, case records with mature fraud conclusions, behavioral data associated with case records, and records of financial business rules; Case records with proven fraud conclusions include at least one of the following: manual review conclusions, payment refusal results, case investigation results, or post-loan verification results; The type definition record includes: type identifier, type name, parent type identifier, type definition, applicable business scenario, necessary behavioral elements, prohibited behavioral elements, time constraint summary, amount constraint summary, subject relationship constraint summary, association rule identifier, number of confirmed real samples, number of necessary behavioral elements covered, and most recent confirmation time.

[0008] As a preferred technical solution of the present invention, the deduplication and sorting includes: querying case records for each financial fraud type according to each financial type label directory, deduplicating and desensitizing the case records to form confirmed real samples, and establishing financial fraud type definition records for each financial fraud type. The case records are deduplicated, including: merging duplicate records based on the unique case number; when the unique case number is missing, forming a case fingerprint based on the anonymized entity identifier, account identifier, transaction identifier, and event time, and merging duplicate records based on the case fingerprint.

[0009] As a preferred embodiment of the present invention, in S102, determining the target fraud type includes: The sample scarcity is calculated based on the number of confirmed real sample data in the type definition record and the preset number of head reference samples. Calculate the behavioral element coverage gap based on the number of necessary behavioral elements in the type definition record and the number of necessary behavioral elements that have been covered; The long-tail demand score is obtained by weighting the sample scarcity and the coverage gap of behavioral elements. Financial fraud types that reach the preset target selection threshold in terms of long-tail demand scores are selected as target fraud types.

[0010] As a preferred technical solution of the present invention, the number of candidate samples generated is determined based on the preset number of enhanced target samples, the number of confirmed real samples of the target fraud type, and the historical verification pass rate; when there is no historical verification record for the target fraud type, the historical verification pass rate of the parent type or the preset default pass rate is used.

[0011] As a preferred technical solution of the present invention, in S105, the verification includes hard business rule gating and cross-sequence consistency verification. Hard business rule gating includes at least two checks from the following: necessary events, prohibited events, event sequence, account status, monetary relationships, cross-sequence reference integrity, and privacy distance. Successful verification conditions include all hard business rules passing, no dangling or conflicting cross-sequence references, and the sample quality score not being lower than the quality acceptance threshold; When a candidate generated sample fails to meet the verification success conditions, the fields to be repaired and the dependent events are determined based on the field and event dependencies involved in the failure constraints. The fields that have passed the verification remain unchanged, the fields to be repaired and the dependent events are regenerated, and the verification is performed again.

[0012] As a preferred technical solution of the present invention, the sample quality score is obtained by weighting the consistency of time and relationship, the coverage of necessary behavioral elements and the sample difference; the training weight for generating enhanced samples is determined by the sample quality score and the historical quality calibration coefficient of the target fraud type, and the training weight of the confirmed real sample is greater than or equal to the training weight for generating enhanced samples. The small sample identification model calculates the quality-weighted type representation corresponding to the financial fraud type based on the sample representation of the confirmed real sample and the weighted sample representation of the generated enhanced sample, and outputs the fraud type identification result based on the distance between the sample representation of the sample to be identified and each quality-weighted type representation.

[0013] As a preferred embodiment of the present invention, it also includes an adaptation step for adding new types of financial fraud: For newly added financial fraud types, based on the financial fraud type definition record and financial business rule record of the newly added financial fraud type, generate and verify the enhanced sample of the newly added type; Freeze the base encoder of the small sample recognition model, and update the quality-weighted type representation or type recognition prompt parameters of the new financial fraud type based on a small number of confirmed real samples of the new financial fraud type, the enhanced samples generated by the new type, and the parent type recognition prompt parameters.

[0014] A system for generating rule-constrained samples and training a few-shot identification model for long-tail financial fraud includes: The basic data processing module is used to respond to training instructions, acquire sample data of financial fraud, perform deduplication and processing, and obtain confirmed real samples, various types of financial fraud and corresponding type definition records. The target type selection module is used to determine the target fraud type and the number of corresponding candidate samples generated based on the type definition records corresponding to each type of financial fraud. The constraint generation module is used to read preset model configuration items, target fraud type type definition records, and associated financial business rule records, extract target constraint items, and build sample constraint generation packages. The candidate sample generation module is used to call the large financial model, use the sample generation constraint package as a constraint, generate fraud behavior templates, and instantiate candidate generated samples based on the fraud behavior templates. The sample verification and repair module is used to verify the candidate generated samples, calculate the sample quality score of the candidate generated samples that pass the verification, and use the candidate generated samples that meet the preset quality acceptance conditions as the generated enhanced samples. The quality-weighted training module is used to determine the training weights for generating enhanced samples based on the sample quality scores, and to train the small sample recognition model together with the generated enhanced samples and the confirmed real samples.

[0015] A training device for a rule-constrained sample generation and small-sample identification model for long-tail financial fraud includes a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor implements the above-mentioned method when executing the computer program.

