Bank anti-money laundering monitoring method and system based on graph neural network

Abstract

The invention discloses a bank anti-money laundering monitoring method based on a graph neural network. The method comprises the following steps: S1, collecting data from a transaction database of a bank; s2, integrating all the collected data into multi-dimensional graph structure data by using a data fusion technology; s3, constructing an enhanced transaction network graph based on the multi-dimensional graph structure data; s4, using a depth map neural network model to carry out deep learning on the enhanced transaction network graph; s5, performing intelligent monitoring and analysis on new or continuously performed transaction activities by using the trained depth map neural network model; s6, according to a monitoring result in the step S5, continuously optimizing and updating the graph neural network model by using a real-time feedback loop and a theme perception adaptive mechanism; and S7, generating a report. According to the invention, the depth map neural network model is introduced, and the map neural network model considers the complexity and dynamic nature of a transaction network, so that money laundering behaviors can be identified more accurately.

Description

Technical Field

[0001] The present invention relates to the field of financial technology, and in particular to a bank anti-money laundering monitoring method and system based on graph neural network. Background Art

[0002] Money laundering refers to the act of hiding, transferring or disguising illegally obtained funds through various means to make them look like legal income. Money laundering not only undermines the stability and integrity of the financial system, but may also encourage criminal activities and have a serious impact on society. Therefore, banks and other financial institutions need to take effective anti-money laundering monitoring measures to identify and prevent money laundering.

[0003] First, traditional anti-money laundering monitoring methods mainly rely on systems based on rules or shallow machine learning models. These methods require manual setting of rules and thresholds, and are difficult to adapt to the ever-changing money laundering techniques and transaction patterns. In addition, traditional methods often only focus on simple features such as transaction amount and transaction frequency, ignoring the complex relationships and spatiotemporal characteristics between transactions.

[0004] Secondly, the existing system also has limitations in adaptability and flexibility. Money laundering techniques and transaction patterns are constantly changing, but many anti-money laundering systems lack real-time feedback loops and adaptive mechanisms, and are unable to learn and adapt to new money laundering methods in a timely manner.

[0005] Finally, many anti-money laundering systems lack detailed explanations when flagging suspicious transactions or accounts, making it difficult for banks’ anti-money laundering teams to understand the decision-making basis of the monitoring system, and thus to conduct effective follow-up investigations and decisions. This reduces the credibility of the monitoring process and may also affect the bank’s ability to respond to money laundering activities in a timely manner.

[0006] In summary, existing anti-money laundering technologies have significant technical problems in terms of technical means, processing of complex transaction networks, adaptability and flexibility, transparency and interpretability, etc., which seriously restrict the efficiency and effectiveness of anti-money laundering work. Summary of the invention

[0007] One purpose of the present invention is to propose a bank anti-money laundering monitoring method based on graph neural network. The present invention introduces a deep graph neural network model. The graph neural network model takes into account the complexity and dynamics of the transaction network and can more accurately identify money laundering behavior.

[0008] To achieve the above objectives, the technical solutions adopted by the present invention include:

[0009] A bank anti-money laundering monitoring method based on graph neural network, characterized by comprising:

[0010] S1. Collect account number data, transaction amount data, transaction time data and transaction counterparty information data from the bank's transaction database, and additionally collect account holder's behavioral characteristics data, social relationship network data between accounts and geographic information data of transaction locations;

[0011] S2, using data fusion technology to integrate all the collected data into multi-dimensional graph structure data;

[0012] S3. Construct an enhanced transaction network graph based on multi-dimensional graph structure data, use the t-distributed random neighborhood embedding algorithm to initialize node feature vectors, define edge weights based on transaction behaviors and their geographic locations, and consider the spatiotemporal relationship between transactions;

[0013] S4. Use a deep graph neural network model to conduct in-depth learning on the enhanced transaction network graph. The deep graph neural network model uses node classification, graph classification or edge prediction technology to optimize the money laundering pattern in the bank transaction network and identify hidden money laundering behavior;

[0014] S5. Use the trained deep graph neural network model to intelligently monitor and analyze new or ongoing transaction activities, introduce deep graph neural network model explanatory technology, identify potential money laundering activities, and provide possible reasons and logic for money laundering behavior;

[0015] S6. Based on the monitoring results in step S5, the graph neural network model is continuously optimized and updated using a real-time feedback loop and a topic-aware adaptive mechanism;

[0016] S7. Based on the monitoring results in step S5, generate a report including risk level assessment, potential money laundering accounts and transaction pattern reports.

[0017] Optionally, the S1 specifically includes:

[0018] S11. Define transaction data set:

[0019] D={D 1 ,D 2 ,...,D n};

[0020] Among them, D i Represents the data of the i-th transaction;

[0021] For each transaction D i , collect data including account number A id , transaction amount T am , Trading time T tm , Transaction counterparty information T pi , Account holder’s behavioral characteristics data B fd, social relationship network data S between accounts rn and the geographic information data G of the transaction location li ;

[0022] S12. Behavioral characteristic data B of the account holder fd Collect information on login frequency, transaction habits and transaction preferences to capture the behavior patterns of account holders;

[0023] S13. Construct social relationship network data by analyzing transaction frequency, transaction amount and transaction time factors between accounts rn , identify potential relationships between accounts;

[0024] S14. Geographic information data G of transaction location li Includes the specific location coordinates where the transaction occurred, which is used to analyze the geographical distribution characteristics of transaction activities.

[0025] Optionally, the S2 specifically includes:

[0026] S21, using data fusion technology to integrate the data collected in step S11, and construct an initialization graph of multi-dimensional graph structure data:

[0027] G = (V, E);

[0028] Where V represents a set of nodes, each node v∈V represents a unique bank account, E represents a set of edges, and each edge e∈E represents a transaction relationship between two accounts;

[0029] S22. Assign feature vector v to each node v feat , feature vector fusion account number A id , Account holder’s behavioral characteristics data B fd And the account's social network data S rn , the feature vector v of node v feat The construction formula is:

[0030] v feat =w 1 Embed(A id )+w 2 Norm(B fd )+w 3 Encode(S rn );

[0031] Among them, v feat The final generated node feature vector is used to represent the comprehensive characteristics of each account in the bank transaction network. id ) indicates account number A idThe vector obtained by the embedding layer is used to transform the discrete characteristics of the account number into a continuous feature vector. Norm(B fd ) represents the behavioral characteristic data B of the account holder fd Perform Z-score standardization to convert behavioral characteristics of different scales into comparable values. Encode (S rn ) represents the social relationship network data S between accounts rn Apply graph embedding algorithm to transform the social network structure into vector form, w 1 、w 2 、w 3 are weight coefficients, A id Represents the account number, which is used to uniquely identify each account. fd It represents the behavioral characteristics of the account holder, including login frequency and transaction habits, reflecting the transaction behavior pattern of the account holder. rn Represents the social relationship network data between accounts, describing the transaction relationship and social connection between accounts;

[0032] S23. Assign attributes to each edge e in the graph, including the transaction amount T am , Trading time T tm , Transaction counterparty information T pi and the geographic information data G of the transaction location li , the edge attribute representation formula is:

[0033] e attr =α·f am (T am )+β·f tm (T tm )+γ·f pi (T pi )+δ·f li (G li );

[0034] Among them, α, β, γ and δ weight coefficients, f am (T am ) represents the conversion function of the transaction amount, which makes the effect of the amount on the result reasonable, f tm (T tm ) represents the conversion function of transaction time, which converts time into the time difference from a reference point, f pi (T pi ) represents the conversion function of the counterparty information, which is encoded based on the counterparty’s risk level, f li (G li ) represents a conversion function of the geographical information of the transaction location, converting the geographical coordinates into some form of geographical risk score;

[0035] S24. Define the spatiotemporal relationship evaluation function Phi to measure the spatiotemporal similarity of transaction behaviors, combining the transaction time difference and geographical distance.

