Financial case fund flow traceability analysis method

Abstract

The invention relates to a financial case fund flow traceability analysis method, and belongs to the technical field of computer networks. According to the method, the social network analysis technology and the graph neural network technology are combined, and the advantages of the social network analysis technology and the graph neural network technology are comprehensively utilized to analyze and track the fund flow direction in the financial transaction network. According to social network analysis, key nodes and group structures in a transaction network are identified by calculating node centrality and community discovery; the graph neural network analysis further extracts complex transaction features and modes through a deep learning model, and identifies abnormal transaction behaviors. Besides, advanced graph neural network models such as a graph convolutional network and a graph attention network are utilized, parallel computing and distributed training technologies are combined, the model training process is efficient and has good expansibility, and the method adapts to processing requirements of large-scale financial transaction data.

Description

Technical Field

[0001] The present invention belongs to the field of computer network technology, and in particular relates to a method for tracing and analyzing the flow of funds in financial cases. Background Art

[0002] The fund flow tracing analysis of financial cases refers to the tracking and analysis of the flow path of the funds involved in the case to reveal the entire process from the source to the final destination of the funds, so as to find the hiding place and flow pattern of illegal funds, thereby providing strong evidence and support for recovering the stolen money and losses. The traditional fund flow tracing analysis method mainly relies on manual investigation and auditing, and restores the fund flow path through manual analysis of bank transaction records, payment platform data, exchange data, etc. However, this method is inefficient, easy to miss key information, and is incapable of coping with complex multi-level, multi-link financial transaction networks and multi-source heterogeneous financial data.

[0003] At present, the technical implementation methods of capital flow tracing analysis mainly include rule-based analysis, machine learning models and graph data analysis.

[0004] 1. Rule-based analysis methods rely on pre-set rules and conditions for transaction matching and pattern recognition, but this method has poor flexibility and is difficult to deal with complex and changing financial crimes.

[0005] 2. Machine learning models identify suspicious transactions by training classifiers or regression models. Although this improves analysis efficiency to a certain extent, it still faces problems such as difficulty in feature selection and insufficient model generalization ability.

[0006] 3. Graph data analysis technology regards the financial transaction network as a graph structure and analyzes it through the relationship between nodes and edges. However, traditional graph analysis methods have shortcomings such as high computational complexity and poor real-time performance when dealing with large-scale, dynamically changing transaction networks.

[0007] Therefore, how to select advanced and appropriate technologies to further improve the accuracy and efficiency of fund flow tracing analysis has become a hot topic and difficulty in the current research field of financial case handling. Summary of the invention

[0008] 1. Technical issues to be resolved

[0009] The technical problem to be solved by the present invention is how to provide a method for tracing and analyzing the flow of funds in financial cases, so as to solve the problem of selecting advanced and appropriate technologies to further improve the accuracy and efficiency of tracing and analyzing the flow of funds.

[0010] (II) Technical solution

[0011] In order to solve the above technical problems, the present invention proposes a method for tracing and analyzing the flow of funds in financial cases, which includes the following steps: data collection and preprocessing, transaction network construction, social network analysis, graph neural network analysis, and fund flow tracking;

[0012] Data collection and preprocessing steps are used to obtain transaction data related to financial cases from multiple data sources, clean and standardize the data, ensure the integrity and consistency of the data, and provide a high-quality data foundation for subsequent transaction network construction and analysis;

[0013] The transaction network construction step is used to convert the pre-processed financial transaction data into a structured network graph, and to achieve systematic management of the transaction network by constructing a relationship graph of nodes and edges;

[0014] The social network analysis step is used to identify the key paths and nodes of capital flow by analyzing the nodes and edges in the transaction network, revealing the community structure and potential abnormal transaction behaviors in the transaction network. This step uses social network analysis technology to conduct in-depth analysis of the constructed transaction network graph, providing valuable insights and clues to support the subsequent tracking of capital flows.

[0015] The graph neural network analysis step is used to use graph neural network technology to conduct deep learning analysis on the transaction network, extract transaction features, and identify complex transaction patterns and abnormal transaction behaviors. By efficiently extracting and learning features of network structure and node attributes, it is possible to deeply explore the implicit relationships and patterns in the transaction network.

[0016] The fund flow tracking step combines the results of the social network analysis step and the graph neural network analysis step to track the flow path of suspicious funds. This step uses graph search algorithms and comprehensive analysis of transaction data and network structure to generate a detailed fund flow path report to assist financial institutions and law enforcement agencies in taking effective actions to recover stolen money and prevent losses.

[0017] (III) Beneficial effects

[0018] The present invention proposes a method for tracing and analyzing the flow of funds in financial cases. The present invention comprehensively uses social network analysis and graph neural network technology to achieve efficient feature extraction and model training: The present invention combines social network analysis technology with graph neural network technology, and comprehensively uses the advantages of both to analyze and track the flow of funds in financial transaction networks. Social network analysis identifies key nodes and group structures in transaction networks by calculating node centrality and community discovery; graph neural network analysis further extracts complex transaction features and patterns and identifies abnormal transaction behaviors through deep learning models. In addition, by utilizing advanced graph neural network models such as graph convolutional networks and graph attention networks, combined with parallel computing and distributed training technologies, the model training process is efficient and has good scalability, which can meet the processing needs of large-scale financial transaction data.

[0019] The present invention accurately tracks and visualizes the capital flow path, and generates a detailed capital flow path report: In the capital flow path tracking link, the graph search algorithm is used to reveal the destination and flow pattern of funds in detail. The capital flow path diagram generated by the system uses visualization tools to intuitively display the flow process of funds from the source to the end point, identify key nodes and high-risk paths, and generate a detailed capital flow path report. The report allows users to deeply analyze and explore the capital flow path as needed, provides flexible screening and query functions, and provides specific action plans and basis for financial institutions and law enforcement agencies, greatly enhancing the insight and operability of suspicious capital flows. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The following is a general flow chart of the method for tracing and analyzing the flow of funds in financial cases of the present invention;

[0021] Figure 2 It is a composition diagram of the data collection and preprocessing process;

[0022] Figure 3 Build a composition diagram of the process for the transaction network;

[0023] Figure 4 A diagram of the components of the social network analysis process;

[0024] Figure 5 This is a composition diagram of the graph neural network analysis process;

[0025] Figure 6 This is a diagram showing the components of the funds flow tracking process. DETAILED DESCRIPTION

[0026] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0027] To solve the above problems, the present invention provides a method for tracing and analyzing the flow of funds in financial cases. The method integrates social network analysis and graph neural network technology, and combines the tracking and visualization of fund flow paths, so as to achieve in-depth analysis and anomaly detection of electronic data of financial funds, and improve the accuracy and efficiency of fund flow tracing.

[0028] The method of the present invention mainly includes five major processes: data collection and preprocessing, transaction network construction, social network analysis, graph neural network analysis, and fund flow tracking. Figure 1 Each process is introduced below.

[0029] 1. Data collection and preprocessing steps

[0030] The main function of the data collection and preprocessing steps is to obtain transaction data related to financial cases from multiple data sources, clean and standardize the data, ensure the integrity and consistency of the data, and provide a high-quality data foundation for subsequent transaction network construction and analysis.

[0031] The data collection and preprocessing steps include five parts: data collection, data cleaning, data standardization, data verification, and data storage. Figure 2 shown.

[0032] (1) Data Collection

[0033] The data collection sub-step obtains transaction data related to financial cases from a variety of financial data sources to ensure the comprehensiveness and accuracy of data collection.

[0034] In terms of technical implementation, transaction data from different financial institutions can be obtained in real time or regularly through technical means such as API interface, database connection and batch data import. By establishing connections with various data sources, the required data can be automatically extracted and preliminary format conversion and storage can be performed.

[0035] (2) Data cleaning

[0036] The data cleaning sub-step cleans and filters the raw transaction data collected from various data sources to provide high-quality analytical data.

