Money laundering behavior detection method, device, and medium in flow chart

Abstract

The present invention proposes a method, device and medium for detecting money laundering behavior in a flow graph, wherein the method comprises obtaining fund transaction information in a money laundering scenario as graph data and representing it through a directed graph; when each fund flow arrives, judging whether the source account reaches a fund balance state after transferring out funds, and whether the target account reaches a fund balance state after transferring in funds; and respectively counting the number of times the source account and the target account reach a fund balance state at the current moment and the number of effective fund transfers accumulated from the initial moment to the current moment when the fund balance state is reached, and inputting them into an abnormal account evaluation model as statistical features for abnormal evaluation. The method can quickly and accurately detect money laundering behaviors of different modes and find suspicious money laundering accounts.

Description

Technical Field

[0001] The present invention relates to the field of anomaly detection technology, and in particular to a method, device and medium for detecting money laundering behavior in a streaming graph suitable for a streaming scenario. Background Art

[0002] Money laundering refers to the act of concealing the source of funds through improper activities. It is a fast process of frequent, chained transactions. Usually, fraudsters will use multiple intermediate accounts to pool funds and mix them with legitimate transactions, and make the amount of the mixed transactions just below the detection threshold, so the detection of money laundering becomes very difficult. In real-time transactions, how to design an effective detection method that can quickly and accurately detect such suspicious accounts and behavior patterns is the key point to consider when detecting money laundering.

[0003] In order to introduce more attributes and process high-dimensional data, traditional money laundering behavior detection methods in streaming graphs use machine learning methods such as SVM, decision trees, and neural networks. However, these methods perform detection in a supervised or semi-supervised manner. In real scenarios, the annotations of money laundering accounts are often scarce, so they are affected by data category imbalance and lack universality.

[0004] Given a stream of edges arriving over time, the SedanSpot algorithm measures edge anomalies based on previous degree, priority connections, and interacting neighbors. The Spotlight algorithm can detect many unexpected edges that appear suddenly. The Midas algorithm treats cluster anomalies or similar edges that arrive suddenly as anomalies. However, these streaming methods do not consider the characteristics of money laundering accounts and are therefore not suitable for detecting money laundering accounts. The FlowScope algorithm and the AutoAudit algorithm have been proposed to detect money laundering flows in multi-partite graphs, but these methods cannot handle streaming edges and cannot capture a variety of different money laundering behaviors well.

[0005] Therefore, most of the existing money laundering detection algorithms are designed for static transaction data and cannot be applied to streaming scenarios. The anomaly detection algorithm based on dynamic graphs does not consider the characteristics of money laundering behavior, resulting in low detection accuracy. Summary of the invention

[0006] In view of the deficiencies in the prior art, the present invention proposes a method, device, and medium for detecting money laundering behavior in a streaming graph of a streaming scenario. The present invention can quickly and accurately detect money laundering behaviors of different modes and find suspicious money laundering accounts.

[0007] In order to achieve the above object, the present invention provides a method for detecting money laundering behavior in a flow chart, comprising:

[0008] Directed graph representation step: Obtain the fund transaction information in the money laundering scenario as graph data to define a directed graph, with each node representing an account and each edge representing a fund flow formed by transferring funds from a source account to a target account;

[0009] Fund balance status judgment step: when each fund flow arrives, judge whether the source account reaches a fund balance state after transferring out funds, and whether the target account reaches a fund balance state after transferring in funds; the fund balance state is that the accumulated amount of funds transferred into the account exceeds a preset threshold, and all the funds transferred into the account are transferred out;

[0010] Abnormal account evaluation step: respectively counting the number of times the source account and the target account reach a fund balance state at the current moment, and the number of times the source account and the target account have effectively transferred funds from the initial moment to the most recent time they reached a fund balance state at the current moment;

[0011] The number of fund balance states and the number of effective fund transfers are input as statistical features into the abnormal account assessment model for anomaly assessment. The effective fund transfer refers to the cumulative amount of funds transferred into the account after the previous fund balance state exceeding the preset threshold, and all cumulative transferred funds are eventually transferred out before the next fund balance state is reached.

[0012] Optionally, the fund balance status determination step further includes:

[0013] Determine whether the source account has reached a capital balance state through the account balance of the source account;

[0014] Whether the target account has reached a capital balance state is determined by the account balance of the target account.

[0015] Optionally, judging whether the source account has reached a capital balance state according to the account balance of the source account includes:

[0016] After the funds of the source account are transferred out, if the account balance of the source account at the current moment is close to the minimum account balance of the source account at the previous moment, the source account reaches a fund balance state at the current moment;

[0017] The determining whether the source account has reached a capital balance state by the account balance of the source account includes:

[0018] After the funds are transferred into the target account, if the account balance of the target account at the current moment is greater than the minimum account balance of the target account at the previous moment and is greater than the minimum threshold for a valid funds transfer, the target account reaches a funds balance state at the current moment.

[0019] Optionally, the fund balance status determination step further includes:

[0020] Determine the account balance of the source account according to the difference between the weighted in-degree and the out-degree of the source account at the current moment;

[0021] The account balance of the target account is determined according to the difference between the weighted in-degree and the weighted out-degree of the target account at the current moment.

[0022] Optionally, the fund balance status determination step further includes:

[0023] Updating the minimum account balance of the source account according to the account balance of the source account;

[0024] The maximum account balance of the target account is updated according to the account balance of the target account.

[0025] Optionally, updating the minimum account balance of the source account according to the account balance of the source account includes:

[0026] After the funds of the source account are transferred out, if the source account reaches a fund balance state at the current moment or the account balance of the source account is close to the minimum account balance at the previous moment, the minimum account balance of the source account at the current moment is updated to the account balance of the source account at the current moment;

[0027] The updating of the maximum account balance of the target account according to the account balance of the target account includes:

[0028] After the funds are transferred into the target account, if the target account reaches a fund balance state at the current moment or the account balance of the target account is greater than the maximum account balance at the previous moment, the maximum account balance of the target account at the current moment is updated to the account balance of the target account at the current moment.