[0036] Phi(e)=λ·exp(-σ t ΔT e )+(1-λ)·exp(-σ g ΔG e );

[0037] Where, ΔT e represents the time difference between the two transaction nodes connected by edge e, ΔG e represents the Euclidean distance between the geographical locations of corresponding transactions, σ t and σ g are scaling parameters of time and geographic information, respectively, used to adjust the influence of time difference and geographic distance on similarity, and λ is the balance coefficient;

[0038] S25, based on the spatiotemporal relationship evaluation function Phi, dynamically adjust the weights of the edges in the graph. For each edge e, its weight w e Updated to:

[0039]

[0040] in, is the original weight of edge e, which is usually calculated based on the transaction amount or other static attributes. The updated weight w e Integrate the temporal and spatial characteristics of transactions to reflect the actual situation and potential risks of transaction behaviors;

[0041] S26. Using the updated edge weights, re-evaluate the centrality and community structure of the nodes in the graph, use spectral clustering to identify potential money laundering clusters, and reveal the network characteristics and evolution trends of money laundering behavior by analyzing the centrality changes and community dynamics of the nodes;

[0042] S27. Incorporate spatiotemporal dynamic characteristics into the training process of the graph neural network model. Through the spatiotemporal-aware graph neural network layer, the model can learn the dynamic spatiotemporal patterns of trading behaviors.

[0043] Optionally, the S3 specifically includes:

[0044] S31. After completing the construction of the multi-dimensional graph structure data, the node feature vector is initialized using the t-distributed random neighborhood embedding algorithm. The node feature vector initialization is to capture the microscopic characteristics of bank accounts in the transaction network and the potential associations between accounts. For each node v∈V in the graph G=(V,E), its initial feature vector Transformed by the t-SNE algorithm, the t-SNE algorithm maintains the local similarity between accounts in the high-dimensional feature space through dimensionality reduction:

[0045]

[0046] S32. Define an edge weight update function to dynamically adjust the weight of each edge according to the transaction amount, transaction time, and geographic information data of the transaction location:

[0047]

[0048] Among them, Norm(T am ) is the standardized value of the transaction amount, TimeFactor(T tm ) and GeoFactor(G li ) are weighting factors for transaction time and geographical location, respectively, and α, β and γ are weight parameters;

[0049] S33. Combined with the spatiotemporal relationship between transactions, the spatiotemporal relationship evaluation function is used to adjust the weight of each edge to identify transaction patterns that are abnormally concentrated in time and space:

[0050] Φ(e)=λ·exp(σ t ΔT e )+(1+λ)·exp(σ g ΔG e );

[0051] Where, ΔT e and ΔG e Represent the time difference and geographical distance respectively, σ t and σ g is the decay parameter, λ adjusts the importance of temporal and spatial factors;

[0052] S34. Use the updated node feature vectors and edge weights to construct an enhanced transaction network diagram, incorporating the basic attributes of transactions and the spatiotemporal characteristics of transaction behaviors:

[0053]

[0054] S35. Apply the node feature vector optimized by the t-SNE algorithm and the edge weight considering the spatiotemporal relationship to recalculate the importance of the nodes in the graph, including the degree centrality and closeness centrality indicators, as well as the community structure:

[0055] Centrality(v)=CalculateCentrality(G enhanced ,v);

[0056] CommunityStructure=SpectralClustering(G enhanced );

[0057] Among them, CalculateCentrality means calculating the centrality index of the node in the enhanced graph, and SpectralClustering means performing community division based on the spectral characteristics of the graph to reveal clusters of potential money laundering activities.

[0058] Optionally, the S4 specifically includes:

[0059] S41. Select deep graph neural network architecture and process node feature vectors and the dynamic weights of the edges Capturing patterns and relationships in transaction networks;

[0060] S42, applying node classification technology, each node v is assigned a label l v , indicating its potential risk level:

[0061]

[0062] Among them, L is the loss function, y v is the true label of node v, is the label predicted by the model, and θ represents the model parameters;

[0063] S43. Use graph classification technology to classify the entire transaction network graph as normal or suspicious:

[0064]

[0065] Among them, Y is the true classification of the image, including normal or suspicious, is the classification predicted by the model based on the features of the entire graph;

[0066] S44. Using edge prediction technology to identify abnormal transaction relationships that may indicate money laundering activities:

[0067]

[0068] where e uv is the real existence sign of edge (u,v), is the probability that the edge exists as predicted by the model.

[0069] Optionally, the S5 specifically includes:

[0070] S51. Deploy the trained deep graph neural network model in the bank transaction monitoring system to process new transaction data in real time or monitor ongoing transaction activities, analyze the nodes, edges and overall graph structure in the transaction network, and identify potential risks that match known money laundering behavior patterns;

[0071] S52 uses LIME technology to locally interpret the graph neural network model and analyze the specific reasons why the graph neural network model identifies potential money laundering activities. For each transaction or account node identified as suspicious by the graph neural network model, LIME approximates the local decision-making behavior of the graph neural network model at the transaction or node by generating an interpretable linear model.

[0072] S53. For transactions identified as suspicious by the model, the system automatically generates a detailed report including the key features of the transaction, the risk level predicted by the model, and an explanatory analysis of the possibility of money laundering:

[0073] RiskScore = f GNN (x;θ);

[0074] Among them, x represents the feature vector of the transaction, f GNN is a graph neural network model, θ represents the model parameters, and RiskScore represents the risk score of the transaction;

[0075] S54. Using the results of explanatory analysis, the bank's anti-money laundering team understands the specific reasons why a transaction is marked as suspicious, including abnormal transaction amounts, frequent small transactions, complex transaction network structures, or transaction relationships with accounts known to be high-risk.

[0076] Optionally, the S52 specifically includes:

[0077] S521. For a given suspicious transaction or account node v, select its feature vector v feat As the explanation target, a new local dataset is constructed. The local dataset includes the feature vector of v and its neighbor node features in the graph neural network model to simulate the local decision-making environment.

[0078] S522, on the local data set, by randomly perturbing v feat Generate a new set of samples, each of which represents a possible transaction or account status change. For each sample, use the graph neural network model to calculate its corresponding risk score;

[0079] S523. Based on the generated samples and their graph neural network model outputs, a linear regression model is trained to approximate the local decision-making behavior of the graph neural network model at v:

[0080]

[0081] Where N is the number of generated samples, π(v,v i ) is a kernel function that measures the difference between the original node v and the generated sample v i The similarity between GNN (v i ) is the graph neural network model for sample v i The output, is the sample v i The eigenvector of

[0082] S524. Use the trained linear model to explain the decision-making basis of the graph neural network model in v and reveal the key factors behind potential money laundering behavior.

[0083] Optionally, the S6 specifically includes:

[0084] S61. Establish a real-time feedback loop mechanism to automatically collect the monitoring results of the graph neural network model on actual bank transaction data, including correctly identified cases and false positives or omissions;

[0085] S62. Analyze monitoring results to identify specific areas where model performance is insufficient, including insufficient identification of certain types of money laundering or inadequate treatment of certain transaction characteristics;

[0086] S63. Use a topic-aware adaptive mechanism based on monitoring results analysis to dynamically adjust the parameters and structure of the graph neural network model, including adjusting the learning rate of the model, increasing or decreasing the number of network layers, modifying the activation function, or optimizing the loss function;

[0087] S64. Utilize newly collected transaction data and feedback information to continuously train and update the graph neural network model, and use incremental learning technology to adapt the graph neural network model to new money laundering techniques and transaction patterns;

[0088] S65. Implement a topic-aware adaptive mechanism to automatically identify and integrate relevant topics or patterns based on emerging patterns and trends in transaction data, discover new money laundering strategies or risk factors through cluster analysis of transaction data, and then use this newly discovered information to adjust and optimize the graph neural network model;

[0089] S66. The updated graph neural network model is redeployed in the bank transaction monitoring system.

[0090] In addition, the present invention also relates to a bank anti-money laundering monitoring system based on graph neural network, which is characterized by comprising:

[0091] A data collection module is used to collect account number data, transaction amount data, transaction time data and transaction counterparty information data from the bank's transaction database, and also collects additional behavioral characteristic data of account holders, social relationship network data between accounts and geographic information data of transaction locations;

[0092] The data integration module is used to integrate all the collected data into multi-dimensional graph structure data using data fusion technology;

[0093] The transaction network graph construction module is used to construct an enhanced transaction network graph based on multi-dimensional graph structure data. It uses the t-distributed random neighborhood embedding algorithm to initialize node feature vectors, defines edge weights based on transaction behaviors and their geographic locations, and considers the spatiotemporal relationship between transactions.

