Fund transaction flow trajectory analysis method and device, computer equipment and medium

Abstract

The invention relates to a fund transaction flow trajectory analysis method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a target transaction card number and fund transaction flow data of a secondary transaction card number associated with the target transaction card number; extracting trajectory clue information from the fund transaction flow data; analyzing corresponding actual geographic position information according to the track clue information, and generating an associated transaction track corresponding to the target transaction card number according to the actual geographic position information; according to the associated transaction track, track points appearing in the same geographic region interval in the same time interval in the associated transaction track are aggregated, and track aggregation condition data are generated; and identifying an abnormal track point according to the track convergence condition data, deleting the abnormal track from the track convergence condition data, and determining the track activity condition of the target transaction card number according to the track convergence condition data from which the abnormal track point is deleted. By adopting the method, the accuracy of tracking the trajectory of the suspicious object can be improved.

Description

Technical Field

[0001] The present application relates to the field of public security technology, and in particular to a method, device, computer equipment and storage medium for analyzing fund transaction flow trajectories. Background Art

[0002] With the development of data public security technology, risk activity trajectory tracking technology has emerged. For new risk activity scenarios involving the Internet, suspects use platforms such as APP (Application) or websites as media to complete risk activities that endanger public security.

[0003] In traditional technologies, suspects are tracked mainly through GPS (Global Positioning System) positioning, video surveillance, face recognition, WIFI (Wireless Fidelity) positioning, sensor positioning, etc. The above tracking methods all rely on the analysis of the known suspects' mobile phone information, network information or biometric information. However, in new risk activity scenarios involving the Internet, the entire risk activity is carried out through platforms such as APP or websites as a medium. Without identifying specific suspects, it is difficult to obtain or understand the suspects' mobile phone information or biometric information data. Therefore, it is difficult to analyze the suspects' trajectories through traditional tracking technologies. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment and storage medium for analyzing fund transaction flow trajectories, which can improve the accuracy of tracking the trajectories of suspicious objects in risk activities without confirming the specific suspects, in response to the above technical problems.

[0005] In a first aspect, a method for analyzing fund transaction flow trajectories is provided, the method comprising:

[0006] Obtaining fund transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number;

[0007] Extracting track clue information from fund transaction flow data;

[0008] Analyze the corresponding actual geographic location information according to the track clue information, and generate the associated transaction track corresponding to the target transaction card number according to the actual geographic location information;

[0009] According to the associated transaction trajectories, the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectories are aggregated to generate trajectory aggregation data;

[0010] Abnormal trajectory points are identified according to the trajectory convergence data, and the abnormal trajectory is deleted from the trajectory convergence data, and the trajectory activity of the target transaction card number is determined according to the trajectory convergence data from which the abnormal trajectory points are deleted.

[0011] In some embodiments, before extracting the track clue information from the fund transaction flow data, the method further includes:

[0012] Perform field mapping processing on fund transaction flow data to obtain field mapping information;

[0013] Perform format standardization on field mapping information to obtain standard field information;

[0014] Use the MD5 hash function to remove duplicate standard field information;

[0015] Estimate and complete key missing information in standard field information based on linked data;

[0016] Identify abnormal transaction information from each standard field information and delete or correct the abnormal transaction information.

[0017] In some embodiments, the track clue information includes physical track clue information and virtual track clue information; wherein,

[0018] Analyze the corresponding actual geographic location information based on the trajectory clue information, including:

[0019] Obtaining first geographic location information according to the entity trajectory clue information;

[0020] Obtaining second geographic location information according to the virtual trajectory clue information;

[0021] Mutual verification of first geographical location information and second geographical location information corresponding to the same fund transaction;

[0022] If the first geographic location information and the second geographic location information are verified, the actual geographic location information is calculated according to the first geographic location information and the second geographic location information.

[0023] In some embodiments, the physical track clue information includes at least one of the transaction merchant address information, the transaction merchant name, the transaction merchant code, and the ATM teller machine number information, and the virtual track clue information includes at least one of the transaction location branch code, the transaction location IP address, the transaction terminal name, and the transaction terminal MAC information; wherein,

[0024] The first geographic location information is obtained by parsing the entity trajectory clue information, including:

[0025] Analyze the actual geographic location information of the transaction merchant associated with the target transaction card number according to the transaction merchant address information, transaction merchant name or transaction merchant code;

[0026] The actual geographical location information of the ATM used for the associated transaction of the target transaction card number is parsed according to the ATM teller machine number information.

[0027] In some embodiments, obtaining the second geographic location information according to the virtual trajectory clue information includes:

[0028] Map the actual geographical location information of the place where the funds transaction of the target transaction card number occurs according to the branch code of the place where the transaction occurs and the IP address of the place where the transaction occurs;

[0029] The actual geographical location information of the transaction terminal associated with the transaction mapped to the target transaction card number according to the transaction terminal name or the transaction terminal MAC information.

[0030] In some embodiments, according to the associated transaction trajectories, the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectories are aggregated to generate trajectory aggregation data, including:

[0031] Determine the accuracy of geographic area division, divide the geographic area map into a plurality of geographic area grids according to the accuracy of geographic area division, and configure unique corresponding geographic location coding information for each geographic area grid;

[0032] Identify the track points in the associated transaction track that fall within the same geographic area grid within the same time interval, and convert the geographic coordinate information of the track points that fall within the same geographic area grid into the geographic location code information corresponding to the geographic area grid where the track points fall;

[0033] The trajectory points with the same geographic location coding information are aggregated to obtain trajectory aggregation data.