[0016] In summary, this invention offers the following advantages: By clearly defining type definitions and rule association identifiers, it reduces the untraceability issues caused by unclear business rule sources during the generation process. By generating multi-source samples through shared identifiers and a unified timeline, it reduces field conflicts between transactions, accounts, devices, and text. By using hard rule gating and quality scores to distinguish between "parseable" and "trainable" samples, it reduces the contamination of the model by unreasonable generated samples. By partially repairing failed samples and preserving the content of validated samples, it reduces duplicate generation and improves the interpretability of the repair process. By using quality-weighted training, it limits the impact of low-quality generated samples on type representation and classification boundaries, improving the stability of training long-tail types with few samples. By freezing the base encoder and updating the parameters of newly added types, it enables controlled adaptation of new fraud types without retraining the entire model. Attached Figure Description

[0017] Figure 1 This is the overall flowchart of the present invention; Figure 2 This is a schematic diagram illustrating the relationship between sample generation, verification, and local repair in this invention; Figure 3 This is a schematic diagram of the small sample recognition model training and new type adaptation of the present invention. Detailed Implementation

[0018] It is readily understood that, based on the technical solution of this invention, various embodiments of the invention can be conceived by those skilled in the art without altering the essential spirit of the invention. Therefore, the following detailed embodiments and accompanying drawings are merely illustrative examples of the technical solution of this invention and should not be considered as the entirety of the invention or as limitations or restrictions on the technical solution of this invention. Rather, these embodiments are provided to enable those skilled in the art to gain a more thorough understanding of the invention. Preferred embodiments of the invention are described below in conjunction with the accompanying drawings, which form part of this application and, together with the embodiments of the invention, serve to illustrate the innovative concept of the invention.

[0019] like Figure 1 As shown, this invention provides a method, system, and apparatus for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud. The overall scheme is as follows: First, obtain a directory of fraud type labels, case records with mature fraud conclusions, case-related behavioral data, and financial business rule records to form a unified financial fraud type definition record and confirmed real samples.

[0020] Based on the number of real samples of each type and the coverage of necessary behavioral elements, determine the target fraud types that need to be enhanced and the number of candidate samples to be generated.

[0021] For the target fraud type, applicable rules are read from the type definition record and risk control rule base, and de-identified case behavior skeletons are extracted from confirmed real samples to form a sample generation constraint package.

[0022] The financial big data model generates fraud behavior templates based on the constraint package, and then instantiates multi-source candidate samples such as transactions, accounts, devices and text based on shared subject identifiers, event identifiers and a unified timeline.

[0023] Candidate samples undergo rigorous checks based on hard business rules, cross-sequence consistency, type coverage, sample differences, and privacy distance. Samples meeting the acceptance criteria receive a sample quality score; samples failing to meet the criteria locate the failed fields and dependent events, and only the affected parts are regenerated and checked again.

[0024] Finally, the quality scores are converted into training weights and used to train a few sample recognition models together with a small number of real samples.

[0025] The following are the detailed steps of the method of the present invention: S101. Obtain and preprocess basic data, and establish a record of financial fraud type definitions.

[0026] Obtain sample data on financial fraud, deduplicate the sample data, and obtain various types of financial fraud and their corresponding type definitions. The sample data for financial fraud includes: a directory of fraud type tags, case records with mature fraud conclusions, behavioral data associated with the case records, and records of financial business rules.

[0027] The fraud type label directory is derived from the fraud label management system or case classification configuration table. Its main fields include: type identifier, type name, parent type identifier, and applicable scenario; used to establish type hierarchy and unique type identifier.

[0028] Case records with mature fraud conclusions include at least one of the following: manual review conclusion, payment refusal result, case investigation result, or post-loan verification result; originating from case management, manual review, payment refusal management, case investigation, or post-loan verification system; its main fields include: case number, conclusion type, conclusion time, and evidence status; used to determine whether the case is a confirmed genuine case.

[0029] The behavioral data associated with the case records comes from systems such as transactions, accounts, credit granting, login authentication, and device risk. Its main fields include: subject, account, event, time, amount, device, channel, and relationship fields; used to form confirmed real samples and statistically analyze the coverage of behavioral elements.

[0030] Financial business rules records originate from risk control rule bases, business system bases, or rule engines. Their main fields include: rule identifier, applicable type, judgment conditions, constraint results, version, and effective time; they are used to form generation constraints and for candidate sample verification.

[0031] The deduplication process for the sample data includes: querying case records for each type of financial fraud according to each financial type label directory, followed by subsequent actions: First, the case records are deduplicated, including: first, merging duplicate records based on the unique case number; when the unique case number is missing, forming a case fingerprint based on the anonymized entity identifier, account identifier, transaction identifier, and event time, and merging duplicate records based on the case fingerprint.