[0094] An optimization module for deep learning of enhanced transaction network graphs using a deep graph neural network model that uses node classification, graph classification, or edge prediction techniques to optimize money laundering patterns in bank transaction networks and identify hidden money laundering behaviors;

[0095] The monitoring module uses the trained deep graph neural network model to intelligently monitor and analyze new or ongoing transaction activities, introduces deep graph neural network model explanatory technology, identifies potential money laundering activities, and provides possible reasons and logic for money laundering behavior;

[0096] The update module is used to continuously optimize and update the graph neural network model based on the monitoring results of the monitoring module using a real-time feedback loop and a topic-aware adaptive mechanism;

[0097] The report generation module is used to generate reports including risk level assessment, potential money laundering accounts and transaction pattern reports based on the monitoring results of the monitoring module.

[0098] In addition, the present invention also relates to an electronic device, characterized in that it comprises a processor and a memory;

[0099] The memory is used to store operation instructions;

[0100] The processor is used to execute the above method by calling the operation instruction.

[0101] In addition, the present invention also relates to a computer-readable storage medium, characterized in that a computer program is stored on the storage medium, and the computer program implements the above method when executed by a processor.

[0102] By adopting the solution provided in this application, data is collected from the bank's transaction database, and all the collected data is integrated into multi-dimensional graph structure data using data fusion technology. An enhanced transaction network graph is constructed based on the multi-dimensional graph structure data, and a deep graph neural network model is used to conduct in-depth learning of the enhanced transaction network graph. The trained deep graph neural network model is used to intelligently monitor and analyze new or ongoing transaction activities. Based on the monitoring results, the graph neural network model is continuously optimized and updated using a real-time feedback loop and a topic-aware adaptive mechanism to generate a report. Therefore, the above technical solution, by introducing a deep graph neural network model, can take into account the complexity and dynamics of the transaction network, identify money laundering behaviors more accurately, reduce false alarms and improve the detection rate of real money laundering behaviors. The real-time feedback loop and topic-aware adaptive mechanism ensure that the monitoring system can continuously learn and adapt to new money laundering methods and transaction patterns, so that the monitoring system can not only respond to current money laundering strategies, but also prevent possible money laundering activities in the future. By introducing model explanatory technology, it can provide detailed explanations as to why a transaction or account is marked as suspicious, which increases the transparency of the monitoring process and provides valuable insights for the bank's anti-money laundering team, helping them to conduct subsequent investigations and decisions more effectively. BRIEF DESCRIPTION OF THE DRAWINGS

[0103] Figure 1 A flowchart of a bank anti-money laundering monitoring method based on a graph neural network provided in an embodiment of the present application;

[0104] Figure 2 A schematic diagram of the structure of a bank anti-money laundering monitoring system based on a graph neural network provided in an embodiment of the present application;

[0105] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0106] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present invention.

[0107] Those skilled in the art can understand that, unless otherwise stated, the singular forms "one", "an", "said" and "the" used herein may also include plural forms, and the "first", "second", etc., are only used to distinguish and define objects for the purpose of introducing the scheme clearly, and do not limit the objects themselves. Of course, the objects defined by "first" and "second" may be the same terminal, device, user, etc., or the same type of terminal, device and user. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0108] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments.

[0109] Figure 1 The flowchart of a bank anti-money laundering monitoring method based on a graph neural network is shown in an embodiment of the present application, which specifically includes:

[0110] S1. Collect account number data, transaction amount data, transaction time data and transaction counterparty information data from the bank's transaction database, and additionally collect account holder's behavioral characteristics data, social relationship network data between accounts and geographic information data of transaction locations;

[0111] In this implementation, S1 specifically includes:

[0112] S11. Define transaction data set:

[0113] D={D 1 ,D 2 ,...,D n};

[0114] Among them, D i Represents the data of the i-th transaction;

[0115] For each transaction D i , collect data including account number A id , transaction amount T am , Trading time T tm , Transaction counterparty information T pi , Behavioral characteristic data of account holders B fd , social relationship network data S between accounts rnand the geographic information data G of the transaction location li ;

[0116] S12. Behavioral characteristic data B of the account holder fd Collect information on login frequency, transaction habits and transaction preferences to capture the behavior patterns of account holders;

[0117] S13. Construct social relationship network data by analyzing transaction frequency, transaction amount and transaction time factors between accounts rn , identify potential relationships between accounts;

[0118] S14. Geographic information data G of transaction location li Includes the specific location coordinates where the transaction occurred, which is used to analyze the geographical distribution characteristics of transaction activities.

[0119] S2, using data fusion technology to integrate all the collected data into multi-dimensional graph structure data;

[0120] In this implementation, S2 specifically includes:

[0121] S21, using data fusion technology to integrate the data collected in step S11, and construct an initialization graph of multi-dimensional graph structure data:

[0122] G = (V, E);

[0123] Where V represents a node set, each node v∈V represents a unique bank account, E represents an edge set, and each edge e∈E represents a transaction relationship between two accounts;

[0124] S22. Assign feature vector v to each node v feat , feature vector fusion account number A id , Behavioral characteristic data of account holders B fd And the account's social network data S rn , the feature vector v of node v feat The construction formula is:

[0125] v feat =w 1 Embed(A id )+w 2 ·Norm(B fd )+w 3 Encode(S rn );

[0126] Among them, v feat The final generated node feature vector is used to represent the comprehensive characteristics of each account in the bank transaction network. id) indicates account number A id The vector obtained by the embedding layer is used to transform the discrete characteristics of the account number into a continuous feature vector. Norm(B fd ) represents the behavioral characteristic data B of the account holder fd Perform Z-score standardization to convert behavioral characteristics of different scales into comparable values. Encode (S rn ) represents the social relationship network data S between accounts rn Apply graph embedding algorithm to transform the social network structure into vector form, w 1 、w 2 、w 3 are weight coefficients, A id Represents the account number, which is used to uniquely identify each account. fd It represents the behavioral characteristics of the account holder, including login frequency and transaction habits, reflecting the transaction behavior pattern of the account holder. rn Represents the social relationship network data between accounts, describing the transaction relationship and social connection between accounts;

[0127] S23. Assign attributes to each edge e in the graph, including the transaction amount T am , Trading time T tm , Transaction counterparty information T pi and the geographic information data G of the transaction location li , the attribute representation formula of the edge is:

[0128] e attr =α·f am (T am )+β·f tm (T tm )+γ·f pi (T pi )+δ·f li (G li );

[0129] Among them, α, β, γ and δ weight coefficients, f am (T am ) represents the conversion function of the transaction amount, which makes the effect of the amount on the result reasonable, f tm (T tm ) represents the conversion function of transaction time, which converts time into the time difference from a reference point, f pi (T pi ) represents the conversion function of the counterparty information, which is encoded based on the counterparty’s risk level, f li (G li) represents a conversion function of the geographical information of the transaction location, converting the geographical coordinates into some form of geographical risk score;

[0130] S24. Define the spatiotemporal relationship evaluation function Phi to measure the spatiotemporal similarity of transaction behaviors, combining the transaction time difference and geographical distance.

[0131] Phi(e)=λ·exp(-σ t ΔT e )+(1-λ)·exp(-σ g ΔG e );

[0132] Where, ΔT e represents the time difference between the two transaction nodes connected by edge e, ΔG e represents the Euclidean distance between the geographical locations of corresponding transactions, σ t and σ g are scaling parameters of time and geographic information, respectively, used to adjust the influence of time difference and geographic distance on similarity, and λ is the balance coefficient;

[0133] S25, based on the spatiotemporal relationship evaluation function Phi, dynamically adjust the weights of the edges in the graph. For each edge e, its weight w e Updated to:

[0134]

[0135] in, is the original weight of edge e, which is usually calculated based on the transaction amount or other static attributes. The updated weight w e Integrate the temporal and spatial characteristics of transactions to reflect the actual situation and potential risks of transaction behaviors;

[0136] S26. Using the updated edge weights, re-evaluate the centrality and community structure of the nodes in the graph, use spectral clustering to identify potential money laundering clusters, and reveal the network characteristics and evolution trends of money laundering behavior by analyzing the centrality changes and community dynamics of the nodes;

[0137] S27. Incorporate spatiotemporal dynamic characteristics into the training process of the graph neural network model. Through the spatiotemporal-aware graph neural network layer, the model can learn the dynamic spatiotemporal patterns of trading behaviors.

