Transaction anomaly detection method and system based on financial analysis

Abstract

The invention discloses a financial analysis-based transaction anomaly detection method and system, and the method comprises the steps: obtaining transaction network data, calculating a risk index through node transaction data, and marking the risk index as an abnormal node if the risk index exceeds a threshold value; obtaining transaction links associated with the abnormal nodes to form a to-be-detected set, performing time sequence segmentation processing on the to-be-detected set to generate transaction segmentation points, and collecting multi-dimensional data to construct a transaction feature matrix; calculating the mode similarity between a to-be-detected link and a normal link, screening the high-similarity normal link, clustering the feature matrix of the high-similarity normal link, and generating a reference clustering center; and by calculating the deviation degree between the feature matrix of the link to be detected and the reference center, determining that the link is an abnormal transaction link if the threshold value is super dynamic. According to the invention, through multi-dimensional node modeling, time sequence dynamic feature analysis and mode matching, accurate identification of abnormal transaction nodes and links is realized, and detection comprehensiveness and prevention and control accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data anomaly detection, and in particular to a transaction anomaly detection method and system based on financial analysis. Background Art

[0002] In the field of financial transaction risk prevention and control, existing transaction anomaly detection technologies face key problems such as insufficient multi-dimensional risk identification capabilities, extensive time series feature analysis, low pattern matching accuracy, and lack of systematic risk assessment. Specifically: First, traditional methods focus on a single transaction element (such as only focusing on the credit of the transaction subject or the compliance of the amount of a single transaction), and lack collaborative modeling of the attributes of the transaction subject, the characteristics of the transaction type, and the laws of the time period. This makes it difficult to effectively identify cross-dimensional correlation risks (for example, a certain type of transaction subject triggers abnormal transaction types with a high frequency within a specific time period). Second, time series analysis generally uses fixed time windows to divide transaction links, and is unable to dynamically capture key segmentation points such as sudden changes in transaction amounts and abnormal operation time intervals. It only extracts static features (such as the average transaction amount) and ignores the quantitative analysis of behavioral differences in adjacent time periods, making it difficult to detect progressive abnormal patterns (such as covert operations of transferring funds in stages). Third, pattern similarity calculations are often complex. Relying on static attributes (such as the main industry classification) or a single dynamic indicator (such as the standard deviation of the transaction amount), without integrating time series characteristics (such as the entropy of the operation time distribution and the frequency of counterparty changes), the normal transaction benchmark sample does not match the business scenario of the link to be detected, and the abnormal judgment is easily interfered by noise; fourthly, the risk threshold is mostly a fixed value preset by humans, which cannot be dynamically adjusted according to the distribution of historical transaction data (such as the difference in fluctuations during business peak and trough periods), resulting in an imbalance between the false alarm rate and the missed detection rate; fifthly, anomaly detection remains at the level of independent nodes or single links, lacking analysis of the network-level correlation relationship of abnormal transactions (such as the risk transmission path and the diffusion effect of abnormal nodes), making it difficult to form a layered prevention and control strategy based on risk levels. Summary of the Invention

[0003] In order to solve at least one of the technical problems mentioned above, the present invention provides a transaction anomaly detection method and system based on financial analysis.

[0004] In a first aspect, the present invention provides a transaction anomaly detection method based on financial analysis, the method comprising:

[0005] Acquire and process transaction network data to obtain transaction nodes, including transaction subject nodes, transaction type nodes, and time period nodes; obtain node risk indicators based on the node transaction data of the transaction nodes; if the node risk indicator exceeds a preset risk threshold, mark the node as an abnormal transaction node;

[0006] Acquire the transaction links associated with the abnormal transaction node to generate a set of transactions to be detected; perform time-series segmentation processing on the transactions to be detected to obtain multiple transaction segmentation points; collect multi-dimensional transaction data of each segmentation point and perform standardization processing to generate a transaction feature matrix;

[0007] Calculate the pattern similarity between the transaction link to be detected and the normal transaction link. The pattern similarity is constructed based on the transaction subject attributes, transaction amount distribution, and time series characteristics. Select normal transaction links with pattern similarity greater than a preset threshold, perform cluster analysis on their transaction feature matrix, and obtain the benchmark cluster center.

[0008] The deviation between the transaction feature matrix of the transaction link to be detected and the benchmark cluster center is calculated. If the deviation exceeds a dynamic threshold, it is determined to be an abnormal transaction link.

[0009] Preferably, obtaining the node risk indicator based on the node transaction data of the transaction node includes:

[0010] Calculate the first risk indicator based on the historical behavior data of the transaction subject node. If the indicator exceeds the subject credit threshold, it will be marked as an abnormal subject node;

[0011] Calculate the second risk indicator based on the amount volatility of the transaction type node. If the indicator exceeds the type compliance threshold, the node is marked as an abnormal type.