[0032] Next, the case records are anonymized, including deleting, hashing, or irreversibly mapping direct identifying fields such as the subject's name, ID number, account number, and precise address; The case is then confirmed, including: when at least one of the following—manual review conclusion, payment refusal result, case investigation result, or post-loan verification result—reaches a preset maturity status, and the conclusion time is no earlier than the preset observation period end time, the corresponding case is determined as a confirmed genuine case. The maturity status table is configured by the case system, such as "review confirmed fraud," "payment refusal liability determined," or "case investigation confirmed."

[0033] Establish a financial fraud type definition record for each type of financial fraud. The type definition record includes: type identifier, type name, parent type identifier, type definition, applicable business scenarios, necessary behavioral elements, prohibited behavioral elements, time constraint summary, amount constraint summary, subject relationship constraint summary, association rule identifier, number of confirmed real samples, covered behavioral elements, and most recent confirmation time. The parent-child type relationship can be pre-configured by business personnel and expanded according to new cases.

[0034] S102. Based on the type definition records corresponding to each type of financial fraud, determine the target fraud type and the corresponding number of candidate samples generated; specifically including: The inputs for this step are the financial fraud type definition record output by S101 and the confirmed real samples. Also included are the pre-set configuration parameters of this invention, including the number of header reference samples N. max Smoothing parameter ε, coverage weight α, selection threshold θtail, and number of augmented target samples N target,k The default value for historical pass rate is π0.

[0035] The process of determining the target fraud type is as follows: Based on the number of confirmed real sample data in the type definition record, and the preset number of header reference samples, calculate the sample scarcity I of the k-th fraud type. k : I k =log((N max +ε) / (N k +ε)) / log((N max +ε) / ε); Where, N k N represents the number of confirmed true samples in class k; max The number of head reference samples; ε is used in N k To maintain computational stability, a value of zero is typically set to 1. k The larger the value, the scarcer the sample of that type.

[0036] Calculate the necessary behavioral element coverage gap C based on the number of necessary behavioral elements in the type definition record and the number of covered necessary behavioral elements. k : C k =1-Mcovered,k / max(M required,k ,1); Among them, M required,k M defines the number of necessary behavioral elements in a record for a given type. covered,k This represents the number of necessary behavioral elements that have been covered by real samples. Whether a necessary behavioral element is covered can be determined by whether there is at least one real sample for that element that satisfies the field completeness condition.

[0037] The long-tail demand score L is obtained by weighting the sample scarcity and the coverage gap of the behavioral elements. k ; L k =α I k +(1-α) C k ; Here, α ranges from 0 to 1. The target type selection depends solely on the number of traceable samples and the necessary behavioral element coverage data.

[0038] When L k Not less than θ tail At that time, the kth type was identified as the target fraud type.

[0039] The number of candidate samples generated is determined based on the preset number of enhanced target samples, the number of confirmed real samples of the target fraud type, and the historical verification pass rate; when there is no historical verification record for the target fraud type, the historical verification pass rate of the parent type or the preset default pass rate is used.

[0040] Number of candidate samples generated B k Determined according to the following formula: B k =ceil(max(N target,k- N k ,0) / max(π pass,k ,π0)); Where, N target,k The number of augmented target samples specified in the model training configuration; π pass,k This is the ratio of the number of candidate samples that have passed the S105 check in the past to the total number of samples generated in the past; if there are no historical generation records for this type, the average pass rate of the parent type or the default value π0 is used.

[0041] S103. Read the preset model configuration items, the type definition record of the target fraud type, and the associated financial business rule record, extract the target constraint items, and construct the sample generation constraint package; where the model configuration items are the output field format of the model.

[0042] In S103, the target constraints include: target type definition, behavioral element definition, constraints formed by financial business rules records, de-identified case behavioral skeleton and output field format; the de-identified case behavioral skeleton is extracted from confirmed real samples; The sample generation constraint package includes parallel rule transformation processing and case skeleton extraction processing. The rule conversion process involves extracting at least two constraints from the financial business rule records, including preset target field values, necessary events, prohibited events, event sequence relationships, monetary relationships, account status changes, and subject relationships; each constraint retains the original rule identifier, version, and effective time. The case skeleton extraction process involves extracting at least two of the following from confirmed real samples: subject category, event category, event sequence, amount range, device relationship, and result label, while removing real customer identifiers. This skeleton is used to provide an observable behavioral structure for business operations and is not used to replicate the original transaction value.

[0043] Finally, the extracted target type definition, behavioral element definition, constraints extracted from financial business rules, desensitized case behavioral skeleton, and output field format are combined into a sample to generate constraint package P. k : P k ={T k ,F k ,R k E k ,S chema}; Among them, T k Define the target type; F k Define the behavioral elements; R k The set of applicable constraints extracted for financial business rules; E k The behavioral framework for desensitization cases; S chema The output field format for generating candidate samples.

[0044] Constraints can be categorized into hard constraints and soft constraints. Candidate samples that violate hard constraints are excluded from the training set; soft constraints are used to evaluate how closely a sample resembles a typical behavioral pattern. Finite state machines, time constraint graphs, or JSON field patterns can serve as specific representations of constraints.