[0029] Optionally, the abnormal account evaluation step further includes:

[0030] Constructing the abnormal account evaluation model includes:

[0031] Constructing an objective function: constructing a first objective function according to the number of times the source account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment;

[0032] Constructing a second objective function according to the number of times the target account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment;

[0033] Construct constraint conditions: Determine the decision boundary according to the decision boundary calculation formula;

[0034] Substituting the decision boundary into the first objective function or the second objective function to obtain an abnormal boundary;

[0035] Determining the constraint condition according to the decision boundary and the abnormal boundary;

[0036] Determine abnormal accounts: Determine accounts that meet the constraint conditions as abnormal accounts.

[0037] Optionally, the first objective function is expressed as:

[0038]

[0039] Among them, the number of times the source account reaches the capital balance state at the current time t is B u (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F u (t);

[0040] The second objective function is expressed as:

[0041]

[0042] Among them, the number of times the target account reaches a balance state at the current time t is B v (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F v (t);

[0043] According to the decision boundary calculation formula Q3+K*IQR, where IQR=Q3-Q1, Q1 and Q3 are the lower quartile and upper quartile respectively, K=1.5, the decision boundaries b1 and f1 are calculated respectively;

[0044] Remove F' u =f1, or F' v =f1, The data is respectively used to obtain the abnormal boundaries b2 and f2 by using the PARETO function;

[0045] According to the decision boundary and the abnormal boundary, the constraint conditions are determined, including:

[0046] The first constraint condition: or

[0047] The second constraint condition: or

[0048] The third constraint condition: 0 ≤ F' u < f2 or 0 ≤ F' v < f2;

[0049] Call the PARETO function to calculate the first abnormal account point that satisfies the first constraint condition and the third abnormal account point that satisfies the third constraint condition;

[0050] Calculate the second abnormal account point that satisfies the second constraint condition;

[0051] The abnormal accounts are determined by taking the union of the first abnormal account point, the second abnormal account point, and the third abnormal account point.

[0052] On the other hand, the present invention also provides a money laundering detection device, including:

[0053] A directed graph representation module: defines a directed graph by using the fund transaction information in the money laundering scenario as graph data, where each node represents an account and each edge represents a fund flow formed by a fund transferred from a source account to a target account;

[0054] A fund balance state judgment module: when each fund flow arrives, judges whether the source account reaches the fund balance state after transferring funds and whether the target account reaches the fund balance state after receiving funds; the fund balance state means that the cumulative amount of funds transferred into the account exceeds a preset threshold and all the funds in the transferred-in account are transferred out;

[0055] An abnormal account evaluation module: respectively counts the number of times the source account and the target account reach the fund balance state at the current moment, and the cumulative number of valid funds transferred into the source account and the target account from the initial moment to the most recent time they reach the fund balance state;

[0056] The number of fund balance states and the number of effective fund transfers are input as statistical features into the abnormal account assessment model for anomaly assessment. The effective fund transfer refers to the cumulative amount of funds transferred into the account after the previous fund balance state exceeding the preset threshold, and all cumulative transferred funds are eventually transferred out before the next fund balance state is reached.

[0057] Another aspect of the present invention provides a storage medium for storing a computer program for executing the money laundering behavior detection method in the above-mentioned flow chart.

[0058] On the other hand, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the money laundering behavior detection method in the above-mentioned flow chart when executing the computer program.

[0059] It can be seen from the above scheme that the advantages of the present invention are:

[0060] The money laundering behavior detection method in the flow graph provided by the present invention is for the money laundering transaction flow intermediate agent detection of the flow graph, by obtaining the fund transaction information in the money laundering scene as the graph data through a directed graph representation; when each of the fund flows arrives, it is judged whether the source account reaches a fund balance state after transferring out funds, and whether the target account reaches a fund balance state after transferring in funds; the number of times the source account and the target account reach a fund balance state at the current moment and the number of effective fund transfers accumulated from the initial moment to the current moment t when the fund balance state is reached are respectively counted, and the statistical features are input into the abnormal account evaluation model to detect the money laundering account. The method can quickly and accurately detect money laundering behaviors of different modes and find suspicious money laundering accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is the system architecture diagram of the anti-money laundering intelligent monitoring and analysis platform;

[0062] Figure 2 A schematic diagram of a flow chart of a method for detecting money laundering behavior in a flow chart provided by an embodiment of the present invention;

[0063] Figure 3 To show all account statistics B + and thermal profiles of F';

[0064] Figure 4 It is a framework diagram of the money laundering detection device of the present invention;

[0065] Figure 5 It is a schematic diagram of the structure of a computer device;

[0066] Figure 6 A schematic diagram of the hardware structure of an electronic device;

[0067] in:

[0068] 100- Monitoring and analysis cloud platform;

[0069] 101- alarm management module;

[0070] 102-Suspicious transaction monitoring module;

[0071] 103- spectrum analysis module;

[0072] 104-model management module;

[0073] 105-rule engine module;

[0074] 106-backtracking analysis module;

[0075] 107-feature analysis module;

[0076] 108-Customer identity recognition module;

[0077] 109-Customer rating module;

[0078] 1010-Case Management Module;

[0079] 1011-data management module;

[0080] 400-Money laundering detection device;

[0081] 401-directed graph representation module;

[0082] 402-fund balance status judgment module;

[0083] 403-Abnormal account evaluation module;

[0084] 500-electronic equipment;

[0085] 501 - processor;

[0086] 502- memory;

[0087] 600-Electronic equipment;

[0088] 601- radio frequency unit;

[0089] 602-network module;

[0090] 603- audio output unit;

[0091] 604-input unit;

[0092] 641-graphics processor;

[0093] 642-Microphone;

[0094] 605-Sensor;

[0095] 606-display unit;

[0096] 6061-display panel;

[0097] 607-user input unit;

[0098] 6071-touch panel;

[0099] 6072-Other input devices;

[0100] 608-interface unit;

[0101] 609-Memory;

[0102] 610 - Processor. DETAILED DESCRIPTION

[0103] In order to make the above features and effects of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings.