[0037] In terms of technical implementation, based on data preprocessing technology, errors and redundancies in the data can be identified and corrected through deduplication, denoising and processing of missing values.

[0038] (3) Data standardization

[0039] The data standardization sub-step converts transaction data from different data sources into a consistent format and structure. By standardizing data fields, formats, and types, the differences between data sources are eliminated, allowing data to be seamlessly integrated and compared in subsequent analysis processes.

[0040] In terms of technical implementation, common data processing tools can be used to unify data fields, unify data formats, and convert data types. These standardized processing steps can be automated, and through a series of predefined rules and algorithms, the system can efficiently convert multi-source data into a unified format.

[0041] (4) Data Verification

[0042] The data verification sub-step ensures the integrity, consistency and accuracy of the data during data collection and preprocessing. Among them, integrity verification ensures that each transaction record contains all the required fields and information; consistency verification ensures that the information of the same account in different data sources is consistent; accuracy verification verifies the accuracy of the data through a series of verification rules and algorithms. Through comprehensive verification and validation of processed data, potential errors and problems can be discovered and corrected in a timely manner.

[0043] (5) Data storage

[0044] The data storage sub-step stores high-quality data that has been cleaned, standardized, and verified for persistent storage. It is responsible for managing the storage location and method of the data, providing a stable and reliable data foundation for subsequent transaction network construction and analysis.

[0045] In terms of technical implementation, distributed databases or distributed file systems, such as Hadoop HDFS, Apache Cassandra, or Amazon S3, are usually used to ensure the security and scalability of data storage.

[0046] 2. Trading network construction steps

[0047] The main function of the transaction network construction step is to convert the pre-processed financial transaction data into a structured network graph. This step achieves systematic management of the transaction network by constructing a relationship graph of nodes and edges.

[0048] The steps of building a transaction network include four parts: node construction, edge construction, weighted processing, storage and management. Figure 3 shown.

[0049] (1) Node construction

[0050] The node construction sub-step maps the preprocessed financial account data into nodes in the transaction network graph. Each node represents a financial account and contains the detailed information and attributes of the account. This process ensures that all relevant accounts in the transaction network can accurately reflect their relationships and attributes.

[0051] (2) Side construction

[0052] The edge construction substep maps the preprocessed transaction data into edges in the transaction network graph. Each edge represents a transaction, connects two financial accounts (nodes), and contains detailed information and attributes of the transaction. This process ensures that all transaction relationships in the network graph can accurately reflect the path and characteristics of capital flow, providing a complete transaction network structure for subsequent analysis.

[0053] (3) Weighted processing

[0054] The weighted processing substep assigns weights to the edges in the transaction network to reflect the importance and frequency of transactions. The weight setting helps to identify and highlight key transaction paths and nodes in network analysis, and can more realistically show the characteristics and patterns of capital flows.

[0055] (4) Storage and management

[0056] The storage and management sub-step stores the constructed transaction network graph persistently and provides efficient management and query functions, enabling the system to quickly access and process large-scale financial data and support complex network analysis tasks.

[0057] 3. Social Network Analysis Steps

[0058] The social network analysis step is one of the core processes of the method of the present invention. Its main function is to identify the key paths and nodes of capital flow by analyzing the nodes and edges in the transaction network, and to reveal the community structure and potential abnormal transaction behaviors in the transaction network. This step uses social network analysis technology to conduct an in-depth analysis of the constructed transaction network graph, providing valuable insights and clues to support the subsequent tracking of capital flows.

[0059] The social network analysis process includes three parts: node centrality analysis, community discovery, pattern recognition and anomaly detection. Figure 4 shown.

[0060] (1) Node centrality analysis

[0061] The main function of the node centrality analysis sub-step is to calculate and analyze the centrality index of each node in the transaction network and identify the nodes that play a key role in the capital flow process. By analyzing the centrality of the nodes, including degree centrality, betweenness centrality, and proximity centrality, it is possible to determine which accounts have an important position in the transaction network and may be the hub or main participant of the capital flow. This information is of great significance for identifying key paths and discovering potential illegal fund transfers.

[0062] (2) Community Discovery

[0063] The main function of the community discovery sub-step is to analyze the nodes and edges in the transaction network through the community discovery algorithm and identify the community structure in the network. Community discovery algorithms include: Louvain algorithm, Girvan-Newman algorithm, and spectral clustering algorithm. Community structure refers to subgroups of nodes in the network with close relationships. Nodes within these groups frequently trade with each other, but have fewer transactions with external nodes. Identifying these communities helps reveal potential money laundering gangs, criminal organizations, or other high-risk account groups, providing important clues for subsequent detailed investigation and analysis.

[0064] (3) Pattern recognition and anomaly detection

[0065] The main function of the pattern recognition and anomaly detection sub-step is to combine pattern recognition algorithms and anomaly detection technologies to analyze common transaction patterns in the transaction network and identify abnormal transaction behaviors, revealing potential illegal activities and suspicious capital flow paths. Pattern recognition algorithms include: frequent pattern mining algorithms, cluster analysis algorithms, and anomaly detection technologies include: statistical-based anomaly detection, and machine learning-based anomaly detection.

[0066] 4. Graph Neural Network Analysis Steps

[0067] The graph neural network analysis step is also one of the core processes of the present invention. Its main function is to use the graph neural network (GNN) technology to conduct deep learning analysis on the transaction network, extract transaction features, and identify complex transaction patterns and abnormal transaction behaviors. By efficiently extracting and learning the features of the network structure and node attributes, it is possible to deeply explore the implicit relationships and patterns in the transaction network.

[0068] Graph neural network analysis works closely with social network analysis to improve the accuracy and depth of transaction network analysis. Social network analysis provides preliminary structural information of the transaction network and identification of key nodes and communities by calculating node centrality and community discovery. On this basis, graph neural network analysis uses this structural information for deep learning to extract more complex transaction patterns and implicit relationships.

[0069] The centrality index, community structure and other features output by the social network analysis step will be used as the input of the graph neural network model to further enrich the feature space of the model. By learning and training these features, the graph neural network analysis can more accurately identify abnormal trading behaviors. In addition, the key nodes and community structures identified by the social network analysis step also provide the graph neural network analysis with key objects and areas of focus, improving the pertinence and efficiency of the model.

[0070] Through this collaboration and integration, the social network analysis step and the graph neural network analysis step form a complete analysis chain, making full use of the structured information of the social network analysis step and the deep learning ability of the graph neural network analysis step, and comprehensively improving the effect of tracking the flow of funds in the trading network.

[0071] The steps of graph neural network analysis include three parts: feature extraction, model training, model prediction and application. Figure 5 shown.

[0072] (1) Feature extraction

[0073] The main function of the feature extraction sub-step is to extract the features of nodes and edges from the transaction network, which will serve as the input data for graph neural network analysis. By extracting features from nodes and edges, it is possible to capture important attributes and relationships in the transaction network, providing high-quality input for subsequent model training and prediction.

[0074] (2) Model training

[0075] The main function of the model training sub-step is to train the graph neural network model using the node and edge feature data obtained from the feature extraction step. By repeatedly adjusting the model parameters, the model can learn the complex relationships and patterns in the transaction network and improve the ability to identify normal and abnormal transaction behaviors.

[0076] (3) Model prediction and application

[0077] The main function of the model prediction and application sub-step is to use the trained graph neural network model to predict and analyze new transaction data.

[0078] 5. Steps to track fund flows

[0079] The main function of the fund flow tracking step is to combine the results of the social network analysis step and the graph neural network analysis step to track the flow path of suspicious funds. This step uses graph search algorithms and comprehensive analysis of transaction data and network structure to generate a detailed fund flow path report to assist financial institutions and law enforcement agencies in taking effective actions to recover stolen money and prevent losses.