[0012] The third risk indicator is calculated based on the transaction frequency and sudden increase in amount at the time period node. If the indicator exceeds the period stability threshold, it is marked as an abnormal time node.

[0013] Preferably, generating a transaction feature matrix includes:

[0014] The transaction link to be tested is evenly divided into N+2 segments along the time axis, generating N+1 segmentation points;

[0015] Collect the transaction amount, counterparty characteristics, and operation time interval of each segment point to form a feature vector of length K;

[0016] Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K.

[0017] Preferably, the calculation of the pattern similarity includes:

[0018] Extract the static attribute vector and dynamic behavior vector of the transaction link. The static attributes include the subject's industry classification, registered capital, and historical violation records. The dynamic behavior includes the standard deviation of the recent transaction amount and the time distribution entropy value.

[0019] The comprehensive similarity between the transaction link to be detected and the normal transaction link is calculated using the cosine similarity algorithm, and the normal links with similarity higher than the threshold are selected as the cluster analysis sample set.

[0020] Preferably, the cluster analysis includes:

[0021] Extract statistical indicators of the transaction feature matrix to construct a dimensionality reduction vector, including kurtosis, skewness, maximum singular value, and covariance matrix condition number;

[0022] Perform density clustering on the reduced-dimensional vectors to generate benchmark cluster centers.

[0023] In a second aspect, the present invention further provides a transaction anomaly detection system based on financial analysis, the system comprising:

[0024] A transaction node monitoring module is configured to acquire and process transaction network data to obtain transaction nodes, including transaction subject nodes, transaction type nodes, and time period nodes; obtain node risk indicators based on the node transaction data of the transaction nodes; and mark the node as an abnormal transaction node if the node risk indicator exceeds a preset risk threshold;

[0025] The transaction link analysis module is used to obtain the transaction links associated with the abnormal transaction node and generate a set of transactions to be detected; perform time-series segmentation processing on the transactions to be detected to obtain multiple transaction segmentation points; collect multi-dimensional transaction data of each segmentation point and perform normalization processing to generate a transaction feature matrix;

[0026] The pattern clustering benchmark module is used to calculate the pattern similarity between the transaction link to be detected and the normal transaction link. The pattern similarity is constructed based on the transaction subject attributes, transaction amount distribution, and time series characteristics. Normal transaction links with pattern similarity greater than a preset threshold are screened and cluster analysis is performed on their transaction feature matrix to obtain the benchmark cluster center.

[0027] The anomaly detection and determination module is used to calculate the deviation between the transaction feature matrix of the transaction link to be detected and the reference cluster center. If the deviation exceeds a dynamic threshold, it is determined to be an abnormal transaction link.

[0028] Preferably, the transaction node monitoring module is further used to:

[0029] Calculate the first risk indicator based on the historical behavior data of the transaction subject node. If the indicator exceeds the subject credit threshold, it will be marked as an abnormal subject node;

[0030] Calculate the second risk indicator based on the amount volatility of the transaction type node. If the indicator exceeds the type compliance threshold, the node is marked as an abnormal type.

[0031] The third risk indicator is calculated based on the transaction frequency and sudden increase in amount at the time period node. If the indicator exceeds the period stability threshold, it is marked as an abnormal time node.

[0032] Preferably, the transaction link analysis module is further used to:

[0033] The transaction link to be tested is evenly divided into N+2 segments along the time axis, generating N+1 segmentation points;

[0034] Collect the transaction amount, counterparty characteristics, and operation time interval of each segment point to form a feature vector of length K;

[0035] Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K.

[0036] In a third aspect, the present invention also provides an electronic device comprising a processor and a memory, wherein the memory is used to store computer program code, and the computer program code comprises computer instructions. When the processor executes the computer instructions, the electronic device executes the method as described in the first aspect above and any possible implementation thereof.

[0037] In a fourth aspect, the present invention also provides a computer-readable storage medium, in which a computer program is stored. The computer program includes program instructions, and when the program instructions are executed by a processor of an electronic device, the processor executes the method as described in the first aspect above and any possible implementation method thereof.

[0038] Compared with the prior art, the present invention has the following beneficial effects:

[0039] The present invention realizes three-dimensional modeling of the transaction network and quantification of node risks by constructing a multi-dimensional node system including transaction subjects, types, and time periods. It combines time series segmentation processing, pattern similarity analysis, and dynamic threshold judgment to form a progressive detection architecture of "node risk identification-link pattern matching-network risk integration". It can not only accurately locate abnormal transaction nodes and links, but also capture the dynamic characteristics and pattern differences of transaction behaviors through cluster analysis and deviation calculation. Finally, it integrates the risk network and generates graded early warning signals, effectively improving the comprehensiveness and real-time nature of anomaly detection and the targetedness of risk prevention and control, avoiding the one-sidedness of single-dimensional detection and the limitations of fixed thresholds, and providing a systematic solution for risk assessment in complex transaction scenarios.