[0034] In some embodiments, the method further comprises:

[0035] According to the identification information of the timestamp of each track point in the associated transaction track, each track point is sorted in the order of time occurrence to construct a transaction occurrence time series diagram.

[0036] In some embodiments, the method further comprises:

[0037] Adjust the geographic area division accuracy, aggregate the trajectory points in the associated transaction trajectory according to different geographic area division accuracy, and obtain the trajectory aggregation data under each geographic area division accuracy;

[0038] Visualize the trajectory convergence data at each geographic area division accuracy to obtain a trajectory heat map;

[0039] The heat maps of each trajectory are superimposed and integrated to identify the high-density areas where trajectory points appear, and the high-density areas are regarded as abnormal trajectory areas.

[0040] In some embodiments, identifying abnormal trajectory points according to trajectory convergence data includes:

[0041] According to the trajectory convergence data, the target trajectory points that appear in different geographical area networks within the same time interval are identified, and the target trajectory points are regarded as abnormal trajectory points.

[0042] In a second aspect, a fund transaction flow track analysis device is also provided, the device comprising:

[0043] A data acquisition module, used to acquire fund transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number;

[0044] The clue extraction module is used to extract the track clue information from the fund transaction flow data;

[0045] A track generation module is used to parse the corresponding actual geographical location information according to the track clue information, and generate an associated transaction track corresponding to the target transaction card number according to the actual geographical location information;

[0046] A data aggregation module is used to aggregate the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectory according to the associated transaction trajectory, and generate trajectory aggregation data;

[0047] The abnormality identification module is used to identify abnormal trajectory points according to the trajectory convergence data, delete the abnormal trajectory from the trajectory convergence data, and determine the trajectory activity of the target transaction card number according to the trajectory convergence data with the abnormal trajectory points deleted.

[0048] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method for analyzing fund transaction flow trajectories of any embodiment of the first aspect are implemented.

[0049] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for analyzing a capital transaction flow trajectory of any embodiment of the first aspect.

[0050] The above-mentioned fund transaction flow trajectory analysis method, device, computer equipment and storage medium, by analyzing the characteristics of new types of cases involving the Internet, find that fund transactions are a necessary process for the crime to occur. Therefore, by obtaining the fund transaction flow data of the target transaction card number and its secondary transaction card number, and extracting trajectory clue information based on the fund transaction flow data and constructing related transaction trajectories, it is possible to monitor the relevant trajectory data of the target transaction card number for which no specific suspect has been identified, and then accurately track the actual activity trajectory of the target transaction card number, that is, the suspicious object in the risk activity. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of a flow chart of a method for analyzing a capital transaction flow trajectory in some embodiments;

[0052] Figure 2 A schematic diagram of a logical framework for analyzing fund transaction flow trajectories in some embodiments;

[0053] Figure 3 It is a structural block diagram of a fund transaction flow track analysis device in some embodiments;

[0054] Figure 4 1 is a diagram of the internal structure of a computer device in some embodiments.

[0055] Figure 5 1 is a diagram of the internal structure of a computer device in some other embodiments. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] The fund transaction flow trajectory analysis method provided in the present application can be applied to a computer device, wherein the computer device can be a server or a terminal. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the server can be implemented as an independent server or a server cluster composed of multiple servers.

[0058] In some embodiments, Figure 1 As shown, a method for analyzing fund transaction flow trajectory is provided, and the method is applied to a server as an example for explanation, including the following steps:

[0059] Step S102: Acquire fund transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number.

[0060] The target transaction card number may be the card number of a fund transaction bank card suspected of risky activities. The secondary transaction card number is the card number of a fund transaction bank card that has fund transaction-related activities such as direct or indirect transfers with the target transaction card number.

[0061] For example, if the target transaction card number is taken as the primary card number, the card with associated transaction activities with the primary card number can be taken as the secondary card number, and the non-primary card number with associated transaction activities with the secondary card number can be taken as the tertiary card number, and so on. In this way, multiple levels of secondary card numbers corresponding to the primary card number, i.e., secondary transaction card numbers, can be tracked.

[0062] Specifically, all relevant transaction records can be collected from transaction channels such as bank accounts, electronic wallets, third-party payment platforms, etc. corresponding to the target transaction card number, so as to obtain the fund transaction flow data of the target transaction card number, and the secondary transaction card numbers under the corresponding level of the target transaction card number can be identified according to the set tracking level, and the fund transaction flow data corresponding to each secondary transaction card number can be obtained. Furthermore, the obtained fund transaction flow data can be summarized and then stored in the original database of the fund transaction flow for backup.

[0063] Exemplarily, the fund transaction flow data can be mapped and standardized according to the following field types and standards and then imported into the standard database of fund transaction flow: transaction flow number, transaction flow institution type, transaction type, transaction payment type, transaction entry and exit identification, transaction time, transaction currency, transaction amount, transaction balance, transaction result, transaction cash mark, transaction purpose, transaction voucher type, transaction voucher number, transaction order number, bank external channel transaction flow number, account type, account number, account name, account number corresponding to the bank card number, account number corresponding to the bank institution code, account Corresponding bank name, counterparty account type, counterparty account number, counterparty account name, counterparty account corresponding bank card number, counterparty account corresponding bank institution code, counterparty account corresponding bank name, counterparty ID number, counterparty merchant number, transaction location, longitude of transaction location, latitude of transaction location, branch code of transaction location, branch name of transaction location, IP address of transaction location, transaction terminal type, transaction terminal number, transaction terminal name, transaction terminal MAC, transaction teller number, ATM number, remarks, etc.