[0045] S104. Call the financial big model, use the sample generation constraint package as a constraint to generate a fraud behavior template, and instantiate multi-source candidate generation samples according to the fraud behavior template. The process of forming a fraud template is as follows: P kThe type definitions, necessary events, prohibited events, constraints, and output field formats are sent to the financial big model. The structured output control module of the big model restricts the model to only return fields and enumeration values ​​specified in the schema, and rejects an output if it would cause a hard constraint to be unmet. The financial big model outputs a fraud behavior template, which only includes event categories, event dependencies, parameter value ranges, and behavioral elements to be instantiated, and does not include the real entity identifier and the real transaction value.

[0046] The structured output control module is located in the output control component of the inference service of the large financial model.

[0047] Instantiated candidate generated samples include: Based on the fraudulent behavior template, unique entity, account, event, and device identifiers are generated within the sample. A unified timeline and total amount range are first determined, then transaction sequences, account behavior sequences, device usage sequences, and text descriptions are generated. Each sequence references the same entity, account, event, and device through the same identifier; the text descriptions can only read the already generated structure fields and cannot modify the structural facts in reverse.

[0048] When it is necessary to express relationship-based fraud such as abnormal fund flow behavior of a group, subject relationship and fund relationship edges can be added to the candidate generated samples. However, the start point, end point, event time, and amount of the relationship edge must all reference the already generated identifiers and fields. The system repeatedly executes template generation or instantiation until B is obtained. k A number of candidate samples are generated, or the preset maximum number of calls is reached.

[0049] S105, such as Figure 2 As shown, the multi-source candidate generated samples are verified, the sample quality score is calculated for the candidate generated samples that pass the verification, and the candidate generated samples that meet the preset quality acceptance conditions are used as the generated enhancement samples. In the actual execution of this step, the preset configuration parameter, quality acceptance threshold θ, will also be used. Q Privacy distance threshold δ priv and maximum number of repairs R max , as input parameters.

[0050] In S105, the verification includes hard business rule gating and cross-sequence consistency verification; The hard business rule gating includes at least two checks from the following: necessary events, prohibited events, event sequence, account status, monetary relationships, cross-sequence reference integrity, and privacy distance. Successful verification conditions include all hard business rules passing, no dangling or conflicting cross-sequence references, and the sample quality score not being lower than the quality acceptance threshold; When the multi-source candidate generated sample fails to meet the verification success condition, the fields to be repaired and the dependent events are determined according to the field and event dependencies involved in the failure constraint. The fields that have passed are kept unchanged, the fields to be repaired and the dependent events are regenerated, and the verification is performed again.

[0051] Specifically, hard business rule gating is used to check whether necessary events exist, whether prohibited events are missing, whether the event order is correct, whether the account status is permissible, whether the monetary relationship is satisfied, whether cross-sequence citations are complete, and whether the distance between the candidate sample and any real case reaches the privacy threshold. If any hard condition is not met, the hard rule gating value G is reduced. rule It is 0.

[0052] For G rule For candidate samples with a value of 1, calculate the consistency V of time and relationship. cons Coverage of essential behavioral elements (V) cov And sample difference V div And calculate the sample quality score Q. i : Q i =G rule (ω cons V cons +ω cov V cov +ω div V div ); Where, ω cons ω cov and ω div All three have non-negative weights and their sum is 1; V div It can be obtained by subtracting the maximum similarity between the candidate sample and the real sample and the selected generated sample from 1. The role of this quality score is to determine whether the candidate sample can enter the augmentation set and to determine its training weight in S106.

[0053] The conditions for successful verification are uniformly defined as: G rule Equal to 1, all cross-sequence references can find the referenced object, and Q i The value must be no less than θQ. Candidate generated samples that meet the above conditions are marked as passing the verification.

[0054] For candidate samples that fail validation, the affected parts are determined based on the fields and event dependencies involved in the failure constraints, forming a list of fields to be retained, fields to be repaired, and dependent events. The system keeps the fields that have passed validation unchanged, only regenerating the fields to be repaired and their dependent events, and then executes S105 again. The number of repair attempts reaches R. maxIf the success condition is still not met, the candidate generated sample is discarded. Minimal unsatisfiable set search or weighted dependency graph search can be considered as preferred algorithms for determining the affected part.

[0055] S106, such as Figure 3 As shown, the training weights of the generated enhanced samples are determined based on the sample quality scores, and the generated enhanced samples and the confirmed real samples are used to jointly train the small sample recognition model.

[0056] The sample quality score is obtained by weighting the consistency of time and relationship, the coverage of necessary behavioral elements, and the sample difference. The training weight for generating enhanced samples is determined by the sample quality score and the historical quality calibration coefficient of the target fraud type. The training weight of the confirmed real samples is greater than or equal to the training weight for generating enhanced samples. The small sample recognition model calculates the quality-weighted type representation corresponding to the financial fraud type based on the sample representation of the confirmed real sample and the weighted sample representation of the generated enhanced sample, and outputs the fraud type recognition result based on the distance between the sample representation of the sample to be identified and each quality-weighted type representation.