[0104] The anti-money laundering intelligent monitoring and analysis platform is based on the three self-developed engines of "graph computing, AI model, and rule model". The system architecture is as follows: Figure 1As shown, it mainly includes monitoring and analysis cloud platform 100, alarm management module 101, suspicious transaction monitoring module 102, graph analysis module 103, model management module 104, rule engine module 105, retrospective analysis module 106, feature analysis module 107, customer identity recognition module 108, customer rating module 109, case management module 1010, data management module 1011 and other modules. Among them, the alarm management module 101 is connected with the suspicious transaction monitoring module 102, and an alarm prompt is issued when suspicious transactions are monitored in real time; the graph analysis module 103, the model management module 104, and the rule engine module 105 are connected with the alarm management module 101 and the feature analysis module 107 at the same time, and after the monitored transaction data undergoes graph analysis, model management, feature analysis, rule engine analysis and other processes, suspicious transaction information is determined for alarm management; at the same time, the retrospective analysis module 106, feature analysis module 107, customer identity recognition module 108, customer rating module 109, case management module 1010, data management module 1011 and other modules are provided to retrospectively analyze abnormal transactions, customer risk rating, etc., and the transaction detection information is uploaded to the remote cloud platform synchronously. The system can help financial institutions realize dynamic profiling and risk classification of customers throughout the life cycle, penetrating monitoring of suspicious transaction events, knowledge accumulation of money laundering behavior characteristics, and advance prediction of money laundering risks, and comprehensively upgrade money laundering risk management capabilities. The platform comprehensively utilizes the advantages of machine learning in feature discovery and pattern learning, as well as the advantages of knowledge graphs in association mining and knowledge computing. Driven by massive data, it integrates anti-money laundering expert rules to form an automated intelligent anti-money laundering application that is explainable, self-learning, and capable of active warning.

[0105] As mentioned above, most of the existing money laundering detection algorithms are designed for static transaction data and are not suitable for streaming scenarios. The anomaly detection algorithm based on dynamic graphs does not take into account the characteristics of money laundering behavior, so the detection accuracy is low. In view of this, the embodiment of the present invention provides a method for detecting money laundering behavior in streaming graphs that can quickly and accurately detect different modes of money laundering behavior and find suspicious money laundering accounts based on the above-mentioned anti-money laundering intelligent monitoring and analysis platform. This embodiment focuses on Figure 1 The graph analysis module 103, model management module 104, rule engine module 105, feature analysis module 107 and other modules.

[0106] Specifically, refer to Figure 2 As shown, Figure 2 A flow chart of a method for detecting money laundering behavior in a flow chart provided in an embodiment of the present invention is shown.

[0107] A method for detecting money laundering behavior in a flow graph, comprising:

[0108] S1. Directed graph representation step: Obtain the fund transaction information in the money laundering scenario as graph data and represent it through a directed graph. Define that each node of the directed graph represents an account, and each edge represents a fund flow. After the funds are transferred from the source account, they are transferred to the target account to form a fund flow. The directed graph is defined as G = (V, E, W, T), and E = {e1, e2, ...} represents the fund flow of the edge, and V represents the node set of the account; for each fund flow, a tuple e = (u, v, w u,v ,t) indicates that node u represents the source account, node v represents the target account, and weight w u,v ∈W∈Z + and the time t∈T at which this edge is added to the graph G.

[0109] S2. Fund balance status judgment step: when each fund flow arrives, judge whether the source account reaches a fund balance state after transferring out funds, and whether the target account reaches a fund balance state after transferring in funds; the fund balance state is that all the funds in the transferred-in account are transferred out.

[0110] In this embodiment, B u (t) represents the number of times the source account u reaches the balance state at the current time t, using B v (t) represents the number of times the target account v reaches a balance state at the current time t; f u (t) represents the number of valid transfers that have occurred to the source account u at the current time t since the last balance state, and is represented by F u (t) represents the cumulative number of valid transfers from the initial time to the current time t when the funds are most recently balanced; f v (t) represents the number of effective transfers to the target account v at the current time t since the last equilibrium state, and F v (t) represents the cumulative number of valid transfers from the initial time to the most recent time when the funds are in a balanced state at the current time t. The initialization process of the target account is the same as that of the source account, and this embodiment will not be repeated.

[0111] In the specific implementation, when the source account or target account appears for the first time, the source account or target account is initialized. Taking the source account as an example, the source account is initialized, that is, the account balance R of the source account is u (t) = 0, the number of times the source account reaches a balance state B u (t) = 0, the number of valid transfers that have occurred in the source account since the last balance state at the current time f u (t) = 0, and the source account status Maximum account balance of the source Minimum account balance of the source

[0112] Then, the account balance of the source account and the account balance of the target account are updated, that is:

[0113] The account balance R of the source account at the current time t u (t) is expressed as:

[0114]

[0115] Among them, the weighted in-degree of the source account at the current time t is The out-degree is w v,u 、w u,v Represents the weight value;

[0116] The account balance R of the target account at the current time t v (t) is expressed as:

[0117]

[0118] Among them, the weighted in-degree of the target account at the current time t is The out-degree is w v,u 、w u,v Indicates the weight value.

[0119] Update the account balance R of the source account according to the above formulas (1) and (2): u (t) The account balance R of the target account v (t).

[0120] In addition, this embodiment specifically tracks whether the source account and the target account have reached a capital balance state through the source account state quantity and the target account state quantity, specifically:

[0121] according to:

[0122]

[0123]

[0124] Among them, the residual amount ∈>0;

[0125] For the source account, the state of the source account at the current time t The source account status at the previous time t-1 The account balance at the current time t is R u (t), the maximum account balance at the previous time t-1 The minimum account balance at the previous time t-1 δ down Indicates the minimum threshold for a fund transfer to achieve a fund balance state. After the source account funds are transferred out, the account balance R of the source account at the current time t u (t) The minimum account balance of the source account at the time close to the previous time t-1 In the case of , the source account reaches a fund balance state at the current time t.