[0064] Step S104: extracting track clue information from the fund transaction flow data.

[0065] The trajectory clue information refers to the positioning information determined by the associated devices of the virtual network that can map the actual geographical location clues. The positioning information can be generated by a virtual positioning tool or software.

[0066] Exemplarily, the track clue information may include but is not limited to at least one of the transaction merchant address information, transaction merchant name, transaction merchant code, transaction location branch code, transaction location IP address, transaction terminal name, transaction terminal MAC information and ATM teller machine number information.

[0067] Step S106: parse the corresponding actual geographic location information according to the track clue information, and generate the associated transaction track corresponding to the target transaction card number according to the actual geographic location information.

[0068] In this step, based on the trajectory clue information, the actual geographic location information (for example, geographic coordinate information) corresponding to each trajectory clue information can be obtained by calling a third-party API (Application Programming Interface) or matching information through a location mapping database. Each actual geographic location information obtained is used as a trajectory point to generate an associated transaction trajectory consisting of the actual geographic location information and associated with the transaction flow of the target transaction card number.

[0069] Step S108: According to the associated transaction trajectories, the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectories are aggregated to generate trajectory aggregation data.

[0070] In this step, the associated trajectory information corresponding to the target transaction card number can be aggregated and analyzed through the Geo Hash trajectory algorithm, so as to aggregate the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectory, and obtain trajectory aggregation data that can reflect the associated transaction card numbers that appear in the same trajectory within the same time interval.

[0071] For example, four length intervals can be formulated according to different calculation accuracies, namely: 4 digits (distance error is 20KM), 5 digits (distance error is 2.4KM), 6 digits (distance error is 0.61KM), and 7 digits (distance error is 0.076KM), so as to analyze the card numbers that appear in the same trajectory interval within the same time interval.

[0072] Step S110: identifying abnormal trajectory points according to the trajectory convergence data, deleting the abnormal trajectory from the trajectory convergence data, and determining the trajectory activity of the target transaction card number according to the trajectory convergence data from which the abnormal trajectory points have been deleted.

[0073] In this step, by aggregating trajectory points, trajectory aggregation data that intuitively reflects the actual geographic trajectory information statistics between the target transaction card number and the associated transaction card numbers associated with it can be obtained in the actual geographic area map, so that abnormal trajectory points can be identified from the trajectory aggregation data in a timely and accurate manner, and abnormal transaction card numbers can be quickly determined from a large number of associated transaction card numbers that have a transaction association relationship with the target transaction card number.

[0074] The above-mentioned fund transaction flow trajectory analysis method, device, computer equipment and storage medium, by analyzing the characteristics of new types of cases involving the Internet, find that fund transactions are a necessary process for the crime to occur. Therefore, by obtaining the fund transaction flow data of the target transaction card number and its secondary transaction card number, and extracting trajectory clue information based on the fund transaction flow data and constructing related transaction trajectories, it is possible to monitor the relevant trajectory data of the target transaction card number for which no specific suspect has been identified, and then accurately track the actual activity trajectory of the target transaction card number, that is, the suspicious object in the risk activity.

[0075] In some embodiments, before extracting the track clue information from the fund transaction flow data, the method further includes performing data cleaning on the fund transaction flow data, and further, the cleaned data can be imported into a standard database of the fund transaction flow data:

[0076] 1. Perform field mapping on fund transaction flow data to obtain field mapping information;

[0077] The fund transaction flow data is mapped according to the following fields:

[0078] Transaction serial number, transaction serial institution type, transaction type, transaction payment type, transaction entry and exit identification, transaction time, transaction currency, transaction amount, transaction balance, transaction result, transaction cash mark, transaction purpose, transaction voucher type, transaction voucher number, transaction order number, bank external channel transaction serial number, account type, account number, account name, account number corresponding to the bank card number, account number corresponding to the bank institution code, account corresponding to the bank name, counterparty account type, counterparty account number, counterparty account name, counterparty account corresponding to the bank card number, counterparty account corresponding to the bank institution code, counterparty account corresponding to the bank name, counterparty ID number, counterparty merchant number, transaction location, transaction location longitude, transaction location latitude, transaction location branch code, transaction location branch name, transaction location IP address, transaction terminal type, transaction terminal number, transaction terminal name, transaction terminal MAC, transaction teller number, ATM teller number, remarks, etc.

[0079] 2. Standardize the format of fund transaction flow data and generate standard field information;

[0080] For example, the format standardization process may be specifically referred to as follows:

[0081] 1) Data cleaning is performed on the transaction time in the format of yyyy-mm-dd hh24:mi:ss.

[0082] 2) Differentiate the transaction in and out as outgoing or incoming;

[0083] 3) Mark the transaction currency with the international standard currency symbol, such as RMB: CNY;

[0084] 4) Differentiate between account types: personal and other;

[0085] 5) The IP address where the transaction takes place is standardized in the format of XXX:XXX:XXX:XXX, such as: 10.192.168.201;

[0086] 6) Standardize the format of the transaction terminal MAC to XX:XX:XX:XX:XX:XX, such as: 02:78:B4:56:39:E2;

[0087] 7) The MAC of the transaction terminal is standardized in the format of XX:XX:XX:XX:XX:XX, such as: 02:78:B4:56:39:E2;

[0088] 8) Determine whether the transaction is based on ATM withdrawal based on the type of transaction purpose. If so, extract the ATM machine code from the fund transaction flow data, generate an ATM teller number field and write the extracted ATM machine code into the ATM teller number field as the standard field information of the ATM teller number field.