[0138] S3. Construct an enhanced transaction network graph based on multi-dimensional graph structure data, use the t-distributed random neighborhood embedding algorithm to initialize node feature vectors, define edge weights based on transaction behaviors and their geographic locations, and consider the spatiotemporal relationship between transactions;

[0139] In this implementation, S3 specifically includes:

[0140] S31. After completing the construction of the multi-dimensional graph structure data, the node feature vector is initialized using the t-distributed random neighborhood embedding algorithm. The node feature vector initialization is to capture the microscopic characteristics of bank accounts in the transaction network and the potential associations between accounts. For each node v∈V in the graph G=(V,E), its initial feature vector Transformed by the t-SNE algorithm, the t-SNE algorithm maintains the local similarity between accounts in the high-dimensional feature space through dimensionality reduction:

[0141]

[0142] S32. Define an edge weight update function to dynamically adjust the weight of each edge according to the transaction amount, transaction time, and geographic information data of the transaction location:

[0143]

[0144] Among them, Norm(T am ) is the standardized value of the transaction amount, TimeFactor(T tm ) and GeoFactor(G li ) are weighting factors for transaction time and geographical location, respectively, and α, β and γ are weight parameters;

[0145] S33. Combined with the spatiotemporal relationship between transactions, the spatiotemporal relationship evaluation function is used to adjust the weight of each edge to identify transaction patterns that are abnormally concentrated in time and space:

[0146] Φ(e)=λ·exp(σ t ΔT e )+(1+λ)·exp(σ g ΔG e );

[0147] Where, ΔT e and ΔG e Represent the time difference and geographical distance respectively, σ t and σ g is the decay parameter, λ adjusts the importance of temporal and spatial factors;

[0148] S34. Use the updated node feature vectors and edge weights to construct an enhanced transaction network diagram, incorporating the basic attributes of transactions and the spatiotemporal characteristics of transaction behaviors:

[0149]

[0150] S35. Apply the node feature vector optimized by the t-SNE algorithm and the edge weight considering the spatiotemporal relationship to recalculate the importance of the nodes in the graph, including the degree centrality and closeness centrality indicators, as well as the community structure:

[0151] Centrality(v)=CalculateCentrality(G enhanced ,v);

[0152] CommunityStructure=SpectralClustering(G enhanced );

[0153] Among them, CalculateCentrality means calculating the centrality index of the node in the enhanced graph, and SpectralClustering means performing community division based on the spectral characteristics of the graph to reveal clusters of potential money laundering activities.

[0154] S4. Use a deep graph neural network model to conduct in-depth learning on the enhanced transaction network graph. The deep graph neural network model uses node classification, graph classification or edge prediction technology to optimize the money laundering pattern in the bank transaction network and identify hidden money laundering behavior;

[0155] In this implementation, S4 specifically includes:

[0156] S41. Select deep graph neural network architecture and process node feature vectors and the dynamic weights of the edges Capturing patterns and relationships in transaction networks;

[0157] S42, applying node classification technology, each node v is assigned a label l v , indicating its potential risk level:

[0158]

[0159] Among them, L is the loss function, y v is the true label of node v, is the label predicted by the model, and θ represents the model parameters;

[0160] S43. Use graph classification technology to classify the entire transaction network graph as normal or suspicious:

[0161]

[0162] Among them, Y is the true classification of the image, including normal or suspicious, is the classification predicted by the model based on the features of the entire graph;

[0163] S44. Using edge prediction technology to identify abnormal transaction relationships that may indicate money laundering activities:

[0164]

[0165] where e uv is the real existence sign of edge (u,v), is the probability that the edge exists as predicted by the model.

[0166] S5. Use the trained deep graph neural network model to intelligently monitor and analyze new or ongoing transaction activities, introduce deep graph neural network model explanatory technology, identify potential money laundering activities, and provide possible reasons and logic for money laundering behavior;

[0167] In this implementation, S5 specifically includes:

[0168] S51. Deploy the trained deep graph neural network model in the bank transaction monitoring system to process new transaction data in real time or monitor ongoing transaction activities, analyze the nodes, edges and overall graph structure in the transaction network, and identify potential risks that match known money laundering behavior patterns;

[0169] S52 uses LIME technology to locally interpret the graph neural network model and analyze the specific reasons why the graph neural network model identifies potential money laundering activities. For each transaction or account node identified as suspicious by the graph neural network model, LIME approximates the local decision-making behavior of the graph neural network model at the transaction or node by generating an interpretable linear model.

[0170] S53. For transactions identified as suspicious by the model, the system automatically generates a detailed report including the key features of the transaction, the risk level predicted by the model, and an explanatory analysis of the possibility of money laundering:

[0171] RiskScore = f GNN (x;θ);

[0172] Among them, x represents the feature vector of the transaction, f GNN is a graph neural network model, θ represents the model parameters, and RiskScore represents the risk score of the transaction;

[0173] S54. Using the results of explanatory analysis, the bank's anti-money laundering team understands the specific reasons why a transaction is marked as suspicious, including abnormal transaction amounts, frequent small transactions, complex transaction network structures, or transaction relationships with accounts known to be high-risk.

[0174] In this implementation, S52 specifically includes:

[0175] S521. For a given suspicious transaction or account node v, select its feature vector v feat As the explanation target, a new local dataset is constructed. The local dataset includes the feature vector of v and its neighbor node features in the graph neural network model to simulate the local decision-making environment.

[0176] S522, on the local data set, by randomly perturbing v feat Generate a new set of samples, each of which represents a possible transaction or account status change. For each sample, use the graph neural network model to calculate its corresponding risk score;

[0177] S523. Based on the generated samples and their graph neural network model outputs, a linear regression model is trained to approximate the local decision-making behavior of the graph neural network model at v:

[0178]

[0179] Where N is the number of generated samples, π(v,v i ) is a kernel function that measures the difference between the original node v and the generated sample v i The similarity between GNN (v i ) is the graph neural network model for sample v i The output, is the sample v i The eigenvector of

[0180] S524. Use the trained linear model to explain the decision-making basis of the graph neural network model in v and reveal the key factors behind potential money laundering behavior.

[0181] S6. Based on the monitoring results in step S5, the graph neural network model is continuously optimized and updated using a real-time feedback loop and a topic-aware adaptive mechanism;

[0182] In this implementation, S6 specifically includes:

[0183] S61. Establish a real-time feedback loop mechanism to automatically collect the monitoring results of the graph neural network model on actual bank transaction data, including correctly identified cases and false positives or omissions;

[0184] S62. Analyze monitoring results to identify specific areas where model performance is insufficient, including insufficient identification of certain types of money laundering or inadequate treatment of certain transaction characteristics;

[0185] S63. Use a topic-aware adaptive mechanism based on monitoring results analysis to dynamically adjust the parameters and structure of the graph neural network model, including adjusting the learning rate of the model, increasing or decreasing the number of network layers, modifying the activation function, or optimizing the loss function;

[0186] S64. Utilize newly collected transaction data and feedback information to continuously train and update the graph neural network model, and use incremental learning technology to adapt the graph neural network model to new money laundering techniques and transaction patterns;

[0187] S65. Implement a topic-aware adaptive mechanism to automatically identify and integrate relevant topics or patterns based on emerging patterns and trends in transaction data, discover new money laundering strategies or risk factors through cluster analysis of transaction data, and then use this newly discovered information to adjust and optimize the graph neural network model;

[0188] S66. The updated graph neural network model is redeployed in the bank transaction monitoring system.

[0189] S7. Based on the monitoring results in step S5, generate a report including risk level assessment, potential money laundering accounts and transaction pattern reports.

[0190] By adopting the solution provided in this application, data is collected from the bank's transaction database, and all the collected data is integrated into multi-dimensional graph structure data using data fusion technology. An enhanced transaction network graph is constructed based on the multi-dimensional graph structure data, and a deep graph neural network model is used to conduct in-depth learning of the enhanced transaction network graph. The trained deep graph neural network model is used to intelligently monitor and analyze new or ongoing transaction activities. Based on the monitoring results, the graph neural network model is continuously optimized and updated using a real-time feedback loop and a topic-aware adaptive mechanism to generate a report. Therefore, the above technical solution, by introducing a deep graph neural network model, can take into account the complexity and dynamics of the transaction network, identify money laundering behaviors more accurately, reduce false alarms and improve the detection rate of real money laundering behaviors. The real-time feedback loop and topic-aware adaptive mechanism ensure that the monitoring system can continuously learn and adapt to new money laundering methods and transaction patterns, so that the monitoring system can not only respond to current money laundering strategies, but also prevent possible money laundering activities in the future. By introducing model explanatory technology, it can provide detailed explanations as to why a transaction or account is marked as suspicious, which increases the transparency of the monitoring process and provides valuable insights for the bank's anti-money laundering team, helping them to conduct subsequent investigations and decisions more effectively.