[0040] It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the background technology, the drawings required for use in the embodiments of the present invention or the background technology will be described below.

[0042] The accompanying drawings herein are incorporated into and constitute a part of the specification. These drawings illustrate embodiments consistent with the present disclosure and, together with the specification, are used to explain the technical solutions of the present disclosure.

[0043] Figure 1 A flowchart of a transaction anomaly detection method based on financial analysis provided by an embodiment of the present invention;

[0044] Figure 2 A schematic diagram of the structure of a transaction anomaly detection system based on financial analysis provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0046] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present invention. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute a separate or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0047] Existing transaction anomaly detection technologies have problems such as one-sided multi-dimensional risk identification, rough analysis of time series characteristics, insufficient pattern matching accuracy, lack of dynamic adaptability in threshold setting, and failure to form network-level linkage in risk assessment, which limits the comprehensiveness, real-time nature, and targeted prevention and control of anomaly detection.

[0048] See also Figure 1 , Figure 1 The flowchart of a transaction anomaly detection method based on financial analysis provided by an embodiment of the present invention is as follows. Figure 1 As shown, the method includes:

[0049] S100, acquiring and processing transaction network data to obtain transaction nodes, wherein the transaction nodes include transaction subject nodes, transaction type nodes, and time period nodes; obtaining node risk indicators based on the node transaction data of the transaction nodes; if the node risk indicator exceeds a preset risk threshold, the node is marked as an abnormal transaction node;

[0050] In this embodiment, transaction network layout data can be obtained from enterprise resource planning systems, financial transaction systems, or blockchain ledgers, and a transaction network graph can be constructed using graph database technology. Transaction subject nodes can be further divided into natural persons and legal entities. Each subject node contains a unique identifier, subject attributes (such as industry classification, registered capital, and credit rating), and historical transaction records. Transaction type nodes include, but are not limited to, operation types such as transfers, payments, investments, and financing. Each type node is associated with a transaction rule base for verifying transaction compliance. Time period nodes can be divided by year, quarter, month, day, or business cycle. Each period node contains features such as transaction frequency, amount distribution, and time entropy. Node transaction data for these transaction nodes is obtained and processed to obtain a node risk indicator. If the node risk indicator exceeds a preset risk threshold, the node is marked as an abnormal transaction node. The node transaction data processing process includes data cleaning, feature extraction, and risk quantification. For example, for transaction subject nodes, machine learning algorithms analyze historical behavioral data to construct behavioral profiles and calculate the primary risk indicator. For transaction type nodes, time series analysis techniques are used to monitor the volatility of transaction amounts and calculate the secondary risk indicator. For time period nodes, statistical process control methods are used to detect transaction frequency and sudden increases in transaction amounts and calculate the third risk indicator. Each risk indicator is compared against its corresponding threshold using a dynamic sliding window mechanism to ensure real-time and accurate detection.

[0051] S200, obtaining a transaction link associated with the abnormal transaction node to generate a set of transactions to be detected; performing time-series segmentation processing on the transactions to be detected to obtain multiple transaction segmentation points; collecting multi-dimensional transaction data of each segmentation point and performing normalization processing to generate a transaction feature matrix;

[0052] Transaction links associated with the abnormal transaction node are obtained to generate a set of transactions to be tested. This step uses a graph traversal algorithm (such as breadth-first search) to obtain a K-degree adjacent subgraph centered on the abnormal node and extract transaction path information. Each transaction link contains a complete transaction process record, including elements such as the transaction initiator, recipient, intermediate nodes, transaction amount, timestamp, and transaction type. The transactions to be tested are segmented into time series segments, resulting in M+1 transaction segment points. This segmentation process utilizes adaptive time window technology to dynamically adjust the segment point positions based on the rate of change in transaction behavior. For example, segment points are set at transaction amount abrupt changes, transaction type transitions, or time interval anomalies to ensure relative stability of the behavioral patterns within each transaction segment. Multi-dimensional transaction data is collected and standardized at each segment point to generate a transaction feature matrix. This multi-dimensional transaction data includes transaction amount, counterparty characteristics (such as credit rating and transaction frequency), transaction time interval, transaction channel, and device information. Standardization processing uses Z-score normalization or Min-Max scaling technology to eliminate the dimensionality impact of data of different dimensions and ensure the comparability of feature matrices.