[0089] 3. Remove duplicate standard field information through MD5 (Message-Digest Algorithm 5) hash function;

[0090] Specifically, the MD5 hash function can be used to remove duplicate data from standard field information such as transaction serial number, transaction time, transaction amount, account number, counterparty account number, transaction entry and exit identifiers, thereby achieving duplicate data cleaning and deduplication processing.

[0091] 4. Estimate and complete the key missing information in each standard field based on the associated data;

[0092] Specifically, the missing key information (transaction serial number, transaction time, transaction amount, account number, counterparty account number, transaction entry and exit identification, etc.) should be supplemented as much as possible, or marked or estimated based on related data that reflects the actual situation.

[0093] 5. Identify abnormal transaction information from each standard field information and delete or correct the abnormal transaction information.

[0094] Specifically, abnormal transaction information, such as abnormally large transactions or obviously erroneous input, can be identified from each standard field information, and the abnormal transaction information can be deleted or corrected and updated.

[0095] The above-mentioned embodiments can improve the accuracy of data by performing data pre-processing such as data cleaning, deduplication, and standardization on the imported or connected fund transaction flow data of each card level, thereby improving the data recognition efficiency and accuracy of subsequent analysis, laying the foundation for subsequent analysis.

[0096] In some embodiments, the trajectory clue information may include: the trajectory clue information includes physical trajectory clue information and virtual trajectory clue information.

[0097] Exemplarily, the physical track clue information includes at least one of the transaction merchant address information, the transaction merchant name, the transaction merchant code and the ATM teller machine number information; the virtual track clue information includes at least one of the branch code where the transaction occurred, the IP address where the transaction occurred, the transaction terminal name, and the transaction terminal MAC information.

[0098] Accordingly, parsing the corresponding actual geographic location information according to the trajectory clue information may include the following steps: obtaining the first geographic location information according to the physical trajectory clue information, obtaining the second geographic location information according to the virtual trajectory clue information, and mutually verifying the first geographic location information and the second geographic location information corresponding to the same fund transaction. If the first geographic location information and the second geographic location information pass the verification, that is, the first geographic location information and the second geographic location information are consistent or the difference accuracy does not exceed a preset range, then the actual geographic location information is calculated according to the first geographic location information and the second geographic location information. If the first geographic location information and the second geographic location information fail to pass the verification, an alarm message or the like may be generated to indicate manual verification.

[0099] This embodiment has created a new mode of comprehensive application of virtual and real trajectories. It extracts accurate and effective physical trajectory clue information such as ATM teller machine address information, transaction merchant address information, etc. based on fund transaction flow data, and combines network virtual trajectory clue information such as IP, MAC address information, etc. to form a mutual verification and checking function, thereby improving the positioning accuracy and effectiveness of the associated transaction trajectory corresponding to the target transaction card number.

[0100] In some embodiments, the first geographic location information is obtained by parsing the entity trajectory clue information, including: parsing the actual geographic location information of the transaction merchant associated with the target transaction card number according to the transaction merchant address information, transaction merchant name or transaction merchant code; parsing the actual geographic location information of the ATM teller machine used for the associated transaction of the target transaction card number according to the ATM teller machine number information.

[0101] In some embodiments, the second geographic location information is obtained by parsing the virtual track clue information, including: the actual geographic location information of the place where the funds transaction occurs based on the branch code of the transaction location and the IP address of the transaction location mapped to the target transaction card number; the actual geographic location information of the transaction terminal of the associated transaction mapped to the target transaction card number based on the transaction terminal name or the transaction terminal MAC information.

[0102] In some embodiments, trajectory points that appear in the same geographic area interval within the same time interval in the associated transaction trajectory are aggregated according to the associated transaction trajectory to generate trajectory aggregation data, including: determining the geographic area division accuracy, dividing the geographic area map into multiple geographic area grids according to the geographic area division accuracy, and configuring unique corresponding geographic location coding information for each geographic area grid; identifying trajectory points in the associated transaction trajectory that fall into the same geographic area grid within the same time interval, and converting the geographic coordinate information of the trajectory points that fall into the same geographic area grid into the geographic location coding information corresponding to the geographic area grid where they fall; aggregating the trajectory points with the same geographic location coding information to obtain trajectory aggregation data.

[0103] In this embodiment, the Geo Hash trajectory algorithm can be used for aggregation analysis:

[0104] (1) Geo Hash grid division: Geo Hash coding can divide the geographic area map into a series of grids of different sizes (geographic area grids), and each grid can be configured with a unique Geo Hash code (geographic location coding information) to represent it. Geo Hash codes of different lengths correspond to grids of different sizes. For example, shorter codes represent larger areas, while longer codes represent smaller areas. The length of Geo Hash codes can reflect the accuracy of regional division.

[0105] (2) Geo Hash encoding of track points: associate each track point in the transaction track

[0106] (i.e., the location coordinate point can be represented by latitude and longitude coordinate information) is converted into the corresponding Geo Hash code. Choose an appropriate code length to balance accuracy and storage requirements. Longer codes can provide higher accuracy, but also increase the complexity of storage and processing.