[0191] In order to more clearly introduce the technical solution of the present application, another specific implementation method is introduced below to help understand the solution disclosed in the present application:

[0192] In order to study its feasibility, the present invention implements the method of the present invention in a large bank located in an international financial center. The bank processes millions of transactions on a daily basis, and these transactions come from individuals and enterprises around the world. The bank needs to ensure that its trading platform is not used for money laundering activities, while also avoiding interference with normal transactions. In this case, the traditional AML method has a high false alarm rate and low adaptability, which causes the bank to invest a lot of manpower and material resources in transaction review, which not only increases the bank's operating costs, but also affects the customer experience.

[0193] First, the bank collects transaction data from the transaction database, including account number, transaction amount, transaction time, and transaction counterparty information. It also collects behavioral characteristic data of account holders, social relationship network data between accounts, and geographic information data of transaction locations. Then, the bank uses data fusion technology to integrate these multi-source data into multi-dimensional graph structure data, where nodes represent transaction accounts and edges represent transaction behaviors between accounts. By constructing an enhanced transaction network graph and initializing node feature vectors using the t-distributed random neighborhood embedding algorithm, the bank can effectively identify complex money laundering patterns while maintaining the local structure of transaction data. On this basis, the bank uses a deep graph neural network model to learn the enhanced transaction network graph. By applying node classification, graph classification, and edge prediction techniques, the model can identify potential money laundering behaviors and provide possible causes and logic of money laundering behaviors through model explanatory techniques.

[0194]

[0195] Table 1 Comparison of anti-money laundering monitoring performance of banks

[0196] Referring to Table 1 above, after implementing the method of the present invention, the bank evaluated its transaction monitoring system in the past year (2023). Before implementation, the false alarm rate of the bank's AML system was 10.36%, that is, 10.36 out of every 100 alarms were false alarms of normal transactions. After implementing the method of the present invention, the false alarm rate was reduced to 1.36%, greatly reducing the interference with normal transactions, while improving the recognition rate of money laundering behavior.

[0197] In addition, by introducing a real-time feedback loop and a topic-aware adaptive mechanism, the bank was able to continuously optimize and update the graph neural network model. In 2023, the bank monitored 20.36% more money laundering activities than in 2022, but by using the method of the present invention, the bank was able to successfully identify 95.24% of them. In contrast, when using traditional AML methods in 2022, the identification rate was only 75.54%.

[0198] The present invention introduces a deep graph neural network model that takes into account the complexity and dynamics of the transaction network and can more accurately identify money laundering behavior. Compared with traditional rule-based systems or shallow machine learning models, the graph neural network model can learn and capture deep patterns and relationships in transaction data, significantly reducing false positives while increasing the detection rate of real money laundering behavior.

[0199] based on Figure 1 The bank anti-money laundering monitoring method based on graph neural network is shown in FIG. On the other hand, it also relates to a bank anti-money laundering monitoring system based on graph neural network, and its structure is as follows Figure 2 As shown, including:

[0200] The data collection module 201 is used to collect account number data, transaction amount data, transaction time data and transaction counterparty information data from the bank's transaction database, and also collects account holder's behavior characteristic data, social relationship network data between accounts and geographic information data of transaction locations;

[0201] The data integration module 202 is used to integrate all the collected data into multi-dimensional graph structure data using data fusion technology;

[0202] The transaction network graph construction module 203 is used to construct an enhanced transaction network graph based on the multi-dimensional graph structure data, initialize the node feature vector using the t-distribution random neighborhood embedding algorithm, define the weight of the edge according to the transaction behavior and its geographical location, and consider the spatiotemporal relationship between transactions;

[0203] An optimization module 204 is used to perform in-depth learning on the enhanced transaction network graph using a deep graph neural network model, where the deep graph neural network model uses node classification, graph classification or edge prediction technology to optimize the money laundering pattern in the bank transaction network and identify hidden money laundering behaviors;

[0204] Monitoring module 205 uses the trained deep graph neural network model to intelligently monitor and analyze new or ongoing transaction activities, introduces deep graph neural network model explanatory technology, identifies potential money laundering activities, and provides possible reasons and logic for money laundering behavior;

[0205] An updating module 206, used to continuously optimize and update the graph neural network model using a real-time feedback loop and a topic-aware adaptive mechanism according to the monitoring results of the monitoring module 205;

[0206] The report generation module 207 is used to generate a report including risk level assessment, potential money laundering accounts and transaction pattern reports according to the monitoring results of the monitoring module 205.

[0207] Furthermore, the data collection module 201 is also used for:

[0208] Define the transaction dataset:

[0209] D={D 1 ,D 2 ,...,D n};

[0210] Among them, D i Represents the data of the i-th transaction;

[0211] For each transaction D i , collect data including account number A id , transaction amount T am, Trading time T tm , Transaction counterparty information T pi , Behavioral characteristic data of account holders B fd , social relationship network data S between accounts rn and the geographic information data G of the transaction location li ;

[0212] Behavioral characteristic data of account holders B fd Collect information on login frequency, transaction habits and transaction preferences to capture the behavior patterns of account holders;

[0213] By analyzing the transaction frequency, transaction amount and transaction time factors between accounts, social relationship network data S is constructed rn , identify potential relationships between accounts;

[0214] Geographic information data of transaction locations li Includes the specific location coordinates where the transaction occurred, which is used to analyze the geographical distribution characteristics of transaction activities.

[0215] Furthermore, the data integration module 202 is also used for:

[0216] The data collected in step S11 is integrated using data fusion technology to construct an initialization graph of multi-dimensional graph structure data:

[0217] G = (V, E);

[0218] Where V represents a node set, each node v∈V represents a unique bank account, E represents an edge set, and each edge e∈E represents a transaction relationship between two accounts;

[0219] Assign feature vector v to each node v feat , feature vector fusion account number A id , Behavioral characteristic data of account holders B fd And the account's social network data S rn , the feature vector v of node v feat The construction formula is:

[0220] v feat =w 1 Embed(A id )+w 2 ·Norm(B fd )+w 3 Encode(S rn );

[0221] Among them, v featThe final generated node feature vector is used to represent the comprehensive characteristics of each account in the bank transaction network. id ) indicates account number A id The vector obtained by the embedding layer is used to transform the discrete characteristics of the account number into a continuous feature vector. Norm(B fd ) represents the behavioral characteristic data B of the account holder fd Perform Z-score standardization to convert behavioral characteristics of different scales into comparable values. Encode (S rn ) represents the social relationship network data S between accounts rn Apply graph embedding algorithm to transform the social network structure into vector form, w 1 、w 2 、w 3 are weight coefficients, A id Represents the account number, which is used to uniquely identify each account. fd It represents the behavioral characteristics of the account holder, including login frequency and transaction habits, reflecting the transaction behavior pattern of the account holder. rn Represents the social relationship network data between accounts, describing the transaction relationship and social connection between accounts;

[0222] Assign attributes to each edge e in the graph, including the transaction amount T am , Trading time T tm , Transaction counterparty information T pi and the geographic information data G of the transaction location li , the attribute representation formula of the edge is:

[0223] e attr =α·f am (T am )+β·f tm (T tm )+γ·f pi (T pi )+δ·f li (G li );

[0224] Among them, α, β, γ and δ weight coefficients, f am (T am ) represents the conversion function of the transaction amount, which makes the effect of the amount on the result reasonable, f tm (T tm ) represents the conversion function of transaction time, which converts time into the time difference from a reference point, f pi (T pi ) represents the conversion function of the counterparty information, which is encoded based on the counterparty’s risk level, fli (G li ) represents a conversion function of the geographical information of the transaction location, converting the geographical coordinates into some form of geographical risk score;

[0225] Define the spatiotemporal relationship evaluation function Phi to measure the spatiotemporal similarity of transaction behaviors, combining the transaction time difference and geographical distance.