[0053] S300: Calculate the pattern similarity between the transaction link to be detected and normal transaction links. The pattern similarity is constructed based on transaction subject attributes, transaction amount distribution, and time series characteristics. Select normal transaction links with pattern similarity greater than a preset threshold, perform cluster analysis on their transaction feature matrix, and obtain a benchmark cluster center.

[0054] Calculate the pattern similarity between the transaction link to be detected and the normal transaction link. The pattern similarity is constructed based on the attributes of the transaction subject, the distribution of the transaction amount, and the time series characteristics. The pattern similarity calculation uses a hybrid feature space model to fuse static attribute characteristics with dynamic behavior characteristics. For example, the main characteristics of the transaction amount distribution are extracted through principal component analysis dimensionality reduction technology, and the similarity of the time series is calculated using the dynamic time warping algorithm. The comprehensive similarity score is obtained through weighted summation. Normal transaction links with pattern similarity greater than a preset threshold are screened, and their transaction feature matrix is ​​clustered and analyzed to obtain the benchmark cluster center. Cluster analysis uses density clustering or hierarchical clustering algorithms to classify links with similar transaction patterns into the same category. The benchmark cluster center represents the typical behavior pattern of this type of transaction and can be obtained by calculating the mean vector or median vector of all samples in the category.

[0055] S400: Calculate the deviation between the transaction feature matrix of the transaction link to be detected and the reference cluster center. If the deviation exceeds a dynamic threshold, determine it as an abnormal transaction link.

[0056] The deviation between the transaction feature matrix of the transaction link to be detected and the benchmark cluster center is calculated. If the deviation exceeds a dynamic threshold, the transaction link is identified as an abnormal transaction link. Deviation calculation uses the Mahalanobis distance or cosine distance metric. The dynamic threshold is dynamically adjusted based on the distribution characteristics of historical normal transaction data to ensure the adaptability of the detection standard.

[0057] One possible embodiment also involves integrating all abnormal transaction links into a risky transaction network, and generating graded warning signals based on the location and risk level of abnormal transaction nodes. The risky transaction network uses graph visualization technology to display the relationships between abnormal transactions, and the DeepWalk graph embedding algorithm is used to analyze risk transmission paths. Graded warning signals are generated based on the deviation value of the abnormal link, the number of associated abnormal nodes, and the length of the risk transmission path. These warning signals are then sent to the terminals of grassroots risk control personnel, department heads, and senior management, respectively.

[0058] In this embodiment, by constructing a multi-dimensional node system that includes transaction entities, types, and time periods, three-dimensional modeling of the transaction network and quantification of node risks are achieved. Combined with time series segmentation processing, pattern similarity analysis, and dynamic threshold judgment, a progressive detection architecture of "node risk identification-link pattern matching-network risk integration" is formed. This can not only accurately locate abnormal transaction nodes and links, but also capture the dynamic characteristics and pattern differences of transaction behaviors through cluster analysis and deviation calculation. Finally, the risk network is integrated and a graded warning signal is generated, effectively improving the comprehensiveness and real-time nature of anomaly detection and the targetedness of risk prevention and control, avoiding the one-sidedness of single-dimensional detection and the limitations of fixed thresholds, and providing a systematic solution for risk assessment in complex transaction scenarios.

[0059] Preferably, obtaining the node risk indicator based on the node transaction data of the transaction node includes:

[0060] Calculate the first risk indicator based on the historical behavior data of the transaction subject node. If the indicator exceeds the subject credit threshold, it will be marked as an abnormal subject node;

[0061] Historical behavioral data includes transaction frequency, transaction amount distribution, counterparty change frequency, and capital flow concentration. By constructing a behavioral scorecard model, a weighted sum of these characteristics is used to derive the primary risk indicator. For example, entities that frequently change counterparties or whose capital flows are concentrated in high-risk industries will have their primary risk indicator values ​​significantly elevated. Entity credit thresholds are dynamically adjusted based on industry characteristics, enterprise size, and historical default rates to ensure the industry adaptability of the assessment criteria.

[0062] Calculate the second risk indicator based on the amount volatility of the transaction type node. If the indicator exceeds the type compliance threshold, the node is marked as an abnormal type.

[0063] Amount volatility is calculated by calculating the standard deviation or coefficient of variation of transaction amounts within a specific time window. For example, for a regular rental payment transaction, if the amount volatility exceeds a preset threshold, it may indicate an abnormal operation. Type compliance thresholds are set based on the inherent characteristics of the transaction type. For example, the volatility threshold for investment transactions is generally higher than that for daily consumption transactions.

[0064] The third risk indicator is calculated based on the transaction frequency and sudden increase in amount at the time period node. If the indicator exceeds the period stability threshold, it is marked as an abnormal time node.