[0107] (3) Grouping trajectory points with the same Geo Hash code into the same grid. For each grid, the number of trajectory points falling into the grid and the frequency of trajectory points appearing in the grid can be counted, thereby realizing the aggregation of trajectory points to grids.

[0108] (4) Identify high-density areas, i.e., grids with dense trajectory points, and obtain trajectory convergence data.

[0109] In some embodiments, the method further includes: sorting each track point in the associated transaction track in the order of occurrence according to the identification information of the timestamp of each track point, and constructing a transaction occurrence time series diagram. In this embodiment, the track points can also be sorted in the order of occurrence according to the identification information of the timestamp, so as to construct a time series, draw the data of the track point on the time axis and perform statistics to observe the trend of the track point changing over time.

[0110] In some embodiments, the method further includes: adjusting the geographic area division accuracy, aggregating the trajectory points in the related transaction trajectory according to different geographic area division accuracies, and obtaining trajectory aggregation data under each geographic area division accuracy; visualizing the trajectory aggregation data under each geographic area division accuracy to obtain a trajectory heat map; superimposing and integrating the trajectory heat maps to identify high-density areas where trajectory points appear, and treating the high-density areas as abnormal trajectory areas.

[0111] In this embodiment, statistics can be performed on the situation after each trajectory point is converted into Geo Hash codes of different lengths (4 bits, 5 bits, 6 bits, and 7 bits), and then the trajectory convergence of grids in different geographic areas can be displayed through a heat map. By adjusting the length of the Geo Hash code, the aggregation accuracy can be adjusted, and then the aggregation situations corresponding to the lengths of different Geo Hash codes can be integrated, and visualized based on the trajectory heat map, so as to identify high-density areas where trajectory points appear, and then quickly determine the abnormal trajectory area.

[0112] In some embodiments, identifying abnormal trajectory points according to trajectory convergence data includes: identifying target trajectory points that appear in different geographic area networks within the same time interval according to the trajectory convergence data, and treating the target trajectory points as abnormal trajectory points.

[0113] In this embodiment, by identifying the target track points of the associated transaction card numbers that appear in multiple different geographic area networks within the same time interval, the target track points can be further marked. For example, when the Geo Hash value is set to 4 bits in length, the track points that appear in more than two track intervals (geographic area networks) within the same 1-hour time interval are identified as target track points, and the target track points are labeled as "abnormal track points". Through this embodiment, abnormal track points can be quickly located, so that the accuracy of the calculated track convergence data can be guaranteed by eliminating abnormal track points.

[0114] In some embodiments, the method may also include: conducting a comprehensive analysis of abnormal trajectory areas and abnormal trajectory points, identifying abnormal transaction card numbers (suspicious card numbers) corresponding to data that belongs to the abnormal trajectory areas and is marked as abnormal trajectory points, and combining the transaction time series graph to timely and effectively observe the trajectory change trend of the target associated card number over time.

[0115] In some application examples, you can refer to Figure 2 As shown, Figure 2 A schematic diagram of the logical framework of fund transaction flow track analysis in some embodiments is shown. Figure 2 The description can be combined with the specific descriptions in the above embodiments, which will not be repeated here.

[0116] According to this application example, at least one of the following technical features is specifically provided:

[0117] 1. A new breakthrough in the investigation of new types of Internet-related cases has been established. By combining the characteristics of the crime process of new types of Internet-related cases, it is found that capital transactions are a necessary process for the crime to occur. Therefore, by effectively utilizing the characteristics of the capital transaction flow data during the case process, clues of suspicion are extracted and discovered.

[0118] 2. Start a new mode of comprehensive application of virtual and real trajectories, analyze accurate and effective physical trajectory information in the capital transaction flow data, such as ATM teller machine address information, transaction merchant address information, etc., and combine network virtual address information such as IP and MAC address information to form mutual verification and verification, thereby generating related transaction trajectories and improving the accuracy and effectiveness of positioning.

[0119] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0120] In some embodiments, Figure 3 As shown, a fund transaction flow track analysis device is provided, including: a data acquisition module 310, a clue extraction module 320, a track generation module 330, a data aggregation module 340 and an anomaly identification module 350, wherein:

[0121] The data acquisition module 310 is used to acquire the fund transaction flow data of the target transaction card number and the secondary transaction card number associated with the target transaction card number;

[0122] A clue extraction module 320 is used to extract track clue information from fund transaction flow data;

[0123] The track generation module 330 is used to analyze the corresponding actual geographical location information according to the track clue information, and generate the associated transaction track corresponding to the target transaction card number according to the actual geographical location information;

[0124] The data aggregation module 340 is used to aggregate the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectory according to the associated transaction trajectory, and generate trajectory aggregation data;

[0125] The abnormality identification module 350 is used to identify abnormal trajectory points according to the trajectory convergence data, delete the abnormal trajectory from the trajectory convergence data, and determine the trajectory activity of the target transaction card number according to the trajectory convergence data with the abnormal trajectory points deleted.

[0126] In some embodiments, the data acquisition module 310 is also used to perform field mapping processing on the fund transaction flow data to obtain field mapping information; perform format standardization processing on the field mapping information to obtain standard field information; eliminate duplicate standard field information through the MD5 hash function; estimate and complete key missing information in the standard field information based on related data; identify abnormal transaction information from each standard field information and delete or correct the abnormal transaction information.