[0126] For the target account, the target account status at the current time t The target account status at the previous moment t-1 The account balance at the current time t is R v (t), the minimum account balance at the previous time t-1 δ up Represents the minimum threshold for a valid transfer. After the funds in the target account are transferred, the account balance R of the target account at the current time t v (t) The minimum account balance of the target account at the previous time t-1 Greater than the minimum threshold δ for a valid transfer up In the case of , the target account reaches a capital balance state at the current time t.

[0127] In this embodiment, the account balance R of the source account is updated by the above formulas (1) and (2). u (t) The account balance R of the target account v (t), according to formulas (3) and (4), track whether the source account and the target account have reached a balance state, and update the source account status Target account status

[0128] In addition, according to the source account status Target account status And the account balance R of the source account u (t) The account balance R of the target account v (t), respectively update the minimum account balance of the source account and the maximum account balance of the target account, specifically:

[0129] according to:

[0130]

[0131] After the funds in the source account are transferred out, the source account reaches a balance state at the current time t or the account balance R of the source account u (t) is close to the minimum account balance at the previous time t-1 In the case of Update to the account balance R of the source account at the current moment u (t);

[0132] according to:

[0133]

[0134] After the funds in the target account are transferred, the target account reaches a fund balance state or the account balance R of the target account at the current time t v (t) is greater than the maximum account balance at the previous time t-1 In the case of Update to the current account balance R of the target account v (t).

[0135] S3, abnormal account evaluation step: respectively count the number of times the source account and the target account reach a fund balance state at the current time t and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was most recently reached, and input them into the abnormal account evaluation model as statistical features, and the abnormal account evaluation model is used to output the money laundering account; the effective fund transfer refers to the cumulative amount of funds transferred into the account after the previous fund balance state exceeds the preset threshold, and all the accumulated transferred funds are eventually transferred out before the next fund balance state is reached.

[0136] In the specific implementation, after judging the fund balance status of the source account and the target account at each moment, the number of times the source account reaches the fund balance state at the current moment t is counted. u (t) and the cumulative number of effective fund transfers F from the source account from the initial time to the most recent time when the fund balance was reached at the current time t u (t); and the number of times the target account reaches a balance state B v (t) and the cumulative number of effective fund transfers F between the target account from the initial time to the current time t when the fund balance was most recently reached v (t), specifically:

[0137] For the source account, according to:

[0138]

[0139] Determine the number of times the source account reaches a balance state at the current time t B u (t);

[0140] according to:

[0141]

[0142] Determine the cumulative number of effective fund transfers F of the source account from the initial time to the current time t when the fund balance state was reached u (t).

[0143] Among them, f u (t) represents the number of effective fund transfers from the previous fund balance state to the current time t of the source account, that is:

[0144]

[0145] in, and Indicates a situation in which funds are balanced.

[0146] For the target account, according to:

[0147]

[0148] Determine the number of times the target account reaches a balance state at the current time t B v (t);

[0149] according to:

[0150]

[0151] Determine the cumulative number of effective fund transfers F between the target account from the initial time to the current time t when the fund balance state was most recently reached v (t).

[0152] Among them, f v (t) represents the number of effective fund transfers into the target account from the last fund balance state to the current time t, that is:

[0153]

[0154] in, and Indicates a situation in which funds are balanced.

[0155] In this embodiment, the number of times the source account reaches a fund balance state at the current time t is counted B u(t) and the cumulative number of effective fund transfers F from the source account from the initial time to the most recent time when the fund balance was reached at the current time t u (t); and the number of times the target account reaches a balance state B v (t) and the cumulative number of effective fund transfers F between the target account from the initial time to the current time t when the fund balance was most recently reached v (t) is used as a statistical feature to input into the abnormal account evaluation model to evaluate the money laundering account. In some embodiments, the local statistical features within the window size can be calculated by using a sliding time window. In addition, the number of times the opponent's account reaches balance can also be counted to discover the transaction chain in money laundering.

[0156] Specifically, in this embodiment, a sliding time window is used to calculate the local statistical characteristics within the window size, and the number of times the source account reaches the capital balance state at the current time t is B. u (t), and the cumulative number of effective fund transfers F from the initial time to the most recent time when the fund balance was reached at the current time t u (t), construct the first objective function According to the number of times the target account reaches a balance state at the current time t, B v (t), and the cumulative number of effective fund transfers F from the initial time to the most recent time when the fund balance was reached at the current time t v (t), construct the second objective function

[0157] Figure 3 Shows all account statistics B + and F' heat map. The generalized Pareto distribution (GPD) is a 3-parameter distribution used to find extreme events in extreme value theory. The second theorem in extreme value theory states that given a random variable X, let m∈R and define a new random variable X m Used to represent the tail data exceeding m in X; define F m The distribution of Xm under the condition of X>m; then when the threshold is equal to m, the cumulative distribution function (CDF) of the excess part is F m (x) = P(Xm≤x|X>m). Figure 3 As shown, B + The distributions of and F' are highly skewed, so the theory can be used to find abnormal accounts. AnoScore returns the accounts that fall in Part I, II, III, and IV of the figure as a set of abnormal accounts, i.e., money laundering accounts.

[0158] In this embodiment, the PARETO function is used to construct an abnormal account evaluation model to find abnormal accounts. The PARETO function uses the tail data exceeding the threshold m, that is, after sorting the data, the data located at the tail 1 - α (α is usually set to 98%) is taken out for fitting the parameters of the Pareto distribution; then the minimum value x that satisfies P(X - m > x|X > m) = 1 - F m (x) < p is output. Here, the parameter p has the same effect as the P-value in hypothesis testing for the null hypothesis (that is, all data points are normal). Therefore, in this embodiment, F′ u 、 F' v the probability threshold p of the Pareto distribution and the percentile α are used as inputs and input into the abnormal account evaluation model constructed by the PARETO function, and then the money laundering accounts can be returned as outputs.