[0065] Sudden increases in transaction frequency are determined by comparing the number of transactions in the current period with the same period in history. Sudden increases in amount are calculated by calculating the deviation between the total amount in the current period and the historical average. For example, large transactions during non-settlement periods, or an unusual increase in transaction frequency during holidays, could trigger an anomaly alert. The cycle stability threshold is dynamically determined based on industry transaction habits and the company's own operating patterns to avoid false positives.

[0066] Preferably, generating a transaction feature matrix includes:

[0067] The transaction link to be tested is evenly divided into N+2 segments along the time axis, generating N+1 segmentation points;

[0068] Collect the transaction amount, counterparty characteristics, and operation time interval of each segment point to form a feature vector of length K;

[0069] Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K.

[0070] Based on the start time of the transaction link and end time , calculate the total time span . Preset the number of basic segments according to the business type (such as high-frequency trading =20, low frequency large amount transaction =5), and calculate the initial segment length Traverse the transaction time series and calculate the time interval between adjacent transactions . Use a sliding window (window size is k) to calculate the standard deviation of the time interval ,like Exceeding the threshold (e.g. 0.8 times the median absolute deviation), then insert an additional segment point at the center of the window. Apply a change point detection algorithm (such as the Pelt algorithm) and add segmentation points at the detected change points to ensure that the sudden changes in the amount are divided into independent time periods.

[0071] The transaction amount, counterparty characteristics, and operation time interval of each segment point are collected to form a feature vector of length K. The specific feature dimensions and quantification methods are as follows:

[0072] Transaction amount characteristics, total transaction amount within the segment , average amount , maximum amount max (a), minimum amount min (a), amount variation coefficient ( is the standard deviation), reflecting the degree of fluctuation of the amount;

[0073] Counterparty characteristics, counterparty credit rating R (using third-party rating agencies, such as Standard & Poor's rating, mapped to a value of 1-20), transaction frequency F = m / M (m is the number of transactions with the counterparty within a segment, M is the total number of transactions within a segment), industry relevance ( is the transaction weight, is the industry similarity function, is the counterparty industry category, as the main industry category);

[0074] Operation time characteristics, transaction time entropy within the segment ( is the probability of a transaction occurring in the i-th time slot), the time offset from the business peak period ( is the median transaction time within the segment, peak period for the industry).

[0075] Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K. Perform Z-score normalization: ,in and are the historical mean and standard deviation of the feature dimension respectively. Calculate the difference between adjacent standardized feature vectors: , get N differential eigenvectors . Splice the difference vectors into a matrix in time order , dimension is N×K, feature enhancement is performed on matrix D: calculate the L norm of each row , as the weight vector W of the row; apply principal component analysis to each column for dimensionality reduction, retain the principal components with a cumulative variance contribution rate of 95%, and form the final transaction feature matrix D'.

[0076] In a possible embodiment, a company has 120 foreign exchange transactions with a total amount of RMB 50 million between January 1 and 31, 2024. The daily transaction is divided into 33 segments ( =31), then, through time interval standard deviation testing, added segmentation points on January 15 (financial statement closing date) and January 25 (year-end bonus payment date). The eigenvector for one segmentation point included: total transaction amount of US$8 million, counterparty credit rating of A (mapped value of 15), transaction frequency with offshore companies of 0.35, industry correlation of 0.72, and temporal entropy of 2.8 (close to uniform distribution). A differential calculation revealed that the difference between the eigenvectors for January 16 and January 15 in the "offshore transaction frequency" dimension reached 2.3σ, triggering further anomaly analysis.

[0077] In this embodiment, adaptive time-series segmentation technology is used to dynamically divide transaction links according to the time change rate. Combined with multi-dimensional feature vector construction and differential operations, a feature matrix is ​​formed that can fully preserve the time dependence and dynamic change laws of transaction behavior. It not only highlights the behavioral differences between adjacent time periods to enhance the sensitivity to abnormal fluctuations, but also optimizes computational efficiency through PCA dimensionality reduction, providing a high-quality data foundation for subsequent pattern matching and cluster analysis, enhancing the ability to characterize periodic transaction patterns and emergencies, and enabling more accurate identification of progressive risk evolution and early signs of abnormalities.

[0078] Preferably, the calculation of the pattern similarity includes:

[0079] Extract the static attribute vector and dynamic behavior vector of the transaction link. The static attributes include the subject's industry classification, registered capital, and historical violation records. The dynamic behavior includes the standard deviation of the recent transaction amount and the time distribution entropy value.