[0080] The fund flow tracking process includes two parts: fund flow path tracking and fund flow path report generation. Figure 6 shown.

[0081] (1) Tracking of fund flow paths

[0082] The main function of the fund flow path tracking sub-step is to track the flow path of suspicious funds in the transaction network and record in detail the entire process of funds from the source account to the final destination. By revealing the flow pattern and path of funds, key nodes and potential transit accounts can be identified, providing specific action guidance for recovering stolen money and preventing losses.

[0083] (2) Generation of fund flow path report

[0084] The main function of the fund flow path report generation sub-step is to organize and visualize the analysis results of the fund flow path tracking link and generate a detailed fund flow path report. The report intuitively displays the flow process of suspicious funds, the key nodes involved and the transaction path, and provides clear guidance for financial institutions and law enforcement agencies to recover stolen money and prevent losses.

[0085] Embodiment 1:

[0086] A method for tracing and analyzing the flow of funds in financial cases, and its typical usage process is as follows.

[0087] Step 1: Data collection and preprocessing

[0088] Data collection and preprocessing are the key first steps to ensure the acquisition of high-quality financial transaction data and lay the foundation for subsequent transaction network construction and analysis. This process involves the following key steps.

[0089] (1) Data Collection

[0090] 1) First, you need to identify and connect to various financial data sources, including banks, payment platforms, exchanges, etc. To identify the data source, you need to list in detail the data type and format provided by each data source to ensure that the required information is fully covered. Through API interfaces, JDBC / ODBC and other database connection technologies, establish a stable and secure connection with each data source, and use encryption protocols to protect the security of data during transmission.

[0091] 2) During the data collection process: For data sources that provide API interfaces, the system will write programs to regularly call the API to obtain data, and obtain the latest transaction data in real time through regular polling or event-based triggering; for data sources that provide database access rights, write SQL queries to extract data from the database, and use the batch data export function to obtain data in batches during offline periods; for data sources that provide log files or other forms of batch data, write scripts to parse the log file content, extract transaction records, and process common file formats such as CSV, JSON, XML, etc.

[0092] 3) After data collection is completed, the system stores the collected raw data in a temporary database or distributed file system, such as HDFS, to ensure the reliability and scalability of data storage. For the convenience of subsequent processing, the system performs preliminary format conversion on the data, such as unifying data fields from different sources into standard field names and unifying different time formats into ISO standard time formats. In addition, the system also records timestamps for each data collection operation to ensure the timeliness and traceability of the data. These steps ensure the consistency and integrity of the data throughout the entire processing process, laying the foundation for subsequent cleaning and standardization processing.

[0093] (2) Data cleaning

[0094] 1) First, deduplicate the data by using a hash algorithm or a matching algorithm based on a unique identifier to identify and delete duplicate transaction records.

[0095] 2) Next, the noise filtering step filters out outliers and erroneous data in the data by setting reasonable thresholds and rules, such as records with transaction amounts outside a reasonable range or timestamps with incorrect formats.

[0096] 3) To handle missing values, the system will use a variety of methods, such as mean filling, interpolation, or directly deleting records with a large number of missing values. The specific method depends on the characteristics of the data and the analysis requirements.

[0097] (3) Data standardization

[0098] 1) First, unify the data fields of each data source. The same concept in different data sources may use different field names and representations. For example, the "transaction time" field in one data source may be called "timestamp" in another data source. To resolve this inconsistency, the system will map and convert all fields and unify them into standard field names. For example, the "transaction time" field will be uniformly named "transaction_time".

[0099] 2) Next is the standardization of formats. The date and time formats in transaction data often vary depending on the data source, such as ISO 8601 format, UNIX timestamp, or other localized date and time representations. The system converts all date and time fields to the standard ISO 8601 format to ensure data consistency. In addition, monetary amounts also need to be standardized. Different data sources may use different currency symbols and decimal places. The system will standardize them to the specified decimal places and currency symbols.

[0100] 3) Data type conversion is another key step in standardization. Different data sources may use different data types for the same field, for example, representing the transaction amount as a string or a numeric type. The system will convert these fields to the appropriate data type based on standardization requirements to ensure data consistency and operability. For example, convert all transaction amount fields to floating point numbers and convert all date and time fields to date and time types.

[0101] All these standardized processing steps are completed automatically. Through a series of predefined rules and algorithms, the system can efficiently convert multi-source data into a unified format, providing a high-quality data foundation for subsequent analysis.

[0102] (4) Data Verification

[0103] 1) First, completeness verification is performed to ensure that each transaction record contains all required fields and information. For example, in financial transaction data, each record should at least include key fields such as transaction time, transaction amount, account information, etc. The system will use predefined verification rules to scan all records to check whether there are any missing required fields. If missing, the system will mark these records and take corresponding measures, such as supplementing the missing information or isolating them for further inspection.

[0104] 2) Next, consistency verification is performed to ensure that the information of the same account in different data sources is consistent. For example, the account balance and transaction records of the same account in different bank systems should be consistent. The system will cross-verify this information across data sources, checking for inconsistencies by comparing the records of the same account in different data sources. If inconsistencies are found, the system will record these differences and provide a detailed report for further investigation and correction.

[0105] 3) Finally, accuracy verification is performed to verify the accuracy of the data through a series of verification rules and algorithms. For example, the system will check whether the transaction amount is within a reasonable range, whether the date and time are valid and within the expected time period. The system will also use historical data for trend analysis and anomaly detection to find possible errors and abnormal behaviors. For example, by comparing historical transaction patterns, the system can detect abnormally large transaction amounts or frequent transaction behaviors, which may indicate data errors or potential fraud.

[0106] (5) Data storage

[0107] 1) Choose a suitable storage system to store preprocessed data. For large-scale financial transaction data, distributed databases or distributed file systems, such as Hadoop HDFS, Apache Cassandra, or Amazon S3, are usually used to ensure the reliability and scalability of data storage. Distributed systems can handle large amounts of data and provide high availability and fault recovery capabilities, ensuring that data is distributed and redundantly backed up on different nodes.

[0108] 2) Write the cleaned, standardized, and verified data in batches to the distributed storage system. Each write operation is accompanied by a timestamp and a unique identifier to ensure the timeliness and traceability of the data. These metadata help the system accurately locate and access the required data in future data queries and analysis. In order to optimize the access performance of the data, the system will partition and index the data according to its characteristics. For example, partitioning the data according to the transaction date or account ID allows related data to be stored in adjacent physical locations, thereby speeding up data queries.

[0109] 3) Data access control and permission management ensure that only authorized users and system components can access and modify data. By setting different access rights and encryption technology, the system protects the security and privacy of data and prevents unauthorized access and data leakage.

[0110] 4) In addition to persistent data storage, it also provides fast data access and query functions. By utilizing the parallel processing capabilities of the distributed storage system, the system can efficiently perform complex query operations and support real-time analysis and processing of large-scale data.

[0111] Step 2: Transaction network construction

[0112] Next, the preprocessed financial transaction data is transformed into a structured transaction network graph. This process involves the following key steps.

[0113] (1) Node construction

[0114] 1) First, extract all financial account information from the preprocessed dataset. This information usually includes account ID, account holder name, account type (such as savings account, credit card account), bank, account status, etc. The system assigns a unique node identifier to each account to ensure that each node in the network graph is unique and identifiable.

[0115] 2) Next, the system creates a node object, which contains all relevant account information and attributes. In order to effectively process and store these node data, the system usually uses object-oriented programming languages ​​to define the structure of node objects. Each node object includes multiple fields, which store various attribute information of the account, such as account ID, holder name, account type, etc.

[0116] 3) After the node is created, the system will insert all node objects into the graph database. During the insertion process, the system will ensure the integrity and consistency of the node data, and establish necessary indexes to speed up subsequent queries and access.

[0117] Through these steps, the node construction link successfully converts financial account data into structured network nodes, forming a complete node set. These node sets serve as the basis of the transaction network graph and provide necessary support for subsequent edge construction and weighted processing.