[0159] First, according to the decision boundary calculation formula Q3 + K * IQR respectively, where IQR = Q3 - Q1, Q1 and Q3 are the lower quartile and the upper quartile respectively, and K = 1.5, the decision boundaries b1 and f1 are calculated respectively;

[0160] Take out the data where F' u = f1, or F' v = f1, and use the PARETO function to obtain the abnormal boundaries b2 and f2 respectively.

[0161] Then, for Figure 3 the PARTI part in: or The abnormal points are obtained by calling the PARETO function for each column of data to get the first abnormal account points;

[0162] For Figure 3 the PARTII and PARTIV parts in: and or and For the data points, since the data in the Part II part is too sparse to find abnormal points using the Pareto distribution, the data points of and or and are directly returned as the second abnormal account points;

[0163] For Figure 3 the PARTIII part in: 0 ≤ F' u < f2 or 0 ≤ F' v<f2, By calling the PARETO function for the data of each row, abnormal points are obtained, and the third abnormal account points are obtained.

[0164] Finally, the union of the first abnormal account points, the second abnormal account points, and the third abnormal account points is taken to obtain an abnormal account, that is, a money laundering account.

[0165] In summary, the money laundering behavior detection method in the flow graph provided by the present invention is for the detection of intermediate agents in the money laundering transaction flow of the flow graph. By obtaining the fund transaction information in the money laundering scenario as graph data represented by a directed graph, it is defined that each node in the directed graph represents an account, and each edge represents a fund flow; after the fund is transferred out of the source account, it is transferred to the target account, forming a fund flow; when each fund flow arrives, it is judged whether the source account reaches the fund balance state after transferring out the funds, and whether the target account reaches the fund balance state after transferring in the funds; respectively count the number of times the source account and the target account reach the fund balance state at the current moment t and the cumulative number of effective fund transfers between the last time reaching the fund balance state from the initial moment to the current moment t, and input them as statistical features into the abnormal account evaluation model to detect money laundering accounts. This method constructs a linear relationship between the time complexity and the number of edges in the flow based on statistical features, can quickly query the detection results at any time, and can effectively detect different suspicious behavior patterns and periodic behaviors, with good scalability. Through the present invention, different patterns of money laundering behaviors can be quickly and accurately detected, and suspicious money laundering accounts can be found.

[0166] The above embodiments of the present invention can be applied to terminal devices with the function of the money laundering behavior detection method in the flow graph of the transaction flow. The terminal device can include personal terminals, host computer terminals, etc., and the embodiments of the present invention do not limit this. The terminal can support operating systems such as Windows, Android, IOS, WindowsPhone, etc.

[0167] Refer to Figure 4 , Figure 4 shows a money laundering detection device 400, which is applied to the money laundering behavior detection method in the flow graph of the transaction flow and can be applied to personal terminals and host computer terminal devices. It can be realized through the money laundering behavior detection method shown in Figure 2 The setting device provided by the embodiments of the present application can realize each process implemented by the above money laundering behavior detection method in the flow graph, at least including a directed graph representation module 401, a fund balance state judgment module 402, and an abnormal account evaluation module 403, specifically:

[0168] A money laundering detection device 400 includes:

[0169] Directed graph representation module 401: Obtaining fund transaction information in the money laundering scenario as graph data to define a directed graph, wherein each node represents an account, and each edge represents a fund flow formed by funds being transferred from a source account to a target account;

[0170] Fund balance status judgment module 402: when each fund flow arrives, judge whether the source account reaches a fund balance status after transferring out funds, and whether the target account reaches a fund balance status after transferring in funds; the fund balance status is that the accumulated amount of funds transferred into the account exceeds a preset threshold, and all the funds transferred into the account are transferred out;

[0171] Abnormal account evaluation module 403: respectively counting the number of times the source account and the target account reach a fund balance state at the current moment, and the number of times the source account and the target account have effectively transferred funds from the initial moment to the most recent time they reached a fund balance state at the current moment;

[0172] The number of fund balance states and the number of effective fund transfers are input as statistical features into the abnormal account assessment model for anomaly assessment. The effective fund transfer refers to the cumulative amount of funds transferred into the account after the previous fund balance state exceeding the preset threshold, and all cumulative transferred funds are eventually transferred out before the next fund balance state is reached.

[0173] Optionally, the fund balance status judgment module is further used to:

[0174] Determine whether the source account has reached a capital balance state through the account balance of the source account;

[0175] Whether the target account has reached a capital balance state is determined by the account balance of the target account.

[0176] Optionally, judging whether the source account has reached a capital balance state according to the account balance of the source account includes:

[0177] After the funds of the source account are transferred out, if the account balance of the source account at the current moment is close to the minimum account balance of the source account at the previous moment, the source account reaches a fund balance state at the current moment;

[0178] The determining whether the source account has reached a capital balance state by the account balance of the source account includes:

[0179] After the funds are transferred into the target account, if the account balance of the target account at the current moment is greater than the minimum account balance of the target account at the previous moment and is greater than the minimum threshold for a valid funds transfer, the target account reaches a funds balance state at the current moment.

[0180] Optionally, the fund balance status judgment module is further used to:

[0181] Determine the account balance of the source account according to the difference between the weighted in-degree and the out-degree of the source account at the current moment;

[0182] The account balance of the target account is determined according to the difference between the weighted in-degree and the weighted out-degree of the target account at the current moment.

[0183] Optionally, the fund balance status judgment module is further used to:

[0184] Updating the minimum account balance of the source account according to the account balance of the source account;

[0185] The maximum account balance of the target account is updated according to the account balance of the target account.

[0186] Optionally, updating the minimum account balance of the source account according to the account balance of the source account includes:

[0187] After the funds of the source account are transferred out, if the source account reaches a fund balance state at the current moment or the account balance of the source account is close to the minimum account balance at the previous moment, the minimum account balance of the source account at the current moment is updated to the account balance of the source account at the current moment;

[0188] The updating of the maximum account balance of the target account according to the account balance of the target account includes:

[0189] After the funds are transferred into the target account, if the target account reaches a fund balance state at the current moment or the account balance of the target account is greater than the maximum account balance at the previous moment, the maximum account balance of the target account at the current moment is updated to the account balance of the target account at the current moment.