[0127] In some embodiments, the trajectory generation module 330 is used to parse the corresponding actual geographic location information according to the trajectory clue information, including: obtaining the first geographic location information according to the physical trajectory clue information; obtaining the second geographic location information according to the virtual trajectory clue information; verifying the first geographic location information and the second geographic location information corresponding to the same financial transaction against each other; if the first geographic location information and the second geographic location information are verified, calculating the actual geographic location information based on the first geographic location information and the second geographic location information.

[0128] In some embodiments, the physical track clue information includes at least one of the transaction merchant address information, the transaction merchant name, the transaction merchant code and the ATM teller machine number information, and the virtual track clue information includes at least one of the branch code of the transaction location, the IP address of the transaction location, the transaction terminal name and the transaction terminal MAC information. The track generation module 330 parses the actual geographic location information of the transaction merchant associated with the target transaction card number according to the transaction merchant address information, the transaction merchant name or the transaction merchant code; and parses the actual geographic location information of the ATM teller machine used for the associated transaction of the target transaction card number according to the ATM teller machine number information.

[0129] In some embodiments, the track generation module 330 maps the actual geographic location information of the place where the funds transaction of the target transaction card number occurs according to the branch code of the transaction location and the IP address of the transaction location; and maps the actual geographic location information of the transaction terminal of the associated transaction of the target transaction card number according to the transaction terminal name or the transaction terminal MAC information.

[0130] In some embodiments, the data aggregation module 340 is used to determine the accuracy of geographic area division, divide the geographic area map into multiple geographic area grids according to the geographic area division accuracy, and configure unique corresponding geographic location coding information for each geographic area grid; identify trajectory points in the associated transaction trajectory that falls into the same geographic area grid within the same time period, and convert the geographic coordinate information of the trajectory points that fall into the same geographic area grid into the geographic location coding information corresponding to the geographic area grid where they fall; aggregate the trajectory points with the same geographic location coding information to obtain trajectory convergence data.

[0131] In some embodiments, the data aggregation module 340 is further used to sort each track point in the associated transaction track in chronological order according to the identification information of the timestamp of each track point, and construct a transaction occurrence time series diagram.

[0132] In some embodiments, the data aggregation module 340 is also used to adjust the geographic area division accuracy, aggregate the trajectory points in the related transaction trajectory according to different geographic area division accuracies, and obtain the trajectory aggregation data under each geographic area division accuracy; visualize the trajectory aggregation data under each geographic area division accuracy to obtain a trajectory heat map; overlay and integrate the trajectory heat maps to identify high-density areas where trajectory points appear, and use the high-density areas as abnormal trajectory areas.

[0133] In some embodiments, the anomaly identification module 350 identifies target trajectory points that appear in different geographic area networks within the same time interval based on the trajectory convergence data, and regards the target trajectory points as anomaly trajectory points.

[0134] The specific definition of the fund transaction flow trajectory analysis device can be found in the definition of the fund transaction flow trajectory analysis method above, which will not be repeated here. Each module in the above fund transaction flow trajectory analysis device can be implemented in whole or in part by software, hardware and a combination thereof. The above modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0135] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store capital transaction flow data, associated trajectory data, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for analyzing capital transaction flow trajectories is implemented.

[0136] In some embodiments, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for analyzing the flow trajectory of capital transactions is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0137] Those skilled in the art will understand that Figure 4 and Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0138] In some embodiments, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the following steps are implemented when the processor executes the computer program: obtaining financial transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number; extracting trajectory clue information from the financial transaction flow data; parsing the corresponding actual geographic location information according to the trajectory clue information, and generating an associated transaction trajectory corresponding to the target transaction card number according to the actual geographic location information; aggregating trajectory points that appear in the same geographic area within the same time interval in the associated transaction trajectory according to the associated transaction trajectory to generate trajectory convergence data; identifying abnormal trajectory points according to the trajectory convergence data, deleting the abnormal trajectory from the trajectory convergence data, and determining the trajectory activity of the target transaction card number according to the trajectory convergence data from which the abnormal trajectory points have been deleted.

[0139] In some embodiments, when the processor executes the computer program, it also implements the following steps: performing field mapping processing on the fund transaction flow data to obtain field mapping information; performing format standardization processing on the field mapping information to obtain standard field information; eliminating repeated standard field information through the MD5 hash function; estimating and completing key missing information in the standard field information based on related data; identifying abnormal transaction information from each standard field information and deleting or correcting the abnormal transaction information.

[0140] In some embodiments, when the processor executes the computer program, the following steps are also implemented: first geographic location information is obtained based on the analysis of physical trajectory clue information; second geographic location information is obtained based on the analysis of virtual trajectory clue information; the first geographic location information and the second geographic location information corresponding to the same financial transaction are mutually verified; if the first geographic location information and the second geographic location information are verified, the actual geographic location information is calculated based on the first geographic location information and the second geographic location information.

[0141] In some embodiments, when the processor executes the computer program, the following steps are also implemented: parsing the actual geographic location information of the transaction merchant associated with the target transaction card number based on the transaction merchant address information, the transaction merchant name or the transaction merchant code; parsing the actual geographic location information of the ATM teller machine used for the transaction associated with the target transaction card number based on the ATM teller machine number information.