[0057] Specifically, the data input for this step is: the confirmed real samples generated in S101, the generated augmented samples output in S105, and their quality scores. Configuration parameters, including the minimum training weights w, also need to be input. min Type quality calibration coefficient a cal,k And the structure of small sample recognition models.

[0058] First, the validated enhanced samples are deduplicated and grouped by source to prevent the same fraudulent template from being repeatedly included in the training set after only modifying irrelevant text. Then, the training weight w of the i-th enhanced sample is determined based on its sample quality score. i : w i =clip(Q i a cal,k ,w min ,1); Among them, a cal,k This is the calibration coefficient for the generated samples of class k in the historical real-world results validation; it can be set to 1 or the parent type coefficient can be used when there is no historical feedback. The training weight for real samples is fixed at 1.

[0059] In a preferred implementation, the encoder fθ encodes the transaction, account, device, text, and relational data of each sample into a unified representation, and calculates the quality-weighted type representation c of the k-th class based on the real samples and the generated augmented samples. k : c k =(Σx∈D real,kfθ(x)+Σx∈D aug,k w x fθ(x)) / (|D real,k |+Σx∈D aug,k w x ); Among them, D real,k Let D be the set of real samples of the kth class; aug,k Generate an enhanced set of samples for the k-th class. Low-quality generated samples have less impact on the type representation than high-quality generated samples and real samples.

[0060] For a sample x to be identified, the type probability can be calculated based on the distance between its representation and the representations of each type. In other embodiments, prototype networks, metric learning models, or other classifiers suitable for training with a small number of samples can also be used. A necessary limitation of this invention is that the quality scores of the generated samples are converted into training weights, and it is not limited to a specific small-sample model.

[0061] The training and validation sets are isolated according to the source of the cases and the time of the events; data derived from the same original case, the same behavior template, and the same random seed can only be located on one side of the training or validation set.

[0062] S107. For newly added financial fraud types, generate and verify enhanced samples for the newly added type based on the financial fraud type definition record and financial business rule record, as well as the identification prompt parameters of the parent type that is closest to the newly added type in the type hierarchy.

[0063] Freeze the base encoder of the small sample recognition model, and based on a small number of confirmed real samples of the newly added financial fraud type, the enhanced samples generated by the newly added type, and the parent type recognition prompt parameters, update the quality weighted type representation or type recognition prompt parameters of the newly added financial fraud type.

[0064] The parent type identification hint parameters are used only for initialization and are not used to generate the constraint package for samples. During the update process, the range of parameter changes and the number of iterations are limited to prevent a small number of samples from altering the recognition capability of existing types.

[0065] When the verification result of a newly added type does not meet the preset acceptance conditions, the identification result of that type is marked as an unknown type or transferred to manual review, instead of forcibly outputting a specific category.

[0066] Corresponding to the above method, the present invention also provides a system for training a rule-constrained sample generation and small-sample identification model for long-tail financial fraud, comprising: The basic data processing module is used to acquire sample data of financial fraud, deduplicate and organize the sample data to obtain various types of financial fraud and their corresponding type definition records. The target type selection module is used to determine the target fraud type and the number of corresponding candidate samples generated based on the type definition records corresponding to each type of financial fraud. The constraint generation module is used to read preset model configuration items, target fraud type type definition records, and associated financial business rule records, extract target constraint items, and build sample constraint generation packages. The candidate sample generation module is used to call the financial big model, use the sample generation constraint package as a constraint, generate a fraud behavior template, and instantiate multi-source candidate generated samples based on the fraud behavior template. The sample verification and repair module is used to verify the multi-source candidate generated samples, calculate the sample quality score of the candidate generated samples that pass the verification, and use the candidate generated samples that meet the preset quality acceptance conditions as the generated enhanced samples. The quality-weighted training module is used to determine the training weights of the generated enhanced samples based on the sample quality scores, and to train the small sample recognition model together with the generated enhanced samples and the confirmed real samples.

[0067] Corresponding to the above methods and systems, the present invention also provides a training device for a rule-constrained sample generation and small sample identification model for long-tail financial fraud, comprising: a processor and a memory, wherein the memory stores a computer program executable by the processor, and the processor implements the methods described in S101-S107 when executing the computer program.

[0068] The advantages of this invention are: The continuous construction of traceable type definition records and sample generation constraint packages: This invention does not directly input fraud type names or a small number of cases into a large model. Instead, it first establishes a unified financial fraud type definition record and links the target type with specific rule records in the risk control rule base through association rule identification. The constraint items formed by rule record transformation, the case behavior skeleton formed by real case extraction, and the preset output field format are combined into the same sample generation constraint package.