[0226] Phi(e)=λ·exp(-σ t ΔT e )+(1-λ)·exp(-σ g ΔG e );

[0227] Where, ΔT e represents the time difference between the two transaction nodes connected by edge e, ΔG e represents the Euclidean distance between the geographical locations of corresponding transactions, σ t and σ g are scaling parameters of time and geographic information, respectively, used to adjust the influence of time difference and geographic distance on similarity, and λ is the balance coefficient;

[0228] Based on the spatiotemporal relationship evaluation function Phi, the weights of the edges in the graph are dynamically adjusted. For each edge e, its weight w e Updated to:

[0229]

[0230] in, is the original weight of edge e, which is usually calculated based on the transaction amount or other static attributes. The updated weight w e Integrate the temporal and spatial characteristics of transactions to reflect the actual situation and potential risks of transaction behaviors;

[0231] Using the updated edge weights, we re-evaluate the centrality and community structure of the nodes in the graph, and use spectral clustering to identify potential money laundering clusters. By analyzing the changes in the centrality of nodes and community dynamics, we reveal the network characteristics and evolution trends of money laundering behavior.

[0232] The spatiotemporal dynamic characteristics are integrated into the training process of the graph neural network model. Through the spatiotemporal-aware graph neural network layer, the model can learn the dynamic spatiotemporal patterns of trading behaviors.

[0233] Furthermore, the transaction network diagram construction module 203 is also used for:

[0234] After completing the construction of the multi-dimensional graph structure data, the t-distributed random neighborhood embedding algorithm is used to initialize the node feature vector. The node feature vector initialization is to capture the microscopic characteristics of bank accounts in the transaction network and the potential associations between accounts. For each node v∈V in the graph G=(V,E), its initial feature vector Transformed by the t-SNE algorithm, the t-SNE algorithm maintains the local similarity between accounts in the high-dimensional feature space through dimensionality reduction:

[0235]

[0236] Define the edge weight update function to dynamically adjust the weight of each edge based on the transaction amount, transaction time, and geographic information data of the transaction location:

[0237]

[0238] Among them, Norm(T am ) is the standardized value of the transaction amount, TimeFactor(T tm ) and GeoFactor(G li ) are weighting factors for transaction time and geographical location, respectively, and α, β and γ are weight parameters;

[0239] Combined with the spatiotemporal relationship between transactions, the spatiotemporal relationship evaluation function is used to adjust the weight of each edge to identify transaction patterns that are abnormally concentrated in time and space:

[0240] Φ(e)=λ·exp(σ t ΔT e )+(1+λ)·exp(σ g ΔG e );

[0241] Where, ΔT e and ΔG e Represent the time difference and geographical distance respectively, σ t and σ g is the decay parameter, λ adjusts the importance of temporal and spatial factors;

[0242] Using the updated node feature vectors and edge weights, an enhanced transaction network graph is constructed, incorporating the basic attributes of transactions and the spatiotemporal characteristics of transaction behaviors:

[0243]

[0244] Apply the node feature vector optimized by the t-SNE algorithm and the edge weight considering the spatiotemporal relationship to recalculate the importance of the nodes in the graph, including the degree centrality and closeness centrality indicators, as well as the community structure:

[0245] Centrality(v)=CalculateCentrality(G enhanced ,v);

[0246] CommunityStructure=SpectralClustering(G enhanced );

[0247] Among them, CalculateCentrality means calculating the centrality index of the node in the enhanced graph, and SpectralClustering means performing community division based on the spectral characteristics of the graph to reveal clusters of potential money laundering activities.

[0248] Furthermore, the optimization module 204 is also used for:

[0249] Selecting a deep graph neural network architecture and processing node feature vectors and the dynamic weights of the edges Capturing patterns and relationships in transaction networks;

[0250] Applying node classification techniques, each node v is assigned a label l v , indicating its potential risk level:

[0251]

[0252] Among them, L is the loss function, y v is the true label of node v, is the label predicted by the model, and θ represents the model parameters;

[0253] Graph classification technology is used to classify the entire transaction network graph as normal or suspicious:

[0254]

[0255] Among them, Y is the true classification of the image, including normal or suspicious, is the classification predicted by the model based on the features of the entire graph;

[0256] Using edge prediction techniques to identify unusual transaction relationships that may indicate money laundering activities:

[0257]

[0258] where e uv is the real existence sign of edge (u,v), is the probability that the edge exists as predicted by the model.

[0259] Furthermore, the monitoring module 205 is also used for:

[0260] Deploy the trained deep graph neural network model in the bank's transaction monitoring system to process new transaction data in real time or monitor ongoing transaction activities, analyze the nodes, edges and overall graph structure in the transaction network, and identify potential risks that match known money laundering behavior patterns;

[0261] LIME technology is used to locally interpret the graph neural network model and analyze the specific reasons why the graph neural network model identifies potential money laundering activities. For each transaction or account node identified as suspicious by the graph neural network model, LIME approximates the local decision-making behavior of the graph neural network model in the transaction or node by generating an interpretable linear model;

[0262] For a given suspicious transaction or account node v, select its feature vector v feat As the explanation target, a new local dataset is constructed. The local dataset includes the feature vector of v and its neighbor node features in the graph neural network model to simulate the local decision-making environment.

[0263] On the local data set, by randomly perturbing v feat Generate a new set of samples, each of which represents a possible transaction or account status change. For each sample, use the graph neural network model to calculate its corresponding risk score;

[0264] Based on the generated samples and their graph neural network model outputs, a linear regression model is trained to approximate the local decision-making behavior of the graph neural network model at v:

[0265]

[0266] Where N is the number of generated samples, π(v,v i ) is a kernel function that measures the difference between the original node v and the generated sample v i The similarity between GNN (v i ) is the graph neural network model for sample v i The output, is the sample v i The eigenvector of

[0267] Using the trained linear model, we explain the decision-making basis of the graph neural network model in v and reveal the key factors behind potential money laundering behavior.

[0268] For transactions that the model identifies as suspicious, the system automatically generates a detailed report that includes the key characteristics of the transaction, the risk level predicted by the model, and an explanatory analysis of the possibility of money laundering:

[0269] RiskScore = f GNN (x;θ);

[0270] Among them, x represents the feature vector of the transaction, f GNN is a graph neural network model, θ represents the model parameters, and RiskScore represents the risk score of the transaction;

[0271] Using the results of interpretive analysis, the bank's anti-money laundering team understands the specific reasons why a transaction was marked as suspicious, including unusual transaction amounts, frequent small transactions, complex transaction network structures, or transaction relationships with accounts known to be high-risk.

[0272] Furthermore, the updating module 206 is further configured to:

[0273] Establish a real-time feedback loop mechanism to automatically collect the monitoring results of the graph neural network model on actual bank transaction data, including correctly identified cases and false positives or omissions;

[0274] Analyze monitoring results to identify specific areas where model performance is insufficient, including insufficient identification of certain types of money laundering or inadequate treatment of certain transaction characteristics;

[0275] Adopt a topic-aware adaptive mechanism based on monitoring results analysis to dynamically adjust the parameters and structure of the graph neural network model, including adjusting the learning rate of the model, increasing or decreasing the number of network layers, modifying the activation function, or optimizing the loss function;

[0276] Utilize newly collected transaction data and feedback information to continuously train and update the graph neural network model, and use incremental learning technology to adapt the graph neural network model to new money laundering techniques and transaction patterns;

[0277] Implement a topic-aware adaptive mechanism to automatically identify and integrate relevant topics or patterns based on emerging patterns and trends in transaction data, discover new money laundering strategies or risk factors through cluster analysis of transaction data, and then use this newly discovered information to adjust and optimize the graph neural network model;

[0278] The updated graph neural network model was redeployed in the bank transaction monitoring system.

[0279] An embodiment of the present invention further provides an electronic device for executing the above method, as an implementation device of the method, comprising a processor and a memory;

[0280] A memory, used for storing operation instructions;

[0281] The processor is used to execute the bank anti-money laundering monitoring method based on graph neural network provided in any embodiment of the present application by calling operation instructions.

[0282] As an example, Figure 3A schematic diagram of the structure of an electronic device applicable to an embodiment of the present application is shown, and the electronic device 300 includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one. It is understandable that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the specific structure of the electronic device 300. In other embodiments of the present application, the electronic device 300 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware. Optionally, the electronic device may also include a display screen 305 for displaying images, or receiving user operation instructions when necessary.