[0142] In some embodiments, when the processor executes the computer program, it also implements the following steps: mapping the actual geographical location information of the place where the funds transaction of the target transaction card number occurs according to the branch code of the transaction location and the IP address of the transaction location; mapping the actual geographical location information of the transaction terminal of the associated transaction of the target transaction card number according to the transaction terminal name or the transaction terminal MAC information.

[0143] In some embodiments, the processor further implements the following steps when executing the computer program: determining the accuracy of geographic area division, dividing the geographic area map into multiple geographic area grids according to the accuracy of geographic area division, and configuring unique corresponding geographic location coding information for each geographic area grid; identifying trajectory points in the associated transaction trajectory that fall into the same geographic area grid within the same time interval, and converting the geographic coordinate information of the trajectory points that fall into the same geographic area grid into the geographic location coding information corresponding to the geographic area grid in which they fall; aggregating the trajectory points with the same geographic location coding information to obtain trajectory convergence data.

[0144] In some embodiments, when the processor executes the computer program, the following steps are also implemented: sorting each track point in the associated transaction track in chronological order according to the identification information of the timestamp of each track point, and constructing a transaction occurrence time series diagram.

[0145] In some embodiments, when the processor executes the computer program, the following steps are also implemented: adjusting the geographic area division accuracy, aggregating the trajectory points in the related transaction trajectory according to different geographic area division accuracies, and obtaining trajectory aggregation data under each geographic area division accuracy; visualizing the trajectory aggregation data under each geographic area division accuracy to obtain a trajectory heat map; superimposing and integrating the trajectory heat maps, identifying high-density areas where trajectory points appear, and treating the high-density areas as abnormal trajectory areas.

[0146] In some embodiments, when the processor executes the computer program, the following steps are also implemented: according to the trajectory convergence data, target trajectory points appearing in different geographic area networks within the same time interval are identified, and the target trajectory points are regarded as abnormal trajectory points.

[0147] In some embodiments, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented: obtaining financial transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number; extracting trajectory clue information from the financial transaction flow data; parsing the corresponding actual geographic location information according to the trajectory clue information, and generating an associated transaction trajectory corresponding to the target transaction card number according to the actual geographic location information; aggregating trajectory points that appear in the same geographic area within the same time interval in the associated transaction trajectory according to the associated transaction trajectory to generate trajectory convergence data; identifying abnormal trajectory points according to the trajectory convergence data, deleting the abnormal trajectory from the trajectory convergence data, and determining the trajectory activity of the target transaction card number according to the trajectory convergence data from which the abnormal trajectory points have been deleted.

[0148] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: performing field mapping processing on the fund transaction flow data to obtain field mapping information; performing format standardization processing on the field mapping information to obtain standard field information; eliminating repeated standard field information through the MD5 hash function; estimating and completing key missing information in the standard field information based on related data; identifying abnormal transaction information from each standard field information and deleting or correcting the abnormal transaction information.

[0149] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: first geographic location information is obtained based on the analysis of physical trajectory clue information; second geographic location information is obtained based on the analysis of virtual trajectory clue information; the first geographic location information and the second geographic location information corresponding to the same financial transaction are mutually verified; if the first geographic location information and the second geographic location information are verified, the actual geographic location information is calculated based on the first geographic location information and the second geographic location information.

[0150] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: parsing the actual geographic location information of the transaction merchant associated with the target transaction card number based on the transaction merchant address information, transaction merchant name or transaction merchant code; parsing the actual geographic location information of the ATM teller machine used for the transaction associated with the target transaction card number based on the ATM teller machine number information.

[0151] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: mapping the actual geographical location information of the place where the funds transaction of the target transaction card number occurs according to the branch code of the place where the transaction occurs and the IP address of the place where the transaction occurs; mapping the actual geographical location information of the transaction terminal of the associated transaction of the target transaction card number according to the transaction terminal name or the transaction terminal MAC information.

[0152] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: determining the accuracy of geographic area division, dividing the geographic area map into multiple geographic area grids according to the accuracy of geographic area division, and configuring unique corresponding geographic location coding information for each geographic area grid; identifying trajectory points in the associated transaction trajectory that falls into the same geographic area grid within the same time period, and converting the geographic coordinate information of the trajectory points that fall into the same geographic area grid into the geographic location coding information corresponding to the geographic area grid where they fall; aggregating the trajectory points with the same geographic location coding information to obtain trajectory convergence data.

[0153] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: sorting each track point in the associated transaction track in chronological order according to the identification information of the timestamp of each track point, and constructing a transaction occurrence time series diagram.

[0154] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: adjusting the geographic area division accuracy, aggregating the trajectory points in the related transaction trajectory according to different geographic area division accuracies, and obtaining trajectory aggregation data under each geographic area division accuracy; visualizing the trajectory aggregation data under each geographic area division accuracy to obtain a trajectory heat map; superimposing and integrating the trajectory heat maps, identifying high-density areas where trajectory points appear, and treating the high-density areas as abnormal trajectory areas.

[0155] In some embodiments, when the computer program is executed by the processor, the following steps are also implemented: according to the trajectory convergence data, target trajectory points appearing in different geographic area networks within the same time interval are identified, and the target trajectory points are regarded as abnormal trajectory points.

[0156] Those skilled in the art can understand that all or part of the processes in the methods for implementing the above embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0157] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0158] In addition, the term "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the characters in this article generally indicate that the associated objects before and after are in an "or" relationship.