[0118] (2) Side construction

[0119] 1) First, extract all transaction records from the preprocessed dataset. Each transaction record usually includes detailed information such as transaction ID, source account ID, target account ID, transaction amount, transaction time, transaction type, etc. The system assigns a unique edge identifier to each transaction to ensure that each edge in the network graph is unique and identifiable.

[0120] 2) Next, the system creates edge objects, which contain all relevant attributes in the transaction record. In order to efficiently process and store these edge data, the system usually uses object-oriented programming languages ​​to define the structure of edge objects. Each edge object includes multiple fields, which store various attribute information of the transaction, such as transaction ID, source account ID, target account ID, transaction amount, transaction time, etc.

[0121] 3) After the edge objects are created, the system will insert them into the graph database. During the insertion process, the system ensures the integrity and consistency of the edge data, and establishes necessary indexes to speed up subsequent queries and access. The source account ID and target account ID in the edge object will correspond to two nodes in the network graph, indicating the transaction relationship between the two accounts.

[0122] Through these steps, the edge construction sub-phase successfully converts the transaction data into structured network edges, forming a complete edge set. These edge sets, as the core part of the transaction network graph, together with the node set, constitute the complete transaction network graph.

[0123] (3) Weighted processing

[0124] 1) Collect relevant data for each transaction edge, including transaction amount, transaction frequency, transaction time and other attributes. The system calculates the weight of each edge based on the comprehensive information of these attributes. The calculation of weight is usually based on a predefined weight model, which takes into account factors such as transaction amount and frequency in order to comprehensively evaluate the importance of each transaction.

[0125] The design of the weighted model needs to be customized according to actual business needs. A common weight calculation method is to combine the transaction amount and transaction frequency. The system will first normalize the transaction amount so that it is distributed between 0 and 1, and then perform similar processing on the transaction frequency. Normalization can use methods such as maximum and minimum value normalization or standard deviation normalization to eliminate the magnitude differences between different transaction data. The normalized transaction amount and frequency can be weighted and summed according to the set weight ratio to obtain the final edge weight. For example, the edge weight can be expressed as: edge weight = α*normalized transaction amount + β*normalized transaction frequency, where α and β are weight ratio coefficients, which are adjusted according to actual needs.

[0126] In actual operation, the system calculates the weight for each edge and stores the calculation result in the edge object. This weight represents the relative importance of the transaction. High-weighted edges often represent the path of large-value transactions or high-frequency transactions, which deserve special attention. After the calculation is completed, the system reinserts the weighted edge object into the graph database and updates the existing transaction network graph.

[0127] 2) Weighted processing also needs to deal with the weight adjustment of the time dimension. For example, the system can set a time window and only consider transaction data within a specific time period to cope with the situation where transaction patterns change over time. In this way, different weighted network diagrams can be generated in different periods to reflect the time series characteristics of capital flow.

[0128] 3) In order to ensure the efficiency of weighted processing, the system will adopt parallel computing technology, especially when processing large-scale transaction data, using multi-threading or distributed computing frameworks (such as Apache Spark) to accelerate the weight calculation process.

[0129] Through these technical means, the weighted processing link can quickly and accurately assign weights to each edge in the transaction network, thereby improving the analytical value of the entire network graph.

[0130] (4) Storage and management

[0131] 1) First, select a suitable graph database to store the constructed transaction network graph. Graph databases such as Neo4j and Amazon Neptune can be selected. They are designed for processing complex network relationship data and can efficiently store and manage large-scale nodes and edges. The system will insert the constructed node and edge objects into the graph database to ensure persistent storage of data.

[0132] 2) During the insertion process, as mentioned above, the system will create indexes for each node and edge to speed up data query. Indexes are usually based on commonly used query fields, such as account ID, transaction time, etc., which can significantly improve the efficiency of data access. The system will also design and create appropriate graph structures based on business needs to make data storage and management more logical and hierarchical.

[0133] 3) To ensure data consistency, the system uses transaction management and data backup mechanisms. Transaction management ensures that during data insertion, updating, and deletion, all operations are either successful or failed, preventing data inconsistency. Data backup ensures that data can be quickly restored when data is lost or damaged by performing full and incremental backups on a regular basis. Backup data is usually stored in offsite servers or cloud storage to prevent the risk of data loss caused by physical disasters.

[0134] 4) In addition, storage and management also provide rich data query and retrieval functions. Users can perform complex query operations through the query language provided by the graph database (such as Cypher for Neo4j) to quickly retrieve and analyze specific nodes and edges in the transaction network graph. The system supports multiple query modes, such as path query, subgraph query, pattern matching, etc., to meet the needs of different analysis tasks.

[0135] 5) To improve query performance, the system will use the parallel processing capabilities and distributed storage architecture of the graph database. By executing query tasks in parallel, the system can process large-scale query requests in a short time. The distributed storage architecture ensures that data is distributedly stored and calculated on multiple nodes, improving the scalability and fault tolerance of the system.

[0136] Through these technical means, the storage and management links successfully store the transaction network graph persistently and provide efficient management and query functions.

[0137] Step 3: Social Network Analysis

[0138] After the transaction network is constructed, it is loaded and parsed to perform social network analysis. This process involves the following key steps.

[0139] (1) Node centrality analysis

[0140] Node centrality analysis is mainly based on the structural analysis of the transaction network graph. The transaction network graph consists of nodes (accounts) and edges (transactions). The system first loads and parses the transaction network graph stored in the graph database. Next, the system calculates the centrality index of each node. Common centrality indexes include degree centrality, betweenness centrality, and closeness centrality.

[0141] 1) Degree centrality is the most intuitive centrality indicator, which indicates the number of connections of a node, that is, the number of edges directly connected to the node. Nodes with high degree centrality are usually accounts with frequent transactions. The system will traverse each node in the network graph, count the degree of each node, and record it in the properties of the node. This process can be efficiently implemented through the query language of the graph database (such as Cypher for Neo4j).

[0142] 2) Betweenness centrality measures the degree to which a node acts as an intermediary in the network, that is, the frequency of the node's appearance in the shortest paths between other pairs of nodes. Nodes with high betweenness centrality are usually hubs for capital flows and may be key capital transfer points. Calculating betweenness centrality requires considering the shortest paths between all pairs of nodes in the network graph, which is usually achieved through the Floyd-Warshall algorithm or the Dijkstra algorithm. The system calculates the frequency of each node's appearance in all shortest paths to obtain the betweenness centrality of each node.

[0143] 3) Closeness centrality measures the average shortest path length from a node to all other nodes in the network. Nodes with high closeness centrality are usually able to quickly reach other nodes in the network, indicating that they have efficient transmission capabilities in capital flows. The calculation of closeness centrality also requires the use of the shortest path algorithm. The system will traverse the network graph, calculate the shortest path length from each node to all other nodes, and take the average value to obtain the closeness centrality of each node.

[0144] In order to improve computing efficiency, the system will use parallel computing technology, especially when processing large-scale transaction networks, using multi-threaded or distributed computing frameworks (such as Apache Spark GraphX) to accelerate the calculation process of centrality indicators. The system stores the calculated centrality indicators in the graph database as node attributes to facilitate subsequent query and analysis.

[0145] (2) Community Discovery

[0146] 1) Use a variety of community discovery algorithms to analyze the transaction network graph and identify and divide the community structure in the network. Commonly used community discovery algorithms include Louvain algorithm, Girvan-Newman algorithm and spectral clustering algorithm.

[0147] a) Louvain algorithm is a greedy optimization algorithm that identifies community structure by maximizing modularity. Modularity is an indicator of the quality of network partitioning, which represents the comparison between the node connection density in the network and the random network. The Louvain algorithm first regards each node as an independent community, and then repeatedly merges adjacent nodes to gradually build larger communities until the modularity no longer increases. The algorithm performs well when dealing with large-scale networks and can efficiently identify community structure. In specific implementation, the system will traverse each node in the network, maximize the modularity by continuously adjusting the community to which the node belongs, and finally determine the community to which each node belongs.