[0080] The comprehensive similarity between the transaction link to be detected and the normal transaction link is calculated using the cosine similarity algorithm, and the normal links with similarity higher than the threshold are selected as the cluster analysis sample set.

[0081] Static attribute vectors are obtained from data sources such as enterprise registration databases and regulatory information platforms using entity resolution technology. Dynamic behavior vectors are calculated through time series analysis and information entropy theory. For example, the time distribution entropy value reflects the regularity of transaction time. Higher entropy values ​​indicate more dispersed transaction time, indicating the possibility of abnormal operations.

[0082] The cosine similarity algorithm is used to calculate the comprehensive similarity between the transaction link under investigation and normal transaction links. Normal links with similarity above a threshold are selected as the sample set for cluster analysis. Cosine similarity calculation is performed in a high-dimensional feature space, combining static attribute vectors with dynamic behavior vectors according to a certain weight to measure similarity. Weighting coefficients are dynamically adjusted based on business scenarios and risk concerns. For example, in anti-money laundering scenarios, the weight of historical violation records can be appropriately increased; in liquidity risk monitoring, the weight of the standard deviation of transaction amounts can be increased. These selected normal links with high similarity form the baseline sample for cluster analysis, ensuring the reliability of the clustering results.

[0083] Preferably, the cluster analysis includes:

[0084] Extract statistical indicators of the transaction feature matrix to construct a dimensionality reduction vector, including kurtosis, skewness, maximum singular value, and covariance matrix condition number;

[0085] Perform density clustering on the reduced-dimensional vectors to generate benchmark cluster centers.

[0086] In one possible embodiment, the Frobenius norm is used to calculate the distance between transaction feature matrices, and the K-means algorithm is used to generate benchmark cluster centers. The Frobenius norm is the square root of the sum of the squares of matrix elements and is suitable for measuring the overall differences between matrices. The K-means algorithm uses iterative optimization to partition the transaction feature matrix into K clusters, with the centroid of each cluster serving as the benchmark cluster center. This method is computationally efficient and suitable for rapid clustering of large-scale transaction data.

[0087] Statistical indicators of the transaction feature matrix are extracted to construct a dimensionality reduction vector, including kurtosis, skewness, maximum singular value, and covariance matrix condition number. Density clustering is then performed on the reduced dimensionality vector to generate benchmark cluster centers. Kurtosis and skewness reflect the morphological characteristics of the data distribution, while the maximum singular value and covariance matrix condition number characterize the algebraic properties of the matrix. Principal component analysis dimensionality reduction techniques are used to compress the high-dimensional feature matrix into a low-dimensional vector. Density clustering algorithms such as DBSCAN are then used to generate benchmark cluster centers. This method effectively handles non-spherical data and improves clustering accuracy.

[0088] In one possible embodiment, the 3σ principle or quantile method dynamically adjusts the judgment threshold based on the deviation distribution of historically normal transaction links. The 3σ principle, based on the normal distribution assumption, sets the threshold at the mean plus three standard deviations, effectively identifying 99.7% of outliers. The quantile method selects an appropriate quantile (such as the 95th or 99th percentile) as the threshold based on the actual data distribution and is suitable for non-normally distributed data. A dynamic adjustment mechanism regularly (e.g., daily or weekly) updates the threshold based on the latest historical data to ensure that the detection standard remains synchronized with changes in the business environment. For example, during peak business periods, when transaction volatility increases, the threshold is raised accordingly; during low business periods, the threshold is appropriately lowered to improve detection sensitivity.

[0089] In another possible embodiment, based on the deviation value of an abnormal transaction link, the number of associated abnormal nodes, and the risk transmission path, three levels of warnings—low, medium, and high—are generated and pushed to the corresponding risk control terminals. The deviation value directly reflects the degree of abnormality, the number of associated abnormal nodes reflects the scope of risk spread, and the risk transmission path reveals the direction of risk transmission and the depth of impact. For example, a transaction link with a high deviation value, multiple associated abnormal nodes, and a long risk transmission path will be judged as high risk and trigger a red warning. Conversely, a transaction link with a low deviation value, only a single associated abnormal node, and a short transmission path will be judged as low risk and trigger a yellow warning. Warning information at each level is pushed to the corresponding risk control terminal through the enterprise risk control platform's message center and visualized on the risk dashboard, supporting drill-down analysis and linked queries.