[0069] This design forms a complete data chain consisting of "source data, type definition records, target fraud types, and sample generation constraint packages." Each business constraint is traceable to the rule identifier and version, and the case skeleton is traceable to a confirmed real sample, but does not carry real customer identifiers. Compared to generation methods that only describe fraud types in natural language, this design clearly defines which events and fields the model can output, the range of field values, and the relationships between events, and allows the same constraint to be used for both generation and subsequent validation.

[0070] Multi-source sample generation with shared identifiers and local repair of failed parts: This invention first generates a fraudulent behavior template without real transaction values ​​from a large financial model, and then instantiates multi-source candidate samples using shared entity identifiers, account identifiers, event identifiers, device identifiers, and a unified timeline. Transaction sequences, account behavior sequences, device usage sequences, and text descriptions are not generated independently, but rather reference the same set of structural fields, maintaining consistency in the relationships between entity, time, amount, and device from the generation stage.

[0071] Candidate samples are first gating through hard business rules, and then consistency, coverage, and difference are calculated. When a validation fails, the system determines the affected parts based on the fields and event dependencies involved in the failure constraints, keeping the fields that have passed unchanged, and only regenerating the failed fields and dependent events. This mechanism avoids the repeated generation of the entire sample and also allows the reasons for failure, the scope of repair, and the results of re-validation to be recorded and audited.

[0072] Transferring the quality of generated samples to the training weights of smaller samples: This invention does not train all generated samples that pass the format check with real samples using equal weights. Instead, it calculates quality scores based on hard rule gating, cross-sequence consistency, coverage of necessary behavioral elements, and sample variability, and then combines these scores with type history quality calibration coefficients to form training weights. Samples with lower quality but still meeting the acceptance criteria have limited impact on model parameters and type representation, while the weight of real samples remains at 1.

[0073] When there are only a few real samples for a newly added fraud type, the same generation and verification chain can be used to form qualified generated samples, and the basic encoder can be frozen. Only the type representation and type recognition hint parameters of the newly added type are updated. In this way, "rule-constrained sample generation" and "small sample recognition adaptation" are connected into a data closed loop, instead of simply putting large model generation and small sample classification side by side.

[0074] The following is an embodiment scenario and initial data of the present invention: The bank labels this type as K-FACE-03 in its fraud labeling catalog, with the parent type being "identity theft," applicable to online consumer loan applications. Specific data is shown in Table 1 below: Table 1 ; The execution examples of S101-S103 are as follows: S101. Merge duplicate cases according to case number, and confirm that all 8 cases have reached the mature state through the case conclusion status table. The system establishes a K-FACE-03 type definition record, recording 12 necessary behavioral elements, 3 prohibited behaviors, 3 association rule identifiers, and 8 confirmed real samples.

[0075] S102, Take N max=100, ε=1, α=0.6. The sample scarcity I is approximately 0.524; the behavioral element coverage gap C = 1 - 7 / 12, approximately 0.417; the long-tail demand score L = 0.6 × 0.524 + 0.4 × 0.417, approximately 0.481. A threshold θ is selected. tail The value was set to 0.45, therefore K-FACE-03 was identified as the target fraud type.

[0076] The number of candidate samples generated is B = ceil((200-8) / 0.50) = 384. This value indicates that 384 candidate samples need to be generated, which is not the same as the number of behavior templates. A qualified behavior template can instantiate multiple candidate samples under different random seeds and allowed value ranges.

[0077] S103. Based on the association rule identifier in the K-FACE-03 type definition record, read three rule records and simultaneously extract the de-identified case behavior skeleton from eight real samples. Rule transformation and case skeleton extraction are performed in parallel. After completion, they are combined to form the P-FACE-03 sample generation constraint package, as shown in Table 2 below: Table 2 ; S104, Example of candidate generated sample: The financial big data model generates behavioral template BT-17 based on P-FACE-03. The template specifies the sequential generation of events: loan application, identity verification, device anomaly switching, approval, loan disbursement, and short-term fund transfer. It also stipulates allowed ranges for the amount and time, and does not record real customer information. The system instantiates candidate samples X-017 based on random seed 17021, as shown in Table 3 below: Table 3 ; Transaction sequences, account behavior sequences, and device usage sequences all reference S01, A01, D01, D02, and E01-E06; the text descriptions are generated from the established structure fields, and the loan disbursement time must not be changed to a time prior to the approval time.

[0078] S105, Example of verification and partial repair: Verification of X-017: All necessary events are complete, the approval time is earlier than the loan disbursement time, the initial transfer amount does not exceed the loan disbursement amount, all device and account references exist, and the privacy distance from any real case reaches the threshold. Therefore, G... rule =1. Let V cons =0.95, V cov =0.92, V div=0.88, with weights of 0.4, 0.35, and 0.25 respectively. Therefore, Q017 = 0.4 × 0.95 + 0.35 × 0.92 + 0.25 × 0.88 = 0.922. Quality acceptance threshold θ Q =0.80, X-017 passes the verification.