[0190] Optionally, the abnormal account assessment module is further used to:

[0191] Constructing the abnormal account evaluation model includes:

[0192] Constructing an objective function: constructing a first objective function according to the number of times the source account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment;

[0193] Constructing a second objective function according to the number of times the target account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment;

[0194] Construct constraint conditions: Determine the decision boundary according to the decision boundary calculation formula;

[0195] Substituting the decision boundary into the first objective function or the second objective function to obtain an abnormal boundary;

[0196] Determining the constraint condition according to the decision boundary and the abnormal boundary;

[0197] Determine abnormal accounts: Determine accounts that meet the constraint conditions as abnormal accounts.

[0198] Optionally, the first objective function is expressed as:

[0199]

[0200] Among them, the number of times the source account reaches the capital balance state at the current time t is B u (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F u (t);

[0201] The second objective function is expressed as:

[0202]

[0203] Among them, the number of times the target account reaches a balance state at the current time t is B v (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F v (t);

[0204] According to the decision boundary calculation formula Q3+K*IQR, where IQR=Q3-Q1, Q1 and Q3 are the lower quartile and upper quartile respectively, K=1.5, the decision boundaries b1 and f1 are calculated respectively;

[0205] Remove F' u =f1, or F' v =f1, The data is respectively used to obtain the abnormal boundaries b2 and f2 by using the PARETO function;

[0206] According to the decision boundary and the abnormal boundary, the constraint conditions are determined, including:

[0207] The first constraint condition: Or

[0208] The second constraint condition: Or

[0209] The third constraint condition: 0 ≤ F' u < f2 or 0 ≤ F' v < f2;

[0210] Call the PARETO function to calculate the first abnormal account point that satisfies the first constraint condition and the third abnormal account point that satisfies the third constraint condition;

[0211] Calculate the second abnormal account point that satisfies the second constraint condition;

[0212] The abnormal accounts are determined by taking the union of the first abnormal account point, the second abnormal account point, and the third abnormal account point.

[0213] Therefore, for the intermediate agent detection of money laundering transaction flows in the streaming graph by the money laundering detection device 400 according to the embodiments of the present application, by obtaining the fund transaction information in the money laundering scenario as graph data represented by a directed graph; when each of the fund flows arrives, it is determined whether the source account reaches the fund balance state after transferring funds, and whether the target account reaches the fund balance state after receiving funds; the number of times the source account and the target account reach the fund balance state at the current moment and the cumulative number of effective fund transfers between the last time reaching the fund balance state from the initial moment to the current moment are respectively counted and used as statistical features to be input into the abnormal account evaluation model to detect money laundering accounts. This method can quickly and accurately detect different patterns of money laundering behaviors and find suspicious money laundering accounts.

[0214] It should be understood that the descriptions of the money laundering behavior detection method in the above streaming graph are equally applicable to the money laundering detection device 400 according to the embodiments of the present application. To avoid repetition, they will not be described in detail.

[0215] In addition, it should be understood that in the money laundering detection device 400 according to the embodiment of the present application, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the security printing device can be divided into functional modules different from the modules illustrated above to complete all or part of the functions described above.

[0216] Figure 5 It is a schematic diagram of the structure of a computer device provided in an embodiment of the present application.

[0217] like Figure 5 As shown in, an embodiment of the present application also provides a computer device 500, including a processor 502, a storage medium 501, and a program or instruction stored on the storage medium 501 and executable on the processor 502. When the program or instruction is executed by the processor 502, the steps of the money laundering behavior detection method in the above-mentioned flow chart are implemented, and the same technical effect can be achieved.

[0218] Therefore, according to the computer device 500 of the embodiment of the present application, the money laundering transaction flow intermediate agent detection based on the flow graph can quickly and accurately detect different patterns of money laundering behaviors and find suspicious money laundering accounts.

[0219] To avoid repetition, other technical effects of the computer device 500 according to the embodiment of the present application will not be described in detail here.

[0220] It should be noted that the electronic devices in the embodiments of the present application may include mobile electronic devices and non-mobile electronic devices.

[0221] Figure 6 It is a schematic diagram of the specific hardware structure of the electronic device provided in the embodiment of the present application.

[0222] Reference Figure 6 The electronic device 600 includes but is not limited to: a radio frequency unit 601, a network module 602, an audio output unit 603, an input unit 604, a sensor 605, a display unit 606, a user input unit 607, an interface unit 608, a memory 609, and a processor 610 and other components.

[0223] It should be understood that in the embodiment of the present application, the radio frequency unit 601 can be used for receiving and sending signals during information transmission or calls. Specifically, after receiving downlink data from the base station, it is sent to the processor 610 for processing; in addition, uplink data is sent to the base station. Generally, the radio frequency unit 601 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier, a duplexer, etc. In addition, the radio frequency unit 601 can also communicate with the network and other devices through a wireless communication system.

[0224] The electronic device 600 provides the user with wireless broadband Internet access through the network module 602, such as helping the user to send and receive emails, browse web pages, and access streaming media.

[0225] The audio output unit 603 can convert the audio data received by the RF unit 601 or the network module 602 or stored in the memory 609 into an audio signal and output it as sound. Moreover, the audio output unit 603 can also provide audio output related to a specific function performed by the electronic device 600 (for example, a call signal reception sound, a message reception sound, etc.). The audio output unit 603 includes a speaker, a buzzer, a receiver, etc.

[0226] The input unit 604 is used to receive audio or video signals. It should be understood that in the embodiment of the present application, the input unit 604 may include a graphics processing unit (GPU) 641 and a microphone 642, and the graphics processor 641 processes the image data of a static picture or video obtained by an image capture device (such as a camera) in a video capture mode or an image capture mode.