[0283] The processor 301 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 304 may include a receiver and a transmitter. The transceiver 304 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0284] Processor 301 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0285] The processor 301 may also include one or more processing units, for example, the processor 301 may include an application processor (AP), a modem processor, a graphics processor (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural network processor (NPU). Different processing units may be independent devices or integrated into one or more processors. Among them, the controller may be the nerve center and command center of the electronic device 300. The controller may generate an operation control signal according to the instruction opcode and the timing signal to complete the control of fetching and executing instructions. A memory may also be provided in the processor 301 for storing instructions and data. In some embodiments, the memory in the processor 301 is a high-speed cache memory. The memory may store instructions or data that the processor 301 has just used or circulated. If the processor 301 needs to use the instruction or data again, it may be directly called from the memory. Repeated access is avoided, the waiting time of the processor 301 is reduced, and the efficiency of the system is improved.

[0286] The processor 301 can run the bank anti-money laundering monitoring method based on graph neural network provided in the embodiment of the present application. The processor 301 may include different devices. For example, when integrating CPU and GPU, the CPU and GPU can cooperate to execute the bank anti-money laundering monitoring method based on graph neural network provided in the embodiment of the present application. Part of the algorithm is executed by the CPU, and the other part of the algorithm is executed by the GPU to obtain faster processing efficiency.

[0287] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0288] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory), or may include a high-speed random access memory, or may include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to this.

[0289] Optionally, the memory 303 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the bank anti-money laundering monitoring method based on graph neural network provided in any embodiment of the present application.

[0290] The memory 303 can be used to store computer executable program codes, which include instructions. The processor 301 executes various functional applications and data processing of the electronic device 300 by running the instructions stored in the memory 303. The memory 303 may include a program storage area and a data storage area. Among them, the program storage area may store the code of the operating system, application program, etc. The data storage area may store data created during the use of the electronic device 300 (such as images, videos, etc. collected by the camera application), etc.

[0291] The memory 303 may also store one or more computer programs corresponding to the bank anti-money laundering monitoring method based on graph neural network provided in the embodiment of the present application. The one or more computer programs are stored in the above-mentioned memory 303 and are configured to be executed by the one or more processors 301. The one or more computer programs include instructions, and the above-mentioned instructions can be used to execute each step in the above-mentioned corresponding embodiment.

[0292] Of course, the code of the bank anti-money laundering monitoring method based on graph neural network provided in the embodiment of the present application can also be stored in an external memory.

[0293] The display screen 305 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the electronic device 300 may include 1 or N display screens 305, where N is a positive integer greater than 1. The display screen 305 can be used to display information input by a user or information provided to a user and various graphical user interfaces (GUI). For example, the display screen 305 can display photos, videos, web pages, or files.

[0294] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding method provided above, which will not be repeated here.

[0295] An embodiment of the present invention also provides a computer-readable storage medium capable of implementing all the steps in the method in the above embodiment, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps in the method in the above embodiment are implemented.

[0296] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0297] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0298] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction system, which is implemented in the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0299] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0300] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A bank anti-money laundering monitoring method based on graph neural network, characterized in that: The following steps are involved: S1. Collect account number data, transaction amount data, transaction time data and transaction counterparty information data from the bank's transaction database, and additionally collect account holder's behavioral characteristics data, social relationship network data between accounts and geographic information data of transaction locations; S2, using data fusion technology to integrate all the collected data into multi-dimensional graph structure data; S3. Construct an enhanced transaction network graph based on multi-dimensional graph structure data, use the t-distributed random neighborhood embedding algorithm to initialize node feature vectors, define edge weights based on transaction behaviors and their geographic locations, and consider the spatiotemporal relationship between transactions; S4. Use a deep graph neural network model to conduct in-depth learning on the enhanced transaction network graph. The deep graph neural network model uses node classification, graph classification or edge prediction technology to optimize the money laundering pattern in the bank transaction network and identify hidden money laundering behavior; S5. Use the trained deep graph neural network model to intelligently monitor and analyze new or ongoing transaction activities, introduce deep graph neural network model explanatory technology, identify potential money laundering activities, and provide possible reasons and logic for money laundering behavior; S6. Based on the monitoring results in step S5, the graph neural network model is continuously optimized and updated using a real-time feedback loop and a topic-aware adaptive mechanism; S7. Based on the monitoring results in step S5, generate a report including risk level assessment, potential money laundering accounts and transaction pattern reports.

2. A bank anti-money laundering monitoring method based on graph neural network according to claim 1, characterized in that: The S1 specifically includes: S11. Define transaction data set: D={D1,D2,...,D n }; Among them, D i Represents the data of the i-th transaction; For each transaction D i , collect data including account number A id , transaction amount T am , Trading time T tm , Transaction counterparty information T pi , Account holder’s behavioral characteristics data B fd , social relationship network data S between accounts rn and the geographic information data G of the transaction location li ; S12. Behavioral characteristic data B of the account holder fd Collect information on login frequency, transaction habits and transaction preferences to capture the behavior patterns of account holders; S13. Construct social relationship network data by analyzing transaction frequency, transaction amount and transaction time factors between accounts rn , identify potential relationships between accounts; S14. Geographic information data G of transaction location li Includes the specific location coordinates where the transaction occurred, which is used to analyze the geographical distribution characteristics of transaction activities.

3. A bank anti-money laundering monitoring method based on graph neural network according to claim 2, characterized in that: The S2 specifically includes: S21, using data fusion technology to integrate the data collected in step S11, and construct an initialization graph of multi-dimensional graph structure data: G = (V, E); Where V represents a node set, each node v∈V represents a unique bank account, E represents an edge set, and each edge e∈E represents a transaction relationship between two accounts; S22. Assign feature vector v to each node v feat , feature vector fusion account number A id , Account holder’s behavioral characteristics data B fd And the account's social network data S rn , the feature vector v of node v feat The construction formula is: v feat =w1·Embed(A id )+w2·Norm(B fd )+w3·Encode(S rn ); Among them, v feat The final generated node feature vector is used to represent the comprehensive characteristics of each account in the bank transaction network. id ) indicates account number A id The vector obtained by the embedding layer is used to transform the discrete characteristics of the account number into a continuous feature vector. Norm(B fd ) represents the behavioral characteristic data B of the account holder fd Perform Z-score standardization to convert behavioral characteristics of different scales into comparable values. Encode (S rn ) represents the social relationship network data S between accounts rn Apply graph embedding algorithm to transform the social network structure into vector form, where w1, w2, and w3 are weight coefficients respectively, and A id Represents the account number, which is used to uniquely identify each account. fd It represents the behavioral characteristics of the account holder, including login frequency and transaction habits, reflecting the transaction behavior pattern of the account holder. rn Represents the social relationship network data between accounts, describing the transaction relationship and social connection between accounts; S23. Assign attributes to each edge e in the graph, including the transaction amount T am , Trading time T tm , Transaction counterparty information T pi and the geographic information data G of the transaction location li , the edge attribute representation formula is: e attr =α·f am (T am )+β·f tm (T tm )+γ·f pi (T pi )+δ·f li (G li ); Among them, α, β, γ and δ weight coefficients, f am (T am ) represents the conversion function of the transaction amount, which makes the effect of the amount on the result reasonable, f tm (T tm ) represents the conversion function of transaction time, which converts time into the time difference from a reference point, f pi (T pi ) represents the conversion function of the counterparty information, which is encoded based on the counterparty’s risk level, f li (G li ) represents a conversion function of the geographical information of the transaction location, converting the geographical coordinates into some form of geographical risk score; S24. Define the spatiotemporal relationship evaluation function Phi to measure the spatiotemporal similarity of transaction behaviors, combining the transaction time difference and geographical distance. Phi(e)=λ·exp(-σ t ·ΔT e )+(1-λ)·exp(-σ g ·ΔG e ); Where, ΔT e represents the time difference between the two transaction nodes connected by edge e, ΔG e represents the Euclidean distance between the geographical locations of corresponding transactions, σ t and σ g are scaling parameters of time and geographic information, respectively, used to adjust the influence of time difference and geographic distance on similarity, and λ is the balance coefficient; S25, based on the spatiotemporal relationship evaluation function Phi, dynamically adjust the weights of the edges in the graph. For each edge e, its weight w e Updated to: in, is the original weight of edge e, which is usually calculated based on the transaction amount or other static attributes. The updated weight w e Integrate the temporal and spatial characteristics of transactions to reflect the actual situation and potential risks of transaction behaviors; S26. Using the updated edge weights, re-evaluate the centrality and community structure of the nodes in the graph, use spectral clustering to identify potential money laundering clusters, and reveal the network characteristics and evolution trends of money laundering behavior by analyzing the centrality changes and community dynamics of the nodes; S27. Incorporate spatiotemporal dynamic characteristics into the training process of the graph neural network model. Through the spatiotemporal-aware graph neural network layer, the model can learn the dynamic spatiotemporal patterns of trading behaviors.