[0090] In summary, the method provided in this embodiment can at least achieve the following effects:

[0091] The present invention realizes three-dimensional modeling of the transaction network and quantification of node risks by constructing a multi-dimensional node system including transaction subjects, types, and time periods. It combines time series segmentation processing, pattern similarity analysis, and dynamic threshold judgment to form a progressive detection architecture of "node risk identification-link pattern matching-network risk integration". It can not only accurately locate abnormal transaction nodes and links, but also capture the dynamic characteristics and pattern differences of transaction behaviors through cluster analysis and deviation calculation. Finally, it integrates the risk network and generates graded early warning signals, effectively improving the comprehensiveness and real-time nature of anomaly detection and the targetedness of risk prevention and control, avoiding the one-sidedness of single-dimensional detection and the limitations of fixed thresholds, and providing a systematic solution for risk assessment in complex transaction scenarios.

[0092] See also Figure 2 In one embodiment, a transaction anomaly detection system based on financial analysis is also provided, the system comprising:

[0093] The transaction node monitoring module 100 is configured to acquire and process transaction network data to obtain transaction nodes, including transaction subject nodes, transaction type nodes, and time period nodes; obtain node risk indicators based on the node transaction data of the transaction nodes; and mark the node as an abnormal transaction node if the node risk indicator exceeds a preset risk threshold;

[0094] The transaction link analysis module 200 is configured to obtain the transaction links associated with the abnormal transaction node and generate a set of transactions to be detected; perform time-series segmentation processing on the transactions to be detected to obtain multiple transaction segmentation points; collect and standardize multi-dimensional transaction data at each segmentation point to generate a transaction feature matrix;

[0095] The pattern clustering benchmark module 300 is used to calculate the pattern similarity between the transaction link to be detected and the normal transaction link. The pattern similarity is constructed based on the transaction subject attributes, transaction amount distribution, and time series characteristics. Normal transaction links with pattern similarity greater than a preset threshold are screened and cluster analysis is performed on their transaction feature matrix to obtain the benchmark cluster center.

[0096] The abnormality detection and determination module 400 is used to calculate the deviation between the transaction feature matrix of the transaction link to be detected and the reference cluster center. If the deviation exceeds a dynamic threshold, it is determined to be an abnormal transaction link.

[0097] Preferably, the transaction node monitoring module is further used to:

[0098] Calculate the first risk indicator based on the historical behavior data of the transaction subject node. If the indicator exceeds the subject credit threshold, it will be marked as an abnormal subject node;

[0099] Calculate the second risk indicator based on the amount volatility of the transaction type node. If the indicator exceeds the type compliance threshold, the node is marked as an abnormal type.

[0100] The third risk indicator is calculated based on the transaction frequency and sudden increase in amount at the time period node. If the indicator exceeds the period stability threshold, it is marked as an abnormal time node.

[0101] Preferably, the transaction link analysis module is further used to:

[0102] The transaction link to be tested is evenly divided into N+2 segments along the time axis, generating N+1 segmentation points;

[0103] Collect the transaction amount, counterparty characteristics, and operation time interval of each segment point to form a feature vector of length K;

[0104] Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K.

[0105] It can be understood that the functions or modules included in the system provided in this embodiment can be used to execute the method described in the above method embodiment. Its specific implementation can refer to the description of the above method embodiment. For the sake of brevity, it will not be repeated here.

[0106] The present invention also provides an electronic device, including a processor and a memory, wherein the memory is used to store computer program code, and the computer program code includes computer instructions. When the processor executes the computer instructions, the electronic device executes a method as described in any one of the possible implementation modes.

[0107] The present invention also provides a computer-readable storage medium, in which a computer program is stored. The computer program includes program instructions. When the program instructions are executed by a processor of an electronic device, the processor executes a method as described in any one of the possible implementation methods described above.

[0108] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present invention.

[0109] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here. Those skilled in the art will also clearly understand that the descriptions of the various embodiments of the present invention have different focuses. For the convenience and brevity of description, the same or similar parts may not be repeated in different embodiments. Therefore, for parts not described or not described in detail in a certain embodiment, reference can be made to the descriptions of other embodiments.

Claims

1. A transaction anomaly detection method based on financial analysis, characterized in that: The method comprises: Acquire and process transaction network data to obtain transaction nodes, including transaction subject nodes, transaction type nodes, and time period nodes; obtain node risk indicators based on the node transaction data of the transaction nodes; if the node risk indicator exceeds a preset risk threshold, mark the node as an abnormal transaction node; Acquire the transaction links associated with the abnormal transaction node to generate a set of transactions to be detected; perform time-series segmentation processing on the transactions to be detected to obtain multiple transaction segmentation points; collect multi-dimensional transaction data of each segmentation point and perform standardization processing to generate a transaction feature matrix; Calculate the pattern similarity between the transaction link to be detected and the normal transaction link. The pattern similarity is constructed based on the transaction subject attributes, transaction amount distribution, and time series characteristics. Select normal transaction links with pattern similarity greater than a preset threshold, perform cluster analysis on their transaction feature matrix, and obtain the benchmark cluster center. The deviation between the transaction feature matrix of the transaction link to be detected and the benchmark cluster center is calculated. If the deviation exceeds a dynamic threshold, it is determined to be an abnormal transaction link.