[0227] The electronic device 600 also includes at least one sensor 605, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor, wherein the ambient light sensor can adjust the brightness of the display panel 6061 according to the brightness of the ambient light, and the proximity sensor can turn off the display panel 6061 and / or the backlight when the electronic device 600 is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in each direction (generally three axes), and can detect the magnitude and direction of gravity when stationary, which can be used to identify the posture of the electronic device (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; the sensor 605 can also include a fingerprint sensor, a pressure sensor, an iris sensor, a molecular sensor, a gyroscope, a barometer, a hygrometer, a thermometer, an infrared sensor, etc., which will not be repeated here.

[0228] The display unit 606 is used to display information input by the user or information provided to the user. The display unit 606 may include a display panel 6061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0229] The user input unit 607 can be used to receive input digital or character information, and to generate key signal input related to user settings and function control of the electronic device. Specifically, the user input unit 607 includes a touch panel 6071 and other input devices 6072. The touch panel 6071, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using any suitable object or accessory such as a finger, stylus, etc. on the touch panel 6071 or near the touch panel 6071). The touch panel 6071 may include two parts: a touch detection device and a touch controller. Other input devices 6072 may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here. The interface unit 608 is an interface for connecting an external device to the electronic device 600. For example, the external device may include a wired or wireless headset port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device having an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, etc. The interface unit 608 may be used to receive input (e.g., data information, power, etc.) from an external device and transmit the received input to one or more elements within the electronic device 600 or may be used to transmit data between the electronic device 600 and an external device.

[0230] The memory 609 can be used to store software programs and various data. The memory 609 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 609 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0231] The processor 610 is the control center of the electronic device. It uses various interfaces and lines to connect various parts of the entire electronic device. By running or executing software programs and / or modules stored in the memory 609 and calling data stored in the memory 609, it executes various functions of the electronic device and processes data, thereby monitoring the electronic device as a whole. The processor 610 may include one or more processing units; preferably, the processor 610 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 610. It is understandable to those skilled in the art that the electronic device 600 may also include a power supply (such as a battery) to power various components, and the power supply may be logically connected to the processor 610 through a power management system, so that the power management system can realize functions such as management of charging, discharging, and power consumption management. Figure 6 The electronic device structure shown in the figure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently, which will not be repeated here. In the embodiments of the present application, the electronic device includes but is not limited to mobile phones, tablet computers, laptop computers, PDAs, vehicle-mounted terminals, wearable devices (such as bracelets, glasses), and pedometers.

[0232] Specifically, the processor 610 obtains the fund transaction information in the money laundering scenario as graph data through a directed graph, and defines that each node of the directed graph represents an account, and each edge represents a fund flow; after the funds are transferred out of the source account, they are transferred to the target account to form a fund flow; when each of the fund flows arrives, it is determined whether the source account reaches a fund balance state after transferring out the funds, and whether the target account reaches a fund balance state after transferring in the funds; the number of times the source account and the target account reach a fund balance state at the current time t and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state is most recently reached are counted, and are input into the abnormal account evaluation model as statistical features, and the abnormal account evaluation model is used to output the money laundering account.

[0233] Therefore, according to the electronic device 600 of the embodiment of the present application, by using the money laundering transaction flow intermediate agent detection for the flow graph, different modes of money laundering behavior can be detected quickly and accurately, and suspicious money laundering accounts can be found.

[0234] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the money laundering behavior detection method in the above-mentioned flow chart are implemented and the same technical effect can be achieved.

[0235] Therefore, according to the readable storage medium of the embodiment of the present application, the money laundering transaction flow intermediate agent detection based on the flow graph can quickly and accurately detect different modes of money laundering behavior and find suspicious money laundering accounts.

[0236] To avoid repetition, other technical effects of the readable storage medium according to the embodiments of the present application are not described here.

[0237] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as a computer read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0238] An embodiment of the present application also provides a chip, which includes a processor and a communication interface. The communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the steps of the money laundering behavior detection method in the above flow chart and achieve the same technical effect.

[0239] Therefore, according to the chip of the embodiment of the present application, using the money laundering transaction flow intermediate agent detection for the flow graph, it is possible to quickly and accurately detect different patterns of money laundering behavior and find suspicious money laundering accounts.

[0240] To avoid repetition, other technical effects of the chip according to the embodiments of the present application are not described here.

[0241] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0242] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be applied, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0243] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0244] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for detecting money laundering behavior in a flow chart, characterized in that: include: Directed graph representation step: Obtain the fund transaction information in the money laundering scenario as graph data to define a directed graph, with each node representing an account and each edge representing a fund flow formed by transferring funds from a source account to a target account; A fund balance state judgment step: when each fund flow arrives, judging whether the source account has reached a fund balance state after transferring out funds by using the account balance of the source account, including: after the source account transfers out funds, if the account balance of the source account at the current moment is close to the minimum account balance of the source account at the previous moment, the source account has reached a fund balance state at the current moment; Determining whether the target account reaches a capital balance state after the funds are transferred in by the account balance of the target account, comprising: after the funds of the target account are transferred in, if the account balance of the target account at the current moment is greater than the minimum account balance of the target account at the previous moment and is greater than the minimum threshold value for a valid capital transfer, the target account reaches a capital balance state at the current moment; The fund balance state is that the cumulative amount of funds transferred into the account exceeds the preset threshold, and all the funds transferred into the account have been transferred out; Abnormal account evaluation step: respectively counting the number of times the source account and the target account reach a fund balance state at the current moment, and the number of times the source account and the target account have effectively transferred funds from the initial moment to the most recent time they reached a fund balance state at the current moment; The number of fund balance states and the number of effective fund transfers are input as statistical features into the abnormal account assessment model for abnormal assessment; wherein, the effective fund transfer means that the cumulative amount of funds transferred into the account after the previous fund balance state exceeds the preset threshold, and all the accumulated transferred funds are eventually transferred out before the next fund balance state is reached; The construction method of the abnormal account evaluation model includes: Constructing an objective function: constructing a first objective function according to the number of times the source account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment; Constructing a second objective function according to the number of times the target account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment; Construct constraint conditions: Determine the decision boundary according to the decision boundary calculation formula; Substituting the decision boundary into the first objective function or the second objective function to obtain an abnormal boundary; Determining the constraint condition according to the decision boundary and the abnormal boundary; Determine abnormal accounts: determine accounts that meet the constraint conditions as abnormal accounts; Wherein, the first objective function is expressed as: Among them, the number of times the source account reaches the capital balance state at the current time t is B u (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F u (t); The second objective function is expressed as: Among them, the number of times the target account reaches a balance state at the current time t is B v (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F v (t); According to the decision boundary calculation formula Q3+K*IQR, where IQR=Q3-Q1, Q1 and Q3 are the lower quartile and upper quartile respectively, K=1.5, the decision boundaries b1 and f1 are calculated respectively; Remove F' u =f1, or F' v =f1, The data are respectively processed using PARETO function to obtain the abnormal boundaries b2 and f2; Determining the constraint condition according to the decision boundary and the abnormal boundary includes: The first constraint is: or Second constraint: or Third constraint condition: 0 ≤ F' u <f2 or 0 ≤ F' v <f2; Calling the PARETO function to calculate a first abnormal account point satisfying the first constraint condition and a third abnormal account point satisfying the third constraint condition; Calculating a second abnormal account point that satisfies the second constraint condition; The abnormal account is determined by taking the union of the first abnormal account point, the second abnormal account point, and the third abnormal account point.