[0148] b) The Girvan-Newman algorithm is a community discovery algorithm based on edge betweenness centrality, which splits communities by gradually deleting edges with high betweenness centrality in the network. Edges with high betweenness centrality usually connect different communities. By deleting these edges, the network will gradually split into multiple sub-groups. In specific implementation, the system first calculates the betweenness centrality of all edges in the network, and then deletes these high betweenness centrality edges in sequence until the network is split into multiple connected components. Each connected component is a community. Although the computational complexity of the Girvan-Newman algorithm is high, it performs well in revealing the hierarchical structure of the network.

[0149] c) Spectral clustering algorithm is a community discovery method based on spectral decomposition of graphs. It divides nodes into different communities through the eigenvalues ​​and eigenvectors of the Laplacian matrix of the graph. In specific implementation, the system first calculates the Laplacian matrix of the network graph, then performs eigenvalue decomposition, selects the first k eigenvectors, and embeds the nodes into the k-dimensional space. By applying the k-means clustering algorithm in this k-dimensional space, the system is able to divide the nodes into different communities. Spectral clustering algorithms have advantages in processing complex network structures and discovering implicit communities.

[0150] 2) In actual applications, the system may combine multiple algorithms for community discovery to improve the accuracy and robustness of identification. After the calculation is completed, the system will store the community division results in the graph database as the attributes of the node to facilitate subsequent query and analysis. Each node will be marked as the community it belongs to, and the system will also generate a relationship diagram between communities to show the transaction relationship and interaction intensity between communities.

[0151] 3) In order to improve computing efficiency, especially when dealing with large-scale transaction networks, the system will use parallel computing and distributed computing technologies. Using multi-threaded or distributed computing frameworks (such as Apache Spark GraphX), the system can quickly complete the computing tasks of community discovery and ensure the timeliness and accuracy of the analysis results.

[0152] (3) Pattern recognition and anomaly detection

[0153] Combining pattern recognition algorithms and anomaly detection technology, we conduct in-depth analysis of transaction networks and provide early warnings and clues for potential financial crimes. Specifically, we include the following parts.

[0154] 1) First, conduct a comprehensive data analysis of the transaction network to extract common transaction patterns and behavioral features. The pattern recognition part mainly uses technologies such as frequent pattern mining and cluster analysis to identify common patterns in the transaction network. For example, through frequent pattern mining, the system can identify transaction combinations that frequently occur between certain accounts within a specific time period. These combinations may represent legitimate business transaction patterns or potential abnormal patterns. Cluster analysis clusters transaction data and classifies similar transaction behaviors into one category, thereby identifying common patterns in the transaction network.

[0155] 2) To identify abnormal trading behavior, the system uses statistical and machine learning-based anomaly detection techniques.

[0156] a) Statistical anomaly detection technology identifies transactions that significantly deviate from normal behavior by establishing a statistical model of transaction behavior. For example, the system can establish a transaction amount distribution model for each account and find transactions whose amounts are significantly higher or lower than the normal range through statistical analysis. Common statistical anomaly detection methods include z-score, IQR (interquartile range), etc. These methods can effectively identify abnormal behavior on a single indicator.

[0157] b) Anomaly detection technology based on machine learning identifies complex multi-dimensional abnormal patterns through training models. The system first uses historical transaction data to train anomaly detection models, such as Isolation Forest, Local Outlier Factor (LOF), or Autoencoder based on deep learning. These models can learn the characteristics of normal trading behavior and identify abnormal transactions that deviate from these characteristics. Isolation Forest constructs multiple isolated trees by randomly selecting features and split points, isolates data points, and calculates anomaly scores. Local Outlier Factor identifies local anomalies by comparing the density difference between data points and their neighbors. Autoencoders learn low-dimensional representations of data by building encoder-decoder networks, and data points with large reconstruction errors are considered abnormal.

[0158] 3) The system will also combine time series analysis technology to identify time series anomalies in transaction behaviors. For example, using time series anomaly detection algorithms (such as ARIMA, LSTM, etc.), the system can analyze the trends of transaction amounts, transaction frequencies, etc. over time, and discover those transactions that suddenly surge or plummet. By analyzing the trends and changes in transaction time series, the system can provide more accurate anomaly detection results.

[0159] Step 4: Graph Neural Network Analysis

[0160] Based on social network analysis, graph neural network analysis is continued to extract more complex transaction patterns and implicit relationships. This process involves the following key steps.

[0161] (1) Feature extraction

[0162] 1) First, load the transaction network data from the graph database, including information on all nodes (accounts) and edges (transactions).

[0163] a) For nodes, the system needs to extract features including account ID, account type, transaction frequency, transaction amount, centrality index, etc. Transaction frequency refers to the number of transactions of an account in a certain period of time, which can be obtained by calculating the degree centrality of the node. The transaction amount is the sum or average of all transaction amounts of the account. Centrality indicators such as degree centrality, betweenness centrality and closeness centrality can be calculated through the social network analysis process to reflect the importance and connectivity of the node in the network.

[0164] b) For edges, the features that the system needs to extract include transaction amount, transaction time, transaction type, transaction frequency, etc. The transaction amount refers to the specific amount of each transaction, the transaction time refers to the timestamp of the transaction, and the transaction type refers to the specific nature of the transaction (such as transfer, payment, etc.). The transaction frequency refers to the number of transactions between two nodes (accounts) within a certain period of time, which can be calculated by counting the number of transactions between the same node pairs.

[0165] 2) During the feature extraction process, the system will standardize these features to ensure their consistency in numerical range and distribution. Standardization includes normalizing numerical features to a range of 0 to 1, or converting them to a standard normal distribution (mean 0, standard deviation 1). This processing method helps to eliminate the magnitude differences between different features and improve the effect of model training. For time-based features, the system will convert timestamps into periodic features, such as days, weeks, months, etc., to capture the time pattern of trading behavior.

[0166] 3) The feature extraction process also needs to process the high-dimensional features of nodes and edges and convert them into low-dimensional embedding representations. The system can use pre-trained embedding models, such as Word2Vec or Node2Vec, to map the high-dimensional features of nodes and edges into low-dimensional space to generate dense feature vectors. These low-dimensional feature vectors can be used as input to the graph neural network to help the model better capture the complex relationships and patterns in the transaction network.

[0167] 4) In the actual feature extraction operation, the system will process the feature extraction tasks of nodes and edges in parallel, especially when dealing with large-scale transaction networks, using multi-threading or distributed computing frameworks (such as Apache Spark) to accelerate the feature extraction process. The system stores the extracted features in memory or distributed storage systems for subsequent model training and prediction.

[0168] Through these technical means, the feature extraction process can accurately extract the features of nodes and edges from the transaction network.

[0169] (2) Model training

[0170] 1) First, receive the feature data generated in the previous step, including the feature vectors of nodes and edges. Then, the system will select an appropriate graph neural network model for training. Commonly used graph neural network models include graph convolutional networks (GCN) and graph attention networks (GAT).

[0171] a) For graph convolutional networks (GCNs), the system aggregates the neighbor information of nodes layer by layer through convolution operations to learn the global features of nodes. At the beginning of the training process, the system initializes the model parameters, including the weight matrix and bias terms. Then, the system inputs the feature data into the model, calculates the convolution operation of each layer, and obtains the new feature representation of each node by weighted summation of the features of the node and its neighbor nodes. After each layer of convolution operation, the system applies a nonlinear activation function (such as ReLU) to further enhance the expressiveness of the model.