[0159] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

[0160] It should be noted that in the embodiments of the present application, data related to user information or user data (for example, financial transaction flow data) needs to be obtained and processed after authorization by the user or consent from relevant departments. When the embodiments of the present application are applied to specific products or technologies, it is necessary to obtain user permission or consent from relevant departments. It can be used to assist public security, criminal investigation and other relevant departments in case investigation, etc., and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

Claims

1. A method for analyzing fund transaction flow traces, the method comprising: Acquire fund transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number; Extracting track clue information from the fund transaction flow data; Analyzing the corresponding actual geographical location information according to the track clue information, and generating the associated transaction track corresponding to the target transaction card number according to the actual geographical location information; According to the associated transaction trajectory, the trajectory points appearing in the same geographical area within the same time interval in the associated transaction trajectory are aggregated to generate trajectory aggregation situation data; Abnormal trajectory points are identified according to the trajectory convergence data, and abnormal trajectories are deleted from the trajectory convergence data, and the trajectory activity of the target transaction card number is determined according to the trajectory convergence data from which the abnormal trajectory points are deleted.

2. The method according to claim 1, characterized in that: Before extracting the track clue information from the fund transaction flow data, the method further includes: Performing field mapping processing on the fund transaction flow data to obtain field mapping information; Performing format standardization processing on the field mapping information to obtain standard field information; Repetitive standard field information is removed through the MD5 hash function; Estimate and complete the key missing information in the standard field information based on the associated data; Abnormal transaction information is identified from each of the standard field information and the abnormal transaction information is deleted or corrected.

3. The method according to claim 1, characterized in that: The track clue information includes physical track clue information and virtual track clue information; wherein, The step of parsing the corresponding actual geographical location information according to the trajectory clue information includes: Obtaining first geographic location information according to the entity trajectory clue information; Obtaining second geographical location information according to the virtual track clue information; Mutual verification of the first geographical location information and the second geographical location information corresponding to the same financial transaction; If the first geographic location information and the second geographic location information are verified, actual geographic location information is calculated according to the first geographic location information and the second geographic location information.

4. The method according to claim 3, characterized in that The physical track clue information includes at least one of the transaction merchant address information, transaction merchant name, transaction merchant code and ATM teller machine number information, and the virtual track clue information includes at least one of the transaction location network code, transaction location IP address, transaction terminal name and transaction terminal MAC information; wherein, The obtaining of the first geographic location information according to the entity trajectory clue information analysis includes: Parsing the actual geographical location information of the transaction merchant associated with the target transaction card number according to the transaction merchant address information, transaction merchant name or transaction merchant code; Analyze the actual geographical location information of the ATM used for the associated transaction of the target transaction card number according to the ATM number information; and / or The step of obtaining the second geographical location information by parsing the virtual trajectory clue information includes: Mapping the actual geographical location information of the place where the funds transaction of the target transaction card number occurs according to the branch code of the place where the transaction occurs and the IP address of the place where the transaction occurs; The actual geographical location information of the transaction terminal associated with the target transaction card number is mapped according to the transaction terminal name or the transaction terminal MAC information.

5. The method according to claim 1, characterized in that The step of aggregating the track points that appear in the same geographical area within the same time interval in the associated transaction track according to the associated transaction track to generate track convergence data includes: Determine the geographic area division accuracy, divide the geographic area map into a plurality of geographic area grids according to the geographic area division accuracy, and configure unique corresponding geographic location coding information for each of the geographic area grids; Identify the track points in the associated transaction track that fall within the same geographic area grid within the same time interval, and convert the geographic coordinate information of the track points that fall within the same geographic area grid into geographic location code information corresponding to the geographic area grid where the track points fall; The trajectory points with the same geographic location coding information are aggregated to obtain the trajectory aggregation situation data.

6. The method according to claim 5, characterized in that The method further comprises: According to the identification information of the timestamps of the track points in the associated transaction track, the track points are sorted in the order of their occurrence, and a transaction occurrence time series diagram is constructed; or Adjusting the geographic area division precision, respectively aggregating the track points in the associated transaction track according to different geographic area division precisions, and obtaining track aggregation data under each geographic area division precision; Visualizing the trajectory convergence data under each of the geographic area division accuracies to obtain a trajectory heat map; The trajectory heat maps are superimposed and integrated to identify high-density areas where trajectory points appear, and the high-density areas are used as abnormal trajectory areas.

7. The method according to claim 1, characterized in that The identifying abnormal trajectory points according to the trajectory convergence data includes: According to the trajectory convergence data, target trajectory points that appear in different geographical area networks within the same time interval are identified, and the target trajectory points are used as the abnormal trajectory points.

8. A fund transaction flow track analysis device, characterized in that: The device comprises: A data acquisition module, used to acquire fund transaction flow data of a target transaction card number and a secondary transaction card number associated with the target transaction card number; A clue extraction module, used to extract track clue information from the fund transaction flow data; A track generation module, used to parse the corresponding actual geographical location information according to the track clue information, and generate the associated transaction track corresponding to the target transaction card number according to the actual geographical location information; A data aggregation module, configured to aggregate the trajectory points that appear in the same geographical area within the same time interval in the associated transaction trajectory according to the associated transaction trajectory, and generate trajectory aggregation data; The abnormality identification module is used to identify abnormal trajectory points according to the trajectory convergence data, delete abnormal trajectories from the trajectory convergence data, and determine the trajectory activity of the target transaction card number according to the trajectory convergence data with the abnormal trajectory points deleted.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images