2. The method according to claim 1, characterized in that The fund balance status determination step further comprises: Determine the account balance of the source account according to the difference between the weighted in-degree and the out-degree of the source account at the current moment; The account balance of the target account is determined according to the difference between the weighted in-degree and the weighted out-degree of the target account at the current moment.

3. The method according to claim 2, characterized in that The fund balance status determination step further comprises: Updating the minimum account balance of the source account according to the account balance of the source account; The maximum account balance of the target account is updated according to the account balance of the target account.

4. The method according to claim 3, characterized in that The updating of the minimum account balance of the source account according to the account balance of the source account includes: After the funds of the source account are transferred out, if the source account reaches a fund balance state at the current moment or the account balance of the source account is close to the minimum account balance at the previous moment, the minimum account balance of the source account at the current moment is updated to the account balance of the source account at the current moment; The updating of the maximum account balance of the target account according to the account balance of the target account includes: After the funds are transferred into the target account, if the target account reaches a fund balance state at the current moment or the account balance of the target account is greater than the maximum account balance at the previous moment, the maximum account balance of the target account at the current moment is updated to the account balance of the target account at the current moment.

5. A money laundering detection device, characterized in that: include: Directed graph representation module: used to obtain the fund transaction information in the money laundering scenario as graph data to define a directed graph, with each node representing an account and each edge representing a fund flow formed by transferring funds from a source account to a target account; A fund balance state judgment module: used to judge whether the source account has reached a fund balance state after transferring out funds by using the account balance of the source account when each fund flow arrives, including: after the source account transfers out funds, if the account balance of the source account at the current moment is close to the minimum account balance of the source account at the previous moment, the source account has reached a fund balance state at the current moment; Determining whether the target account reaches a capital balance state after the funds are transferred in by the account balance of the target account, comprising: after the funds of the target account are transferred in, if the account balance of the target account at the current moment is greater than the minimum account balance of the target account at the previous moment and is greater than the minimum threshold value for a valid capital transfer, the target account reaches a capital balance state at the current moment; The fund balance state is that the cumulative amount of funds transferred into the account exceeds the preset threshold, and all the funds transferred into the account have been transferred out; Abnormal account evaluation module: used to count the number of times the source account and the target account reach a fund balance state at the current moment, and the number of times the source account and the target account have effectively transferred funds from the initial moment to the most recent time they reached a fund balance state at the current moment; The number of fund balance states and the number of effective fund transfers are input as statistical features into an abnormal account assessment model for abnormal assessment, wherein the effective fund transfer means that the cumulative amount of funds transferred into the account after the previous fund balance state exceeds a preset threshold, and all the cumulative transferred funds are eventually transferred out before the next fund balance state is reached; wherein the construction method of the abnormal account assessment model includes: Constructing an objective function: constructing a first objective function according to the number of times the source account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment; Constructing a second objective function according to the number of times the target account reaches a capital balance state at the current moment and the number of effective capital transfers accumulated from the initial moment to the most recent time when the capital balance state is reached at the current moment; Construct constraint conditions: Determine the decision boundary according to the decision boundary calculation formula; Substituting the decision boundary into the first objective function or the second objective function to obtain an abnormal boundary; Determining the constraint condition according to the decision boundary and the abnormal boundary; Determine abnormal accounts: determine accounts that meet the constraint conditions as abnormal accounts; Wherein, the first objective function is expressed as: Among them, the number of times the source account reaches the capital balance state at the current time t is B u (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F u (t); The second objective function is expressed as: Among them, the number of times the target account reaches a balance state at the current time t is B v (t), and the cumulative number of effective fund transfers from the initial time to the current time t when the fund balance state was reached is F v (t); According to the decision boundary calculation formula Q3+K*IQR, where IQR=Q3-Q1, Q1 and Q3 are the lower quartile and upper quartile respectively, K=1.5, the decision boundaries b1 and f1 are calculated respectively; Remove F' u =f1, or F' v =f1, The data are respectively processed using PARETO function to obtain the abnormal boundaries b2 and f2; Determining the constraint condition according to the decision boundary and the abnormal boundary includes: The first constraint is: or Second constraint: or Third constraint condition: 0 ≤ F' u <f2 or 0 ≤ F' v <f2; Calling the PARETO function to calculate a first abnormal account point satisfying the first constraint condition and a third abnormal account point satisfying the third constraint condition; Calculating a second abnormal account point that satisfies the second constraint condition; The abnormal account is determined by taking the union of the first abnormal account point, the second abnormal account point, and the third abnormal account point.

6. A storage medium, characterized in that: Used to store a computer program for executing the money laundering behavior detection method in the flow chart of any one of claims 1 to 4.

Images