[0172] b) Graph Attention Network (GAT) uses the attention mechanism to assign different weights to the neighbors of each node, and learn the relationship between nodes more flexibly. The system first initializes the attention weights and inputs the node features into the model. For each node, the system calculates its attention score with its neighboring nodes, and obtains the new feature representation of the node by multiplying the node feature with the attention weight. Similar to GCN, GAT also applies a nonlinear activation function after each layer of operation.

[0173] 2) During the training process, the system uses the training data for forward propagation to calculate the output of the model. For supervised learning, the system compares the model output with the true label and calculates the loss function (such as cross entropy loss or mean square error). Then, the system calculates the gradient of the loss function with respect to the model parameters through the back-propagation algorithm and updates the model parameters to minimize the loss function. This process is repeated until the loss function converges or the preset number of training rounds is reached.

[0174] 3) Model training also requires batch training and validation of data. The system divides the training data into multiple mini-batches and inputs them into the model for training one by one to improve computational efficiency and the generalization ability of the model. After each training cycle, the system uses the validation data set to evaluate the model performance to prevent the model from overfitting. The validation process includes calculating the validation loss and accuracy, and monitoring the performance of the model on the validation set.

[0175] 4) In order to improve training efficiency, the system will use parallel computing and distributed training technology. Through multi-threaded or distributed computing frameworks (such as TensorFlow Distributed or PyTorchDistributed), the system can accelerate the model training process and process large-scale transaction network data. In addition, the system will also use optimization algorithms (such as Adam or RMSprop) to adjust the learning rate and model parameters to improve training results.

[0176] 5) After the model training is completed, the system will save the trained model parameters and structure as the basis for subsequent predictions and applications. The trained model can accurately capture the complex relationships and patterns in the transaction network and identify normal and abnormal transaction behaviors.

[0177] (3) Model prediction and application

[0178] 1) First, new transaction data is received and node and edge features are extracted from it. This process is similar to feature extraction, including collecting node attributes (such as account ID, account type, transaction frequency, transaction amount, etc.) and edge attributes (such as transaction amount, transaction time, transaction type, etc.) and normalizing them. The extracted feature data is then used as input to the trained graph neural network model.

[0179] 2) Before inputting data into the model, the system will first load the trained model parameters and structure. Model parameters include weight matrix and bias term, while model structure includes information such as number of network layers, number of nodes in each layer and activation function. After loading, the system will input the features of new data into the model for forward propagation calculation. During the forward propagation process, the system calculates the feature representation of nodes layer by layer, aggregates the information of neighboring nodes through convolution operation or attention mechanism, and generates new node feature representation.

[0180] 3) Model reasoning calculation. For the graph convolutional network (GCN), the system aggregates the neighbor information of the node layer by layer through convolution operations to obtain a new feature representation for each node. For the graph attention network (GAT), the system assigns different weights to the neighbors of each node by calculating the attention score, and flexibly learns the relationship between nodes. Regardless of the model used, the final output is the predicted score or classification label of each node.

[0181] 4) Post-process the output of the model. For classification tasks, the classification label output by the model indicates the category of the node or edge, such as normal transaction or abnormal transaction. For regression tasks, the predicted score output by the model indicates the suspiciousness of the transaction, and the higher the score, the more suspicious the transaction. The system will mark transactions with scores higher than the threshold as abnormal transactions based on the preset threshold, and record the detailed information of these abnormal transactions.

[0182] Step 5: Tracking the flow of funds

[0183] Fund flow tracking is the last step of the present invention, which tracks the flow path of suspicious funds based on the results of social network analysis and graph neural network analysis. This process involves the following key steps.

[0184] (1) Tracking of fund flow paths

[0185] 1) First, extract the transaction records marked as abnormal from the transaction network as a starting point. These abnormal transaction records come from the previous social network analysis and graph neural network analysis process. The system will gradually track the flow path of funds based on the source account of each abnormal transaction.

[0186] 2) In actual operation, the system first loads the graph structure of the transaction network, including detailed information of all nodes (accounts) and edges (transactions). Then, the system selects the depth-first search (DFS) or breadth-first search (BFS) algorithm for path tracing. The DFS algorithm recursively goes from a node (account) along the transaction path (edge) to the farthest node possible, then backtracks and continues to explore other paths. This method can deeply discover long-chain transaction paths. In contrast, the BFS algorithm starts from the starting node, expands outward layer by layer, explores all adjacent nodes, and then expands further. This method is suitable for discovering extensive transaction networks at multiple levels.

[0187] 3) During the path tracing process, the system will record the transaction information of each step in detail, including transaction amount, transaction time, source account and target account, etc. The system will also calculate the cumulative transaction amount and number of transactions for each path to help identify high-frequency and large-value transaction paths. To improve efficiency, the system will use data structures (such as queues or stacks) to manage the search process and avoid repeated searches by marking visited nodes.

[0188] 4) During the path tracing process, the system not only records the transaction path, but also combines the results of the social network analysis process to identify the key nodes on the path and highlight them in the path diagram.

[0189] 5) In addition, the system will further evaluate the transactions on the path based on predefined rules and abnormal patterns. For example, the system will check whether the transaction amount is abnormally large, whether the transaction frequency is abnormally high, whether the transaction time is concentrated in a specific period, etc. These evaluation results help to further confirm and exclude suspicious fund flow paths.

[0190] Through these technical means, fund flow tracking can comprehensively and accurately track the flow path of suspicious funds, record every step of the fund flow process in detail, and reveal the destination and flow pattern of funds.

[0191] (2) Generation of fund flow path report

[0192] 1) First, receive the tracking results from the fund flow path tracking, which include detailed fund flow path information, transaction records and key nodes, etc. The system will organize and analyze this information to ensure the accuracy and comprehensiveness of the report content.

[0193] 2) In the process of collating information, the system will summarize each fund flow path, including all transaction records and account information involved. The summary information of each path includes detailed information such as transaction ID, source account, target account, transaction amount, transaction time, etc. In addition, the system will calculate the cumulative transaction amount and number of transactions on the path, and identify high-frequency and large-value transaction paths. The system will classify and sort these paths, highlighting the most important and most suspicious paths according to their abnormality and risk level.

[0194] 3) In order to intuitively display the process of capital flow, the system will generate a visual capital flow path diagram. The visualization process uses graphics drawing tools (such as D3.js or Graphviz) and the visualization function of the graph database to display the capital flow path in a graphical way. The capital flow path diagram shows the complete capital flow process from the source account to the final destination, including each transaction node and transaction path. The system will use different colors and line styles to distinguish normal transactions from abnormal transactions, and highlight key nodes and high-risk paths. The size and color of the node can indicate the importance of the node, such as transaction frequency and amount, and the thickness and color of the edge can indicate the weight and risk level of the transaction.

[0195] 4) In addition to the path map, the report also includes a detailed text description that explains the key details and anomalies of each fund flow path. The text description section provides an analysis of each key node, including its role, transaction behavior, and risk assessment. For example, the system will explain in detail why a node is identified as a key node, how its transaction frequency and amount are abnormal, etc. The text description section also provides a comprehensive assessment of each path, indicating its importance and risk level in the overall fund flow.

[0196] 5) The system will also generate interactive reports, allowing users to conduct in-depth analysis and exploration as needed. Interactive reports can be displayed through a graphical user interface, and users can click on nodes and edges in the path diagram to view detailed transaction information and analysis results. Interactive reports also provide filtering and search functions, and users can filter and query the flow path of funds according to different conditions (such as transaction amount, time range, account type, etc.). The generation of interactive reports relies on modern Web technologies and data visualization tools such as HTML5, JavaScript, D3.js, etc. to achieve real-time interaction and data display.

[0197] 6) Finally, the system will generate a formal document version of the fund flow path report in PDF or other document formats. These document versions of the report include all path maps, text descriptions and analysis results, and as a formal report file, can be easily distributed and archived.