[0079] In another candidate sample X-031, the loan disbursement event time was earlier than the approval event time. The system marked the time sequence constraint as failed, affecting the approval time, loan disbursement time, and the text descriptions referencing both; the entity, account, device, amount, and other events remained unchanged. After the first partial fix, the approval time and loan disbursement time were regenerated and validated again, resulting in Q031=0.86, meeting the acceptance criteria.

[0080] Of the 384 candidate generated samples, the example execution results are as follows: 310 passed the hard business rule gating, 288 passed the cross-sequence reference check, and 240 reached the quality threshold; after near-duplication removal, 192 generated enhanced samples were retained, which, together with 8 real samples, formed 200 type training samples.

[0081] S106, S107: Examples of training and new type adaptation: Let the K-FACE-03 type quality calibration coefficient be a. cal =0.90, minimum training weight w min =0.20, then the training weight of X-017 is clip(0.922×0.90,0.20,1)=0.830. The weight of the real sample is 1. The system uses 8 real samples and 192 generated augmented samples to calculate the quality-weighted type representation and train the few-sample recognition model.

[0082] When a new type of fraud, "remote collaborative face-swapping fraud," is discovered, the system establishes a new type definition record and generates qualified enhanced samples according to S102-S105. The basic encoder remains frozen, initialized with the type recognition prompt parameters of K-FACE-03, and only updates the type representation and type recognition prompt parameters of the newly added type. If the time-isolated verification sample does not meet the acceptance criteria, the system outputs an unknown type marker and transfers the case to manual review.

[0083] In this invention, the large financial model can be a large language model deployed within a bank, or it can be another generative model that has been fine-tuned, enhanced for retrieval, or aligned for security purposes using financial corpora. The structured output control module can employ JSON field validation, syntax tree constraints, function call interfaces, or equivalent structured generation techniques.

[0084] Fraudulent behavior templates can be generated from a large model all at once, or an event graph can be generated first and then converted into a template; candidate generated samples can include at least two types of data from transactions, accounts, devices, and text. For fraud types that do not involve devices or text, the corresponding sequence can be omitted, but shared identifiers and business constraints are retained.

[0085] Sample quality assessment can use weighted summation, piecewise functions, rule-based scoring cards, or trained quality estimation models, as long as samples that fail hard business rules cannot enter the augmentation set as ordinary training samples, and the quality results are used to determine training weights.

[0086] Few-shot recognition models can employ quality-weighted prototype networks, metric learning, efficient parameter fine-tuning, or other few-shot classifiers.

[0087] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this invention should be included within the protection scope of this invention.

[0088] It should be understood that, in order to simplify the present invention and help those skilled in the art understand its various aspects, in the above description of exemplary embodiments of the present invention, various features of the present invention are sometimes described in a single embodiment or with reference to a single figure. However, the present invention should not be construed as implying that all features included in the exemplary embodiments are essential technical features of the claims of the present invention.

[0089] Those skilled in the art will understand that all or part of the processes of the methods described in the above embodiments can be implemented by a computer program instructing related hardware, and the program can be stored in a computer-readable storage medium. The computer-readable storage medium may be a disk, optical disk, read-only memory, or random access memory, etc.

[0090] It should be understood that the modules, units, components, etc., included in the device of one embodiment of the present invention can be adaptively changed to be placed in a device different from that embodiment. Different modules, units, or components included in the device of the embodiment can be combined into a single module, unit, or component, or they can be divided into multiple sub-modules, sub-units, or sub-components.

[0091] The modules, units, or components in the embodiments of the present invention can be implemented in hardware, in software running on one or more processors, or in a combination thereof. Those skilled in the art should understand that... In practice, microprocessors or digital signal processors (DSPs) can be used to implement embodiments of the invention. The invention can also be implemented on computer program products or computer-readable media for performing some or all of the methods described herein.

Claims

1. A method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud, characterized in that, Includes the following steps: S101. In response to the training instruction, obtain sample data of financial fraud, perform deduplication and sorting, and obtain confirmed real samples, various types of financial fraud and corresponding type definition records. S102. Based on the type definition records and preset configuration parameters corresponding to each type of financial fraud, determine the target fraud type and the number of corresponding candidate samples generated. S103. Read the preset model configuration items, the type definition record of the target fraud type, and the associated financial business rule record, extract the target constraint items, and construct the sample generation constraint package; S104. Call the financial big model, use the sample generation constraint package as a constraint to generate a fraud behavior template, and instantiate candidate generation samples based on the fraud behavior template. S105. Verify the multiple candidate generated samples, calculate the sample quality score for the candidate generated samples that pass the verification, and use the candidate generated samples that meet the preset quality acceptance conditions as the generated enhancement samples. S106. Determine the training weights for generating enhanced samples based on the sample quality scores, and use the generated enhanced samples and the confirmed real samples to jointly train the small sample recognition model.

2. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 1, characterized in that, The sample data for financial fraud includes: a directory of fraud type tags, case records with mature fraud conclusions, behavioral data associated with case records, and records of financial business rules; Case records with proven fraud conclusions include at least one of the following: manual review conclusions, payment refusal results, case investigation results, or post-loan verification results; The type definition record includes: type identifier, type name, parent type identifier, type definition, applicable business scenario, necessary behavioral elements, prohibited behavioral elements, time constraint summary, amount constraint summary, subject relationship constraint summary, association rule identifier, number of confirmed real samples, necessary behavioral elements covered, and most recent confirmation time.

3. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 1, characterized in that, The deduplication process includes: querying case records for each financial fraud type according to the category of each financial type label, deduplicating and de-identifying the case records to form a confirmed real sample, and establishing a financial fraud type definition record for each financial fraud type. The case records are deduplicated, including: merging duplicate records based on the unique case number; when the unique case number is missing, forming a case fingerprint based on the anonymized entity identifier, account identifier, transaction identifier, and event time, and merging duplicate records based on the case fingerprint.

4. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 1, characterized in that, In S102, the types of targeted fraud are identified as follows: The sample scarcity is calculated based on the number of confirmed real sample data in the type definition record and the preset number of head reference samples. Calculate the behavioral element coverage gap based on the number of necessary behavioral elements in the type definition record and the number of necessary behavioral elements that have been covered; The long-tail demand score is obtained by weighting the sample scarcity and the coverage gap of behavioral elements. Financial fraud types that reach the preset target selection threshold in terms of long-tail demand scores are selected as target fraud types.

5. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 1, characterized in that, The number of candidate samples generated is determined based on the preset number of enhanced target samples, the number of confirmed real samples of the target fraud type, and the historical verification pass rate; when there is no historical verification record for the target fraud type, the historical verification pass rate of the parent type or the preset default pass rate is used.

6. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 5, characterized in that, In S105, the verification includes hard business rule gating and cross-sequence consistency verification; Hard business rule gating includes at least two checks from the following: necessary events, prohibited events, event sequence, account status, monetary relationships, cross-sequence reference integrity, and privacy distance. Successful verification conditions include all hard business rules passing, no dangling or conflicting cross-sequence references, and the sample quality score not being lower than the quality acceptance threshold; When a candidate generated sample fails to meet the verification success conditions, the fields to be repaired and the dependent events are determined based on the field and event dependencies involved in the failure constraints. The fields that have passed the verification remain unchanged, the fields to be repaired and the dependent events are regenerated, and the verification is performed again.

7. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 1, characterized in that, The sample quality score is obtained by weighting the consistency of time and relationships, the coverage of necessary behavioral elements, and the sample variability. The training weights for generating augmented samples are jointly determined by the sample quality score and the historical quality calibration coefficient of the target fraud type. The training weights for confirmed real samples are greater than or equal to the training weights for generating augmented samples. The small sample identification model calculates the quality-weighted type representation corresponding to the financial fraud type based on the sample representation of the confirmed real sample and the weighted sample representation of the generated enhanced sample, and outputs the fraud type identification result based on the distance between the sample representation of the sample to be identified and each quality-weighted type representation.

8. The method for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud according to claim 1, characterized in that, This also includes adaptation steps for adding new types of financial fraud: For newly added financial fraud types, based on the financial fraud type definition record and financial business rule record of the newly added financial fraud type, generate and verify the enhanced sample of the newly added type; Freeze the base encoder of the small sample recognition model, and update the quality-weighted type representation or type recognition prompt parameters of the new financial fraud type based on a small number of confirmed real samples of the new financial fraud type, the enhanced samples generated by the new type, and the parent type recognition prompt parameters.

9. A system for generating rule-constrained samples and training a small-sample identification model for long-tail financial fraud, characterized in that, include: The basic data processing module is used to respond to training instructions, acquire sample data of financial fraud, perform deduplication and processing, and obtain confirmed real samples, various types of financial fraud and corresponding type definition records. The target type selection module is used to determine the target fraud type and the number of corresponding candidate samples generated based on the type definition records corresponding to each type of financial fraud. The constraint generation module is used to read preset model configuration items, target fraud type type definition records, and associated financial business rule records, extract target constraint items, and build sample constraint generation packages. The candidate sample generation module is used to call the large financial model, use the sample generation constraint package as a constraint, generate fraud behavior templates, and instantiate candidate generated samples based on the fraud behavior templates. The sample verification and repair module is used to verify the candidate generated samples, calculate the sample quality score of the candidate generated samples that pass the verification, and use the candidate generated samples that meet the preset quality acceptance conditions as the generated enhanced samples. The quality-weighted training module is used to determine the training weights for generating enhanced samples based on the sample quality scores, and to train the small sample recognition model together with the generated enhanced samples and the confirmed real samples.

10. A training device for a rule-constrained sample generation and small-sample identification model for long-tail financial fraud, characterized in that, include: A processor and a memory, the memory storing a computer program executable by the processor, wherein the processor, when executing the computer program, implements the method of any one of claims 1-8.

Images