4. A bank anti-money laundering monitoring method based on graph neural network according to claim 3, characterized in that: The S3 specifically includes: S31. After completing the construction of the multi-dimensional graph structure data, the node feature vector is initialized using the t-distributed random neighborhood embedding algorithm. The node feature vector initialization is to capture the microscopic characteristics of bank accounts in the transaction network and the potential associations between accounts. For each node v∈V in the graph G=(V,E), its initial feature vector Transformed by the t-SNE algorithm, the t-SNE algorithm maintains the local similarity between accounts in the high-dimensional feature space through dimensionality reduction: S32. Define an edge weight update function to dynamically adjust the weight of each edge according to the transaction amount, transaction time, and geographic information data of the transaction location: Among them, Norm(T am ) is the standardized value of the transaction amount, TimeFactor(T tm ) and GeoFactor(G li ) are weighting factors for transaction time and geographical location, respectively, and α, β and γ are weight parameters; S33. Combined with the spatiotemporal relationship between transactions, the spatiotemporal relationship evaluation function is used to adjust the weight of each edge to identify transaction patterns that are abnormally concentrated in time and space: Φ(e)=λ·exp(σ t ·ΔT e )+(1+λ)·exp(σ g ·ΔG e ); Where, ΔT e and ΔG e Represent the time difference and geographical distance respectively, σ t and σ g is the decay parameter, λ adjusts the importance of temporal and spatial factors; S34. Use the updated node feature vectors and edge weights to construct an enhanced transaction network diagram, incorporating the basic attributes of transactions and the spatiotemporal characteristics of transaction behaviors: S35. Apply the node feature vector optimized by the t-SNE algorithm and the edge weight considering the spatiotemporal relationship to recalculate the importance of the nodes in the graph, including the degree centrality and closeness centrality indicators, as well as the community structure: Centrality(v)=CalculateCentrality(G enhanced ,v); CommunityStructure=SpectralClustering(G enhanced ); Among them, CalculateCentrality means calculating the centrality index of the node in the enhanced graph, and SpectralClustering means performing community division based on the spectral characteristics of the graph to reveal clusters of potential money laundering activities.

5. A bank anti-money laundering monitoring method based on graph neural network according to claim 4, characterized in that: The S4 specifically includes: S41. Select deep graph neural network architecture and process node feature vectors and the dynamic weights of the edges Capturing patterns and relationships in transaction networks; S42, applying node classification technology, each node v is assigned a label l v , indicating its potential risk level: Among them, L is the loss function, y v is the true label of node v, is the label predicted by the model, and θ represents the model parameters; S43. Use graph classification technology to classify the entire transaction network graph as normal or suspicious: Among them, Y is the true classification of the image, including normal or suspicious, is the classification predicted by the model based on the features of the entire graph; S44. Using edge prediction technology to identify abnormal transaction relationships that may indicate money laundering activities: where e uv is the real existence sign of edge (u,v), is the probability that the edge exists as predicted by the model.

6. A bank anti-money laundering monitoring method based on graph neural network according to claim 5, characterized in that: The S5 specifically includes: S51. Deploy the trained deep graph neural network model in the bank transaction monitoring system to process new transaction data in real time or monitor ongoing transaction activities, analyze the nodes, edges and overall graph structure in the transaction network, and identify potential risks that match known money laundering behavior patterns; S52. LIME technology is used to locally interpret the graph neural network model and analyze the specific reasons why the graph neural network model identifies potential money laundering activities. For each transaction or account node identified as suspicious by the graph neural network model, LIME approximates the local decision-making behavior of the graph neural network model at the transaction or node by generating an interpretable linear model. S53. For transactions identified as suspicious by the model, the system automatically generates a detailed report including the key features of the transaction, the risk level predicted by the model, and an explanatory analysis of the possibility of money laundering: RiskScore=f GNN (x;θ); Among them, x represents the feature vector of the transaction, f GNN is a graph neural network model, θ represents the model parameters, and RiskScore represents the risk score of the transaction; S54. Using the results of explanatory analysis, the bank's anti-money laundering team understands the specific reasons why a transaction is marked as suspicious, including abnormal transaction amounts, frequent small transactions, complex transaction network structures, or transaction relationships with accounts known to be high-risk.

7. A bank anti-money laundering monitoring method based on graph neural network according to claim 6, characterized in that: The S52 specifically includes: S521. For a given suspicious transaction or account node v, select its feature vector v feat As the explanation target, a new local dataset is constructed. The local dataset includes the feature vector of v and its neighbor node features in the graph neural network model to simulate the local decision-making environment. S522, on the local data set, by randomly perturbing v feat Generate a new set of samples, each of which represents a possible transaction or account status change. For each sample, use the graph neural network model to calculate its corresponding risk score; S523. Based on the generated samples and their graph neural network model outputs, a linear regression model is trained to approximate the local decision-making behavior of the graph neural network model at v: Where N is the number of generated samples, π(v,v i ) is a kernel function that measures the difference between the original node v and the generated sample v i The similarity between GNN (v i ) is the graph neural network model for sample v i The output, is the sample v i The eigenvector of S524. Use the trained linear model to explain the decision-making basis of the graph neural network model in v and reveal the key factors behind potential money laundering behavior.

8. A bank anti-money laundering monitoring method based on graph neural network according to claim 6, characterized in that: The S6 specifically includes: S61. Establish a real-time feedback loop mechanism to automatically collect the monitoring results of the graph neural network model on actual bank transaction data, including correctly identified cases and false positives or omissions; S62. Analyze monitoring results to identify specific areas where model performance is insufficient, including insufficient identification of certain types of money laundering or inadequate treatment of certain transaction characteristics; S63. Use a topic-aware adaptive mechanism based on monitoring results analysis to dynamically adjust the parameters and structure of the graph neural network model, including adjusting the learning rate of the model, increasing or decreasing the number of network layers, modifying the activation function, or optimizing the loss function; S64. Utilize newly collected transaction data and feedback information to continuously train and update the graph neural network model, and use incremental learning technology to adapt the graph neural network model to new money laundering techniques and transaction patterns; S65. Implement a topic-aware adaptive mechanism to automatically identify and integrate relevant topics or patterns based on emerging patterns and trends in transaction data, discover new money laundering strategies or risk factors through cluster analysis of transaction data, and then use this newly discovered information to adjust and optimize the graph neural network model; S66. The updated graph neural network model is redeployed in the bank transaction monitoring system.

9. A bank anti-money laundering monitoring system based on graph neural network, characterized in that: include: A data collection module is used to collect account number data, transaction amount data, transaction time data and transaction counterparty information data from the bank's transaction database, and also collects additional behavioral characteristic data of account holders, social relationship network data between accounts and geographic information data of transaction locations; The data integration module is used to integrate all the collected data into multi-dimensional graph structure data using data fusion technology; The transaction network graph construction module is used to construct an enhanced transaction network graph based on multi-dimensional graph structure data. It uses the t-distributed random neighborhood embedding algorithm to initialize node feature vectors, defines edge weights based on transaction behaviors and their geographic locations, and considers the spatiotemporal relationship between transactions. An optimization module for deep learning of enhanced transaction network graphs using a deep graph neural network model that uses node classification, graph classification, or edge prediction techniques to optimize money laundering patterns in bank transaction networks and identify hidden money laundering behaviors; The monitoring module uses the trained deep graph neural network model to intelligently monitor and analyze new or ongoing transaction activities, introduces deep graph neural network model explanatory technology, identifies potential money laundering activities, and provides possible reasons and logic for money laundering behavior; The update module is used to continuously optimize and update the graph neural network model based on the monitoring results of the monitoring module using a real-time feedback loop and a topic-aware adaptive mechanism; The report generation module is used to generate reports including risk level assessment, potential money laundering accounts and transaction pattern reports based on the monitoring results of the monitoring module.

10. An electronic device, characterized in that: including a processor and a memory; The memory is used to store operation instructions; The processor is used to execute the method according to any one of claims 1 to 8 by calling the operation instruction.

11. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images