[0198] Beneficial effects of the present invention:

[0199] The present invention uses social network analysis and graph neural network technology to achieve efficient feature extraction and model training: The present invention combines social network analysis technology with graph neural network technology, and uses the advantages of both to analyze and track the flow of funds in financial transaction networks. Social network analysis identifies key nodes and group structures in transaction networks by calculating node centrality and community discovery; graph neural network analysis further extracts complex transaction features and patterns and identifies abnormal transaction behaviors through deep learning models. In addition, by utilizing advanced graph neural network models such as graph convolutional networks and graph attention networks, combined with parallel computing and distributed training technologies, the model training process is efficient and has good scalability, which can meet the processing needs of large-scale financial transaction data.

[0200] The present invention accurately tracks and visualizes the capital flow path, and generates a detailed capital flow path report: In the capital flow path tracking link, the graph search algorithm is used to reveal the destination and flow pattern of funds in detail. The capital flow path diagram generated by the system uses visualization tools to intuitively display the flow process of funds from the source to the end point, identify key nodes and high-risk paths, and generate a detailed capital flow path report. The report allows users to deeply analyze and explore the capital flow path as needed, provides flexible screening and query functions, and provides specific action plans and basis for financial institutions and law enforcement agencies, greatly enhancing the insight and operability of suspicious capital flows.

[0201] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for tracing and analyzing the flow of funds in financial cases, characterized in that: The method includes the following steps: data collection and preprocessing, transaction network construction, social network analysis, graph neural network analysis and fund flow tracking; Data collection and preprocessing steps are used to obtain transaction data related to financial cases from multiple data sources, clean and standardize the data, ensure the integrity and consistency of the data, and provide a high-quality data foundation for subsequent transaction network construction and analysis; The transaction network construction step is used to convert the pre-processed financial transaction data into a structured network graph, and to achieve systematic management of the transaction network by constructing a relationship graph of nodes and edges; The social network analysis step is used to identify the key paths and nodes of capital flow by analyzing the nodes and edges in the transaction network, revealing the community structure and potential abnormal transaction behaviors in the transaction network. This step uses social network analysis technology to conduct in-depth analysis of the constructed transaction network graph, providing valuable insights and clues to support the subsequent tracking of capital flows. The graph neural network analysis step is used to use the graph neural network (GNN) technology to perform deep learning analysis on the transaction network, extract transaction features, and identify complex transaction patterns and abnormal transaction behaviors; Through efficient feature extraction and learning of network structure and node attributes, it is possible to deeply explore the implicit relationships and patterns in the transaction network; The fund flow tracking step combines the results of the social network analysis step and the graph neural network analysis step to track the flow path of suspicious funds. This step uses graph search algorithms and comprehensive analysis of transaction data and network structure to generate a detailed fund flow path report to assist financial institutions and law enforcement agencies in taking effective actions to recover stolen money and prevent losses.

2. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 1, characterized in that: The data collection and preprocessing steps include five parts: data collection, data cleaning, data standardization, data verification, and data storage: The data collection sub-step obtains transaction data related to financial cases from a variety of financial data sources to ensure the comprehensiveness and accuracy of data collection; The data cleaning sub-step cleans and filters the raw transaction data collected from various data sources to provide high-quality analytical data; The data standardization sub-step converts transaction data from different data sources into a consistent format and structure. By standardizing data fields, formats, and types, the differences between data sources are eliminated, allowing the data to be seamlessly integrated and compared in subsequent analysis processes. The data validation sub-step ensures the completeness, consistency, and accuracy of the data during data collection and preprocessing; The data storage sub-step will persistently store high-quality data that has been cleaned, standardized, and verified, and is responsible for managing the storage location and method of the data, providing a stable and reliable data foundation for subsequent transaction network construction and analysis.

3. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 1, characterized in that: The transaction network construction steps include: node construction, edge construction, weighted processing, storage and management; The node construction sub-step maps the preprocessed financial account data into nodes in the transaction network graph. Each node represents a financial account and contains the detailed information and attributes of the account. This process ensures that all relevant accounts in the transaction network can accurately reflect their relationships and attributes. The edge construction substep maps the preprocessed transaction data into edges in the transaction network graph. Each edge represents a transaction, connects two financial accounts, and contains detailed information and attributes of the transaction. This process ensures that all transaction relationships in the network graph can accurately reflect the path and characteristics of capital flow, providing a complete transaction network structure for subsequent analysis. The weighted processing substep assigns weights to the edges in the transaction network to reflect the importance and frequency of transactions; the setting of weights helps to identify and highlight key transaction paths and nodes in network analysis, and can more realistically show the characteristics and patterns of capital flows; The storage and management sub-step stores the constructed transaction network graph persistently and provides efficient management and query functions, enabling the system to quickly access and process large-scale financial data and support complex network analysis tasks.

4. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 3 is characterized in that: The weight calculation method is to combine the transaction amount and transaction frequency; the system will first normalize the transaction amount to make it distributed between 0 and 1, and then perform similar processing on the transaction frequency; the normalization process uses the maximum and minimum value normalization or standard deviation normalization method to eliminate the magnitude differences between different transaction data; The normalized transaction amount and frequency are weighted and summed according to the set weight ratio to obtain the final edge weight; The edge weight is expressed as: edge weight = α*normalized transaction amount + β*normalized transaction frequency, where α and β are weight ratio coefficients, which are adjusted according to actual needs.

5. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 1, characterized in that: The social network analysis steps include: node centrality analysis, community discovery, pattern recognition and anomaly detection; The node centrality analysis sub-step calculates and analyzes the centrality index of each node in the transaction network, identifies the nodes that play a key role in the capital flow process, and determines which accounts have an important position in the transaction network and may be the hub or main participant of the capital flow by analyzing the centrality of the nodes, including degree centrality, betweenness centrality, and closeness centrality; The community discovery sub-step uses a community discovery algorithm to analyze the nodes and edges in the transaction network and identify the community structure in the network. The community structure refers to subgroups of nodes in the network that are closely related. The nodes within these groups frequently trade with each other, but have fewer transactions with external nodes. Identifying these communities helps reveal potential money laundering gangs, criminal organizations, or other high-risk account groups. The pattern recognition and anomaly detection sub-step combines pattern recognition algorithms and anomaly detection techniques to analyze common transaction patterns in the transaction network and identify abnormal transaction behaviors, revealing potential illegal activities and suspicious capital flow paths.

6. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 5, characterized in that: Community discovery algorithms include: Louvain algorithm, Girvan-Newman algorithm, spectral clustering algorithm; pattern recognition algorithms include: frequent pattern mining algorithm, clustering analysis algorithm; anomaly detection technologies include: statistics-based anomaly detection, machine learning-based anomaly detection.

7. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 6, characterized in that: Degree centrality indicates the number of connections of a node, that is, the number of edges directly connected to the node; nodes with high degree centrality are accounts with frequent transactions; the system will traverse each node in the network graph, count the degree of each node, and record it in the node's attributes; Betweenness centrality measures the degree to which a node acts as an intermediary in the network, that is, the frequency of the node's appearance in the shortest path between other node pairs; nodes with high betweenness centrality are hubs for capital flow and may be key capital transfer points; calculating betweenness centrality requires considering the shortest paths between all node pairs in the network graph, which is achieved through the Floyd-Warshall algorithm or the Dijkstra algorithm; the system calculates the frequency of each node's appearance in all shortest paths to obtain the betweenness centrality of each node; Closeness centrality measures the average shortest path length from a node to all other nodes in the network; Nodes with high proximity centrality can quickly reach other nodes in the network, indicating that they have efficient transmission capabilities in capital flow; the calculation of proximity centrality also requires the use of the shortest path algorithm. The system will traverse the network graph, calculate the shortest path length from each node to all other nodes, and take the average value to obtain the proximity centrality of each node; Use a variety of community discovery algorithms to analyze transaction network graphs, identify and divide community structures in the network; After the calculation is completed, the system will store the community division results in the graph database as the attributes of the node to facilitate subsequent query and analysis; each node will be marked with the community it belongs to, and the system will also generate a relationship diagram between communities to show the transaction relationship and interaction intensity between communities; Combine pattern recognition algorithms and anomaly detection technology to conduct in-depth analysis of transaction networks and provide early warnings and clues to potential financial crimes; It specifically includes the following parts: First, conduct a comprehensive data analysis of the transaction network to extract common transaction patterns and behavioral characteristics; The pattern recognition part uses frequent pattern mining and cluster analysis techniques to identify common patterns in the transaction network; cluster analysis clusters transaction data and classifies similar transaction behaviors into one category, thereby identifying common patterns in the transaction network; Statistical anomaly detection technology identifies transactions that significantly deviate from normal behavior by establishing a statistical model of transaction behavior; machine learning-based anomaly detection technology identifies complex multi-dimensional anomaly patterns by training models; The system first uses historical transaction data to train anomaly detection models. These models can learn the characteristics of normal transaction behavior and identify abnormal transactions that deviate from these characteristics. The system will also combine time series analysis technology to identify timing anomalies in trading behavior.

8. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 1, characterized in that: The graph neural network analysis steps include: feature extraction, model training, model prediction and application; The feature extraction substep extracts node and edge features from the transaction network. These features will serve as input data for graph neural network analysis. By extracting features from nodes and edges, important attributes and relationships in the transaction network are captured, providing high-quality input for subsequent model training and prediction. The model training sub-step uses the node and edge feature data obtained from the feature extraction step to train the graph neural network model. By repeatedly adjusting the model parameters, the model learns the complex relationships and patterns in the transaction network and improves the ability to identify normal and abnormal transaction behaviors. The model prediction and application sub-step uses the trained graph neural network model to predict and analyze new transaction data.

9. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 8, characterized in that: Graph neural network analysis works closely with social network analysis to improve the accuracy and depth of transaction network analysis. Social network analysis provides preliminary structural information of the transaction network and identification of key nodes and communities by calculating node centrality and community discovery. On this basis, graph neural network analysis uses this structural information for deep learning to extract more complex transaction patterns and implicit relationships. The centrality index and community structure characteristics output by the social network analysis step will serve as the input of the graph neural network model to further enrich the feature space of the model. Graph neural network analysis identifies abnormal transaction behaviors by learning and training these features. In addition, the key nodes and community structures identified in the social network analysis step also provide key focus objects and areas for graph neural network analysis, improving the targetedness and efficiency of the model.

10. The method for tracing and analyzing the flow of funds in financial cases as claimed in claim 8, characterized in that: In the feature extraction sub-step, the transaction network data is loaded from the graph database, including the information of all nodes and edges; For nodes, the system needs to extract features including account ID, account type, transaction frequency, transaction amount, and centrality index; transaction frequency refers to the number of transactions of an account in a certain period of time, which is obtained by calculating the degree centrality of the node, and the transaction amount is the sum or average of all transaction amounts of the account; the centrality index is calculated through the social network analysis process, reflecting the importance and connectivity of the node in the network; For edges, the system needs to extract features including transaction amount, transaction time, transaction type, and transaction frequency; transaction amount refers to the specific amount of each transaction, transaction time refers to the timestamp of the transaction, and transaction type refers to the specific nature of the transaction; transaction frequency refers to the number of transactions between two nodes within a certain period of time, which is calculated by counting the number of transactions between the same node pairs; The feature extraction stage also needs to process the high-dimensional features of nodes and edges and convert them into low-dimensional embedding representations. The system will process the feature extraction tasks of nodes and edges in parallel. The system will store the extracted features in memory or distributed storage systems for subsequent model training and prediction. In the model training sub-step, the feature data generated in the previous step is first received, including the feature vectors of nodes and edges; then, the system selects an appropriate graph neural network model for training, including: Graph Convolutional Network (GCN) and Graph Attention Network (GAT); For graph convolutional networks (GCNs), the system aggregates node neighbor information layer by layer through convolution operations to learn the global features of nodes. At the beginning of the training process, the system initializes the model parameters, including the weight matrix and bias terms. Then, the system inputs the feature data into the model, calculates the convolution operation of each layer, and obtains the new feature representation of each node by weighted summation of the features of the node and its neighbor nodes. After the convolution operation of each layer, the system applies a nonlinear activation function to further enhance the expressiveness of the model. The Graph Attention Network (GAT) uses the attention mechanism to assign different weights to the neighbors of each node, and learn the relationship between nodes more flexibly. The system first initializes the attention weights and inputs the node features into the model. For each node, the system calculates the attention score between it and its neighbor nodes, and obtains the new feature representation of the node by multiplying the node feature with the attention weight. GAT applies a nonlinear activation function after each layer of operation. During the training process, the system uses the training data for forward propagation to calculate the model output. For supervised learning, the system compares the model output with the true label and calculates the loss function. Then, the system uses the back-propagation algorithm to calculate the gradient of the loss function with respect to the model parameters and updates the model parameters to minimize the loss function. This process is repeated until the loss function converges or the preset number of training rounds is reached. The system divides the training data into multiple mini-batches and inputs them into the model for training one by one to improve computational efficiency and the generalization ability of the model. After each training cycle, the system uses the validation data set to evaluate the model performance to prevent the model from overfitting. The validation process includes calculating the validation loss and accuracy, and monitoring the performance of the model on the validation set. The system will use parallel computing and distributed training technology; through multi-threaded or distributed computing frameworks, the system can accelerate the model training process and process large-scale transaction network data; in addition, the system will use optimization algorithms to adjust the learning rate and model parameters; After the model training is completed, the system will save the trained model parameters and structure as the basis for subsequent prediction and application; the trained model can accurately capture the complex relationships and patterns in the transaction network and identify normal and abnormal transaction behaviors; In the model prediction and application sub-step, new transaction data is first received, and node and edge features are extracted and standardized. The extracted feature data is then used as input to the trained graph neural network model. Before inputting data into the model, the system will first load the trained model parameters and structure; model parameters include weight matrix and bias term, while model structure includes the number of network layers, number of nodes in each layer and activation function information; after loading, the system will input the features of new data into the model for forward propagation calculation; during the forward propagation process, the system calculates the feature representation of nodes layer by layer, aggregates the information of neighboring nodes through convolution operation or attention mechanism, and generates new node feature representation; Model reasoning calculation; for the graph convolutional network (GCN), the system aggregates the neighbor information of the node layer by layer through convolution operations to obtain a new feature representation of each node; for the graph attention network (GAT), the system assigns different weights to the neighbors of each node by calculating the attention score, and flexibly learns the relationship between nodes; no matter which model is used, the final output is the predicted score or classification label of each node; Post-process the output of the model; for classification tasks, the classification label output by the model indicates the category of the node or edge, including: normal transaction or abnormal transaction; for regression tasks, the predicted score output by the model indicates the suspiciousness of the transaction, and the higher the score, the more suspicious the transaction; the system will mark transactions with scores higher than the threshold as abnormal transactions based on the preset threshold, and record the detailed information of these abnormal transactions.

11. The method for tracing and analyzing the flow of funds in financial cases according to claim 1, characterized in that: The fund flow tracking step includes: fund flow path tracking and fund flow path report generation; The fund flow path tracking sub-step tracks the flow path of suspicious funds in the transaction network, and records in detail the entire process of funds from the source account to the final destination. By revealing the flow pattern and path of funds, key nodes and potential transit accounts are identified, providing specific action guidance for recovering stolen money and preventing losses; The fund flow path report generation sub-step organizes and visualizes the analysis results of the fund flow path tracking link to generate a detailed fund flow path report. The report intuitively displays the flow process of suspicious funds, the key nodes involved and the transaction paths, and provides clear guidance for financial institutions and law enforcement agencies to recover stolen money and prevent losses.

Images