2. The transaction anomaly detection method based on financial analysis according to claim 1, characterized in that: The node risk indicator is obtained based on the node transaction data of the transaction node, including: Calculate the first risk indicator based on the historical behavior data of the transaction subject node. If the indicator exceeds the subject credit threshold, it will be marked as an abnormal subject node; Calculate the second risk indicator based on the amount volatility of the transaction type node. If the indicator exceeds the type compliance threshold, the node is marked as an abnormal type. The third risk indicator is calculated based on the transaction frequency and sudden increase in amount at the time period node. If the indicator exceeds the period stability threshold, it is marked as an abnormal time node.

3. The transaction anomaly detection method based on financial analysis according to claim 2, characterized in that: Generating a transaction feature matrix includes: The transaction link to be tested is evenly divided into N+2 segments along the time axis, generating N+1 segmentation points; Collect the transaction amount, counterparty characteristics, and operation time interval of each segment point to form a feature vector of length K; Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K.

4. The transaction anomaly detection method based on financial analysis according to claim 1, characterized in that: The calculation of the pattern similarity includes: Extract the static attribute vector and dynamic behavior vector of the transaction link. The static attributes include the subject's industry classification, registered capital, and historical violation records. The dynamic behavior includes the standard deviation of the recent transaction amount and the time distribution entropy value. The comprehensive similarity between the transaction link to be detected and the normal transaction link is calculated using the cosine similarity algorithm, and the normal links with similarity higher than the threshold are selected as the cluster analysis sample set.

5. The transaction anomaly detection method based on financial analysis according to claim 1, characterized in that: The cluster analysis includes: Extract statistical indicators of the transaction feature matrix to construct a dimensionality reduction vector, including kurtosis, skewness, maximum singular value, and covariance matrix condition number; Perform density clustering on the reduced-dimensional vectors to generate benchmark cluster centers.

6. A transaction anomaly detection system based on financial analysis, characterized in that: The system comprises: A transaction node monitoring module is configured to acquire and process transaction network data to obtain transaction nodes, including transaction subject nodes, transaction type nodes, and time period nodes; obtain node risk indicators based on the node transaction data of the transaction nodes; and mark the node as an abnormal transaction node if the node risk indicator exceeds a preset risk threshold; The transaction link analysis module is used to obtain the transaction links associated with the abnormal transaction node and generate a set of transactions to be detected; perform time-series segmentation processing on the transactions to be detected to obtain multiple transaction segmentation points; collect multi-dimensional transaction data of each segmentation point and perform normalization processing to generate a transaction feature matrix; The pattern clustering benchmark module is used to calculate the pattern similarity between the transaction link to be detected and the normal transaction link. The pattern similarity is constructed based on the transaction subject attributes, transaction amount distribution, and time series characteristics. Normal transaction links with pattern similarity greater than a preset threshold are screened and cluster analysis is performed on their transaction feature matrix to obtain the benchmark cluster center. The anomaly detection and determination module is used to calculate the deviation between the transaction feature matrix of the transaction link to be detected and the reference cluster center. If the deviation exceeds a dynamic threshold, it is determined to be an abnormal transaction link.

7. The transaction anomaly detection system based on financial analysis according to claim 6, characterized in that: The transaction node monitoring module is also used to: Calculate the first risk indicator based on the historical behavior data of the transaction subject node. If the indicator exceeds the subject credit threshold, it will be marked as an abnormal subject node; Calculate the second risk indicator based on the amount volatility of the transaction type node. If the indicator exceeds the type compliance threshold, the node is marked as an abnormal type. The third risk indicator is calculated based on the transaction frequency and sudden increase in amount at the time period node. If the indicator exceeds the period stability threshold, it is marked as an abnormal time node.

8. The transaction anomaly detection system based on financial analysis according to claim 6, characterized in that: The transaction link analysis module is further used to: The transaction link to be tested is evenly divided into N+2 segments along the time axis, generating N+1 segmentation points; Collect the transaction amount, counterparty characteristics, and operation time interval of each segment point to form a feature vector of length K; Perform differential operations on adjacent feature vectors to generate N differential feature vectors, which are then concatenated to form a transaction feature matrix of size N×K.

9. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store computer program code, the computer program code comprising computer instructions, and when the processor executes the computer instructions, the electronic device executes the transaction anomaly detection method based on financial analysis as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which includes program instructions. When the program instructions are executed by a processor of an electronic device, the processor executes the transaction anomaly detection method based on financial analysis according to any one of claims 1 to 